Privacy Notice

IJ Marketing LTDA, CNPJ 64.704.051/0001-87, is the controller of the personal data described here. Our data protection officer is Jakson Lucas Campos, reachable at privacy@tylon.app.

This notice is written under the Lei Geral de Proteção de Dados (Lei 13.709/2018). It says what we hold, why, for how long, and what you can ask us to do about it.

We use a small number of processors, and each sees only what its job needs: GitHub and GitLab (the repositories you connect), Stripe (payments), Resend (the emails we send), and the model provider you chose, which receives what an agent sends it under your own key.

Some of these operate outside Brazil, so your data may be transferred internationally under the safeguards the LGPD allows. We do not sell personal data and we do not use it for advertising.

Board data lives as long as your workspace does. Agent transcripts are kept for the period your organization sets — they hold source code, so that is a decision we ask you to make rather than a default we choose. Sessions expire on their own, and a revoked one is removed immediately.

When you delete your account we remove every session, every provider link and every password reset, immediately and for real. The row that remains is scrubbed: your name becomes "a former member", your email becomes an address nobody can be found at, and your picture and password are removed.

What we keep is the work: the cards you opened, the comments you wrote and the releases you cut stay on the boards they belong to, without your name on them. They are the team's record of what happened, and removing them would rewrite somebody else's history. If that is not what you want, tell us before you delete and we will discuss what can be done.

Under the LGPD you may ask us to confirm what we hold, to give you a copy, to correct it, to anonymize or delete what is unnecessary or excessive, to tell you who we shared it with, and to withdraw consent where consent is what we relied on. Write to privacy@tylon.app and we will answer within fifteen days.

You may also complain to the Autoridade Nacional de Proteção de Dados if you believe we have not done right by you.

Tokens and model keys are encrypted at rest. Sessions are cookies the page cannot read. An agent runs in a container with no network access, unprivileged, with memory and process limits, and the only moment it reaches out is to install dependencies through a proxy restricted to its language's registries.

None of that makes a breach impossible. If one happens and it puts you at risk, we will tell you and the authority, as the law requires.

We set two, both necessary: one holds your session and one protects the sign-in round trip. There is no advertising or analytics cookie on this site.