Legal
Privacy Policy
Last updated: 12 July 2026. Effective for all users of Agilox.com.
1. Who We Are
Agilox.com is a warehouse automation preparation platform operated by Hyperlium UG (haftungsbeschränkt), Erkrather Str 401, 40231 Düsseldorf, Germany (hereinafter "we", "us", or "Hyperlium").
For questions about this policy or your personal data, contact us at [email protected].
2. What Data We Collect and Why
Assessment answers
When you complete the warehouse automation assessment, we collect your operational profile: industry, warehouse type and size, staffing situation, current technology, operating challenges, and decision context. This data is the foundation of the assessment and is required to generate your preparation workspace, situation summary, and planning outputs.
Legal basis: performance of the service you requested (Art. 6(1)(b) GDPR).
Account information
When you create a workspace, we collect your email address, and optionally your name, job title, and company name. Your email is used to authenticate you (via magic link), send your assessment results, and enable access to your dashboard from any device.
Legal basis: performance of the service you requested (Art. 6(1)(b) GDPR).
Email sharing
When you choose to share a document by email, we process the recipient email addresses you enter, any optional personal message you include, and your sender-copy preference. These are used solely to send the document you requested. Recipient addresses are not stored in our marketing systems, not added to mailing lists, and not used for any purpose beyond delivering the requested message.
Legal basis: performance of the service you requested (Art. 6(1)(b) GDPR).
Usage data and analytics
We use Plausible Analytics, a privacy-preserving analytics tool that does not use cookies and does not track individuals across sites. Plausible collects aggregated page view data only. No personal identifiers are processed by our analytics system.
Legal basis: legitimate interest in understanding how the platform is used to improve it (Art. 6(1)(f) GDPR). No consent is required for cookieless analytics.
Session cookies
We use strictly necessary cookies to maintain your session and save your assessment progress. These cookies are required for the platform to function. No marketing, tracking, or advertising cookies are used.
Legal basis: strictly necessary for the service (exempt from consent under ePrivacy Directive). See Section 7 for details.
3. How We Use Your Data
- Generating and displaying your preparation workspace, assessment summary, and planning outputs.
- Sending you your assessment results and workspace access link by email.
- Maintaining your workspace so you can access it from any device.
- Sending a document by email to recipients you specify, when you use the sharing feature.
- Generating an AI-assisted executive summary from anonymised assessment inputs.
- Improving the platform and its planning outputs using aggregated, anonymised patterns.
We do not sell your personal data. We do not use your data for advertising. We do not share your data with third parties except as described in Section 4.
4. Sub-Processors and Third Parties
We use the following third-party services to operate the platform. Each processes personal data only to the extent necessary for the specified function.
| Service | Purpose | Location |
|---|---|---|
| Supabase | Database and account storage | EU (Frankfurt) |
| Vercel | Platform hosting and edge delivery | EU |
| Resend | Transactional email delivery | US (SCCs apply) |
| Anthropic | AI-assisted executive summary generation (anonymised operational inputs only; no name, email, or company data is sent) | US (SCCs apply) |
| Plausible | Cookieless aggregated analytics | EU (Germany) |
SCCs = Standard Contractual Clauses (EU mechanism for lawful international transfers).
5. Data Retention
- Account and assessment data: retained for as long as your workspace is active. You may request deletion at any time (see Section 6).
- In-progress assessment drafts: automatically deleted when you save your workspace. If you do not save, drafts are deleted after 30 days.
- Email delivery logs: retained by Resend for up to 30 days in accordance with their data retention policy.
- Shared document attachments: generated at send time and not stored by us after delivery. Resend may retain delivery metadata for up to 30 days.
- Magic link tokens: expire after 24 hours (login links) or 72 hours (verification links) and are purged once used.
6. Your Rights Under GDPR
As a data subject under the GDPR, you have the following rights:
- Right of access: you may request a copy of all personal data we hold about you.
- Right to rectification: you may correct inaccurate data in your profile at any time via your account settings.
- Right to erasure: you may request deletion of your account and all associated data.
- Right to data portability: you may request your assessment data in a machine-readable format.
- Right to restriction: you may request that we limit processing of your data in certain circumstances.
- Right to object: you may object to processing based on legitimate interests.
- Right to lodge a complaint: you may lodge a complaint with the supervisory authority in your EU member state. Our lead authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Germany.
To exercise any of these rights, contact us at [email protected]. We respond within 30 days.
7. Cookies
We use only strictly necessary cookies. No third-party tracking or advertising cookies are set by this platform.
| Cookie | Purpose | Duration |
|---|---|---|
| agilox_pid | Maintains your authenticated session across devices. HttpOnly; not accessible to JavaScript. | 90 days |
| agilox_session | Indicates to the browser interface that a session exists, enabling correct UI rendering. | 90 days |
| agilox_draft | Saves your in-progress assessment so you can continue if you close your browser. | 30 days |
| agilox_locale | Stores your selected display language (English or German). No personal data. | 1 year |
| cookie_ack | Records that you have acknowledged this cookie notice. No personal data. | 1 year |
8. Data Security
All data is stored within the European Union on Supabase (Frankfurt region). Data is encrypted in transit (TLS 1.3) and at rest. Authentication uses time-limited one-time tokens delivered by email; no passwords are stored. Session cookies are marked HttpOnly and Secure, preventing access by scripts and requiring HTTPS.
9. Changes to This Policy
We may update this policy to reflect changes in the platform or applicable law. Material changes will be announced by email to registered users at least 14 days before taking effect. The current version is always available at this URL. The "last updated" date at the top of this page reflects the most recent revision.
10. Contact
Hyperlium UG (haftungsbeschränkt), Erkrather Str 401, 40231 Düsseldorf, Germany
Email: [email protected]