ArchX

Privacy Notice (United Kingdom)

Last updated: 12 October 2026

This notice applies to:

  • the ArchX desktop app for Mac and Windows (the ‘app’);
  • the online service for licence, trial, purchase, seats, invoices, updates and support, including its web pages such as ‘Download’, the purchase page for the United Kingdom and ‘Manage seats’ (the ‘service’).

It is addressed to customers with their place of business in the United Kingdom and to everyone whose data we process in this context, for example members of the customer’s staff who have a seat. It follows the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. As TYTOS has its registered office in Switzerland, the Swiss Federal Act on Data Protection (FADP) also applies.

1. Controller and UK representative

TYTOS GmbH
Arsenalstrasse 40
6010 Kriens
Switzerland
UID CHE-351.360.864

Data protection contact: support@frontierx.ch
More about us: Company information

Our representative in the United Kingdom under Article 27 UK GDPR: not yet appointed. We will name our representative here once appointed. Until then, you and the Information Commission can contact us directly at the address above on any question about how we process personal data.

2. The key points

  • We do not process your project data.
    • The app keeps drawings, documents, instructions, conversations and schedules of works on your device, not at TYTOS.
    • For the AI work, they go directly from your device to the AI provider you choose in the app: through your ChatGPT account to OpenAI, or with an API key to the provider of that key.
    • Your business and that provider are responsible for this, not TYTOS (section 3).
    • The app keeps an API key only in the operating system’s key store on your device. TYTOS never receives it.
  • We process only what we need for the contract and for running the service: your email address and installation ID for the licence; purchase and billing data, including your proof of business status; support reports; update requests and error codes.
  • UK optional usage counts must remain switched off unless you opt in. The service does not retain usage counts for UK practice accounts. The UK app release must apply the same default before delivery (section 4.11).
  • Project data reaches us only if you send it yourself: as an attachment with ‘Report a problem’ or by email to support. We then process it on your behalf under the Data Processing Terms.
  • A plain overview of what the app sends where, with our recommendations for personal data of your clients, is on the page Data and AI.

3. What does not reach us: project data and AI providers

What goes to the AI provider: the app works with OpenAI’s Codex core. For every instruction, the core sends the following to the AI provider you chose in the app (with an API key, through a compatibility layer in the app itself):

  • the text of the instruction, attachments and the conversation so far;
  • the content of files the agent reads;
  • tool results and images;
  • the beginning of a new instruction, so that the provider can suggest a title for the conversation;
  • if ‘Approve for me’ is selected, the agent’s requests for approval, which an AI then decides on.

Which provider: the connection runs directly from your device to the provider, without any service in between. TYTOS does not receive this data, sees neither content nor keys and is neither controller nor processor for this processing. The provider depends on how you set up AI access in the app:

  • Your ChatGPT account: the data goes to OpenAI.
  • An API key: the data goes to the provider of the key. You can choose:
    • OpenAI (api.openai.com);
    • Anthropic (api.anthropic.com);
    • Google (generativelanguage.googleapis.com);
    • Mistral (api.eu.mistral.ai): the app uses Mistral’s European location, with data centres in the EU or in a European Free Trade Association (EFTA) country;
    • xAI (api.x.ai).

With your ChatGPT account: your contract and OpenAI’s privacy terms apply. Your password and the access tokens of your ChatGPT account stay with OpenAI or in the operating system’s key store on your device. From the account, the service receives at most its email address (sections 4.1 and 4.8).

Whether OpenAI uses your content for training depends on your plan and your settings. According to OpenAI, content from ChatGPT Business, Enterprise and Edu is not used for training by default (OpenAI: Enterprise privacy). With Plus and Pro, it is used as long as the setting to improve the model is switched on; according to OpenAI, this setting also applies to tasks through Codex and therefore through ArchX (OpenAI: Data Controls).

Personal data of your clients and of others in your documents: for this data, your business is the controller, and the AI provider you choose processes it under your contract with that provider. We recommend ChatGPT Business or Enterprise, or an API key, with the provider’s data processing terms, for documents that contain personal data; with Plus or Pro, at least switch off the setting to improve the model. Details are on the page Data and AI.

With an API key: your business enters into a contract for the use of the models directly with the provider. Its business or API terms and privacy terms apply, and the provider bills your business directly.

  • The app checks the key with the provider and keeps it only in the operating system’s key store on your device: on a Mac in the Keychain, on Windows in the Credential Manager. The key is not stored in any file and is sent only to the chosen provider.
  • According to the providers (checked on 7 October 2026), OpenAI, Anthropic, Google and xAI do not use API data to train their models by default. For Google, this applies to the paid tier. For applications available to users in the European Economic Area, Switzerland or the United Kingdom, Google allows only the paid tier, and for users there Google applies the data rules of the paid tier to all tiers (Gemini API Additional Terms). With Mistral, you must switch training off in your Mistral account.
  • To detect abuse, OpenAI, Anthropic, Mistral and xAI keep API data for up to 30 days, and Google for 55 days; longer if a breach of their terms is suspected. Each provider sets out the details in its terms and documentation.

What the core itself could report: the Codex core has its own features for usage statistics, metrics and feedback to OpenAI. The app switches them off each time it starts the core. The app itself contains no analytics, tracking or crash-reporting component.

Tools you connect yourself: the browser tool, Model Context Protocol (MCP) servers, plugins and account apps connect to the providers you choose. You or the provider concerned are responsible for these data flows.

Downloads directly from third parties: the app fetches some components and public data directly from their source. These sources see your IP address but receive no data from us:

  • new versions of the Codex core from npm (registry.npmjs.org), only versions we have released;
  • directories of plugins and apps that the Codex core fetches from OpenAI or chatgpt.com and from the providers of the plugins, and plugin directories you add yourself, for example from GitHub;
  • the list of bank holidays in England and Wales from GOV.UK (www.gov.uk), when the agent writes a tender letter with dates;
  • your practice’s own website, only after you have confirmed that the agent may read it;
  • on Windows, the speech model from Hugging Face, only if you set up speech input;
  • on a Mac, language packs from Apple;
  • on Windows, spell-checking dictionaries from a Google server. According to Electron, no input is transmitted.

4. What data we process and why

The contract as lawful basis: where we name the contract as the lawful basis (Article 6(1)(b) UK GDPR), we mean the contract with your business. If you are not a party yourself, for example as a member of the customer’s staff with a seat, we rely to that extent on our legitimate interest in performing the contract with your business (Article 6(1)(f) UK GDPR).

What you have to provide: without a licence email address, the app cannot hold a licence. Without the practice’s name, email address, billing address and proof of business status, we cannot complete a purchase. The referral code and the usage counts are voluntary.

4.1 Sign-in and licence (app)

  • Data:
    • your licence email address: with a ChatGPT account, initially the email address of the ChatGPT account, which the app reads from the sign-in with OpenAI, or another address you enter in the app and confirm with a code (section 4.2); with an API key, always an address you enter and confirm in this way;
    • a random installation ID the app creates once;
    • operating system (Mac or Windows), processor type, version of the app and of the Codex core;
    • the time of the check and the licence status;
    • the IP address of the request; to limit requests, we store only hashed values of IP and email addresses; in addition, Vercel’s server logs (section 4.12).
  • When: when the app starts and then every 24 hours.
  • Purpose:
    • to check the licence and return it signed;
    • to enforce the limit of 2 active devices per seat;
    • to tell the app which update version has been released;
    • to detect abuse.
  • Lawful basis:
    • contract (Article 6(1)(b) UK GDPR);
    • for detecting abuse and limiting requests: our legitimate interest in a secure service (Article 6(1)(f) UK GDPR);
    • for accessing information on your device: it is strictly necessary to provide the service you have requested, in particular to check the licence and to prevent fraud (Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6 and Schedule A1, paragraph 4).

4.2 Device confirmation

  • When:
    • for paid and free seats: each device must be confirmed once with a code sent to the seat’s email address;
    • if you enter a licence email address in the app that is not the address of your ChatGPT account, you confirm it in the same way, even during the trial; with an API key, you always enter the address yourself and confirm it in this way;
    • otherwise, there is no device confirmation during the trial.
  • How: we send a 6-digit code to this email address. The code is valid for 15 minutes. The installation then receives a confirmation key.
  • What we store: the code and the key only as hashed values, together with the installation ID, the email address, the time of the confirmation and the device details from section 4.1.
  • Purpose: to prevent anyone from using a seat with someone else’s email address.
  • Lawful basis: contract (Article 6(1)(b) UK GDPR).

4.3 Trial

  • Data: email address, start and end of the trial, the installation that started it, and the version of the terms the app showed when AI access was set up, with the time.
  • Practice account: at the start of the trial, the service creates a practice account, with you as admin and your address as its first seat.
  • Practice name: if the app starts the trial automatically, the service derives the name from the domain of your email address; for public email providers, it uses ‘My practice’. Your admin can change it.
  • Purpose: to grant the trial, to show which version of the terms was accepted and to make sure each address receives the trial only once.
  • Lawful basis: contract (Article 6(1)(b) UK GDPR).

4.4 Purchase, practice account and seats

  • Data:
    • on the purchase page: name of the practice, email address, number of seats, billing address, your proof of business status (section 4.5), billing interval and, optionally, a referral code;
    • the time of the order and the version of the terms you accepted;
    • for the seats: the email addresses your admin assigns, and who assigned them and when;
    • admin accounts: email address and role;
    • free seats TYTOS provides to your practice.
  • Purpose: to conclude the contract and show that it was concluded, to manage seats, to send invitations and to link the purchase to the referral partner who introduced you.
  • Lawful basis: contract (Article 6(1)(b) UK GDPR).

4.5 Proof of business status

  • What: we sell in the United Kingdom only to businesses, because our invoice carries no UK VAT and you account for VAT under the reverse charge. Before the purchase, you provide one of the following as proof of business status: your UK VAT registration number, your Companies House number, or the Architects Registration Board (ARB) registration number of the architect who runs the practice, together with the practice’s website address.
  • Who checks it: the service checks only the format. Stripe checks a UK VAT number with HM Revenue & Customs (HMRC); for this, Stripe passes the number to HMRC. TYTOS checks a Companies House number in the public register of Companies House and an ARB registration in the public Register of Architects and on the practice’s website, and records the result, the time and who checked it.
  • What we store: the type of proof and its number, the practice’s name and website as you gave them, the status of the check and the note of the person who checked it.
  • Purpose: to show that we sold to a business and that the reverse charge applies, and to keep the evidence HMRC expects a supplier to keep.
  • Lawful basis: contract (Article 6(1)(b) UK GDPR) and our legitimate interest in handling VAT correctly on our sales and in being able to show this (Article 6(1)(f) UK GDPR).

4.6 Billing

  • Data:
    • practice name, billing address, proof of business status, invoice email address;
    • subscription, number of seats, payment method, invoices;
    • payment events: amount, tax details, time, status.
  • Payment details such as card numbers are entered directly with Stripe. We do not receive them.
  • Purpose: invoicing, receiving payments, reminders, accounting and commission to referral partners who introduced you.
  • Lawful basis:
    • contract (Article 6(1)(b) UK GDPR);
    • retention under TYTOS’s legal obligation under Swiss law (Art. 958f Swiss Code of Obligations) and our legitimate interest in meeting it (Article 6(1)(f) UK GDPR);
    • for the commission to referral partners who introduced you: our legitimate interest (Article 6(1)(f) UK GDPR).

4.7 The ‘Manage seats’ page

  • Sign-in: with a link sent by email. The link is valid for 15 minutes and can be used only once.
  • Cookie: for the session, we set a strictly necessary cookie. It lasts 12 hours or until you sign out.
  • Lawful basis: contract (Article 6(1)(b) UK GDPR); for the cookie: it is strictly necessary to provide the page you have requested (Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6 and Schedule A1, paragraph 4).

4.8 Support

How to contact support: by email to support@frontierx.ch or with the ‘Report a problem’ button in the app.

What ‘Report a problem’ always sends. Nothing is sent until you click to send. Before that, you see your text and the attachments you choose; the following details are always added:

  • installation ID and the email address of the ChatGPT account (if you are signed in with ChatGPT);
  • operating system and its version, processor type, version of the app and of the core;
  • with ChatGPT: plan and remaining allowance as a percentage;
  • whether a specification catalogue is connected (yes or no), and the licence status;
  • up to 50 recent error codes with their time, for example ‘ACC-003’;
  • your text.

Only if you choose it: up to 2 attachments – a screenshot of the app window, messages you select one by one (at most 40), or both. These can contain project data.

Never included automatically: the log of the Codex core, conversations, project files, the specification catalogue, sign-in details and API keys.

What the service adds: practice, seat and licence status from its own data, so that we can match the report to your account.

Where: the service stores reports and attachments in its database in Zurich. We do not currently use an external support tool. Emails to support are kept in the mailbox at Infomaniak in Switzerland. The service fetches them there and stores sender, subject, date and text in the same database in Zurich; attachments stay only in the mailbox, and the service records their name and size. We use other tools or AI services for support data only if they are named in section 5 and in the Data Processing Terms.

Purpose: to answer your request and fix errors. If you gave an email address, we confirm receipt by email; the confirmation contains only the number of the report.

Lawful basis:

  • contract (Article 6(1)(b) UK GDPR);
  • if your text, attachments or emails contain personal data from your projects, we process it as a processor, only on your behalf and only for your request (Article 28 UK GDPR). The Data Processing Terms, an annex to the Licence Terms, apply to this.

4.9 Updates and downloads

  • Data: IP address, time, channel, operating system, processor type and the file requested. This data is recorded in Vercel’s standard server logs (section 5).
  • Purpose: to deliver updates and installation packages, and to prevent abuse.
  • Lawful basis: contract and our legitimate interest in secure delivery (Article 6(1)(b) and (f) UK GDPR).

4.10 Error codes

  • What the app stores: only error codes with their time, locally on your device; no message text, paths or content.
  • When they reach us: only with ‘Report a problem’ (section 4.8).

4.11 Optional usage counts

The service does not retain optional usage counts for UK practice accounts. Licence verification and necessary device-security data still operate as described in section 4.1.

The UK app release must keep optional usage counting and access to those counts switched off unless you actively opt in after receiving a clear explanation. Declining or withdrawing consent must not affect licence access. This default is a condition of UK app delivery; a release that still counts by default is not covered by this notice.

Any future introduction of optional UK usage analytics requires an updated notice and a corresponding consent mechanism before collection (Article 6(1)(a) UK GDPR and regulation 6 PECR, where applicable).

4.12 Web pages of the service

Server logs: IP address, time, page requested, browser; kept at Vercel, for delivery and security.

  • Lawful basis: our legitimate interest in secure delivery (Article 6(1)(f) UK GDPR).

Cookies and analytics: the web pages set only the session cookie of the ‘Manage seats’ page (section 4.7) and, for people at TYTOS, a session cookie for TYTOS’s internal administration pages. We use no analytics or advertising cookies and no tracking tools.

Campaign and referral links: links can carry a referral code (‘ref’) and campaign tags (‘utm_source’, ‘utm_medium’, ‘utm_campaign’, ‘utm_term’, ‘utm_content’). The service accepts bounded campaign labels only. They link a trial or purchase to the introducing campaign or referral partner, without advertising cookies, device fingerprinting, email-open tracking or collecting browsing history. The lawful basis is our legitimate interest in understanding which campaigns lead to contracts (Article 6(1)(f) UK GDPR). You may remove these tags from the address before using the link or object to this processing. Trial attribution is kept with the practice account; paid-order attribution follows the accounting retention period.

Contact by email: we use your details to answer your request (Article 6(1)(b) or (f) UK GDPR).

4.13 Emails from the service

The service sends emails through Resend: sign-in links, device codes, invitations, order confirmations and confirmations of changes to the subscription, a reminder one day before the end of the trial, invoices, confirmations of a cancellation and acknowledgements of support reports. For this, Resend receives the recipient’s address and the content of these emails. The service sends no marketing emails.

  • Lawful basis: contract (Article 6(1)(b) UK GDPR).

4.14 Referral partners

For people who refer customers to us, we process:

  • name, email address, postal address, evidence of their business or self-employment, and their tax status;
  • bank details and commission statements.

We process this data to perform the referral contract and for our accounting (Article 6(1)(b) and (f) UK GDPR).

5. Recipients, places of storage and safeguards

We pass data only to recipients we need to run the service. They act as processors on our behalf and on our instructions, unless stated otherwise. For each recipient, we name the country and the safeguard.

  • Vercel Inc., USA: running the service and its web pages; storing the installation packages and updates in Vercel Blob.
    • The functions of the service and the Blob storage run in Frankfurt (Germany). Delivery goes through Vercel’s worldwide network, which caches content; Vercel also processes data in the USA.
    • Safeguard: Vercel’s Data Processing Addendum, including its UK transfer addendum. Transfers covered by its current UK Extension certification can use the UK-US data bridge; the contractual UK addendum provides the applicable alternative.
  • Supabase Pte. Ltd., Singapore: database of the service, stored in Zurich (Switzerland) at Amazon Web Services. Supabase and its sub-processors, such as Supabase, Inc. in the USA for support, may occasionally access it from other countries.
    • Safeguard: the Supabase Data Processing Addendum, Schedule 2, including the UK Addendum to the standard contractual clauses for relevant onward transfers. The DPA is incorporated into the service terms.
  • Stripe: payments, invoices and customer portal. Our contracting party is Stripe Payments Europe, Limited (Ireland), and for payment services in Switzerland also Stripe Payments UK Ltd (United Kingdom). Stripe passes data to Stripe, LLC in the USA. Stripe acts partly as a controller in its own right, for example for fraud prevention and because of legal obligations.
    • Safeguard: Stripe’s Data Processing Agreement and Data Transfer Agreement. Relevant transfers to Stripe, LLC use its UK Extension certification where applicable, with the UK Addendum to the standard contractual clauses as the contractual alternative.
  • Resend (Plus Five Five, Inc.), USA: sending the service’s emails (section 4.13). The data is stored in the USA.
    • Safeguard: the Resend Data Processing Agreement, including its UK Addendum to the standard contractual clauses. Resend incorporates this DPA into every account’s terms automatically; no separate signature is required.
  • Infomaniak Network SA, Geneva: email mailbox for contact and support. The data is stored in Switzerland (adequacy, section 6).
  • HM Revenue & Customs (HMRC): Stripe checks a UK VAT number there (section 4.5). Only the number is passed on. HMRC does not act on our behalf.
  • Help Scout PBC, USA: not currently used. Before we process support reports there, we will amend this notice and announce it under the Data Processing Terms.

In addition, where necessary, our tax and legal advisers, and authorities where the law requires it.

The AI providers, that is OpenAI and the providers of the API keys, are not recipients of data we process. The connection to them runs through your own ChatGPT account or your own API key (section 3).

6. Transfers outside the United Kingdom

Switzerland: TYTOS has its registered office in Switzerland, and the service's database is in Zurich. The United Kingdom recognises Switzerland as providing an adequate level of protection (Data Protection Act 2018, Schedule 21, paragraph 5). Personal data from UK practices may therefore be transferred to TYTOS without additional safeguards.

Ireland and other countries of the European Economic Area: the United Kingdom recognises them as adequate.

USA and other countries:

  • For organisations in the USA certified under the UK Extension to the EU-U.S. Data Privacy Framework, the UK-US data bridge applies (Data Protection (Adequacy) (United States of America) Regulations 2023).
  • Otherwise the UK Addendum to the EU standard contractual clauses in the recipient’s data processing terms applies. Section 5 names the safeguard for each recipient.

We also observe the rules of the Swiss FADP for disclosures abroad (Art. 16 FADP). On request, we will give you a copy of the safeguards.

7. Retention and deletion

The service deletes expired data in a daily run.

  • Sign-in links and device codes: valid for 15 minutes and stored only as hashed values. The daily run deletes expired device codes and sign-in links, the latter one day after expiry. Sessions of the ‘Manage seats’ page end after 12 hours.
  • Hashed values of IP and email addresses used to limit requests: about 2 hours.
  • Installations (ID, device, versions, device confirmation, last seen): we delete them 24 months after the last activity, that is, the last licence check. We delete usage counts 24 months after the day counted.
  • Support reports: we delete them 24 months after receipt.
  • Attachments of support reports: deleted in the service 30 days after they were forwarded to the support inbox, and in any event no later than 90 days after receipt. As long as we do not use an external support inbox, they are deleted 90 days after receipt. We delete emails to support once they are no longer needed, and in any event no later than 24 months after receipt.
  • Practice accounts, seats and admin accounts: kept during the trial or the contract. If the trial ends without a purchase or the contract ends, we anonymise the personal data in the practice account, such as email addresses, 24 months after the end.
  • Invoices, payment events, orders with their proof of business status, and commission statements: 10 years from the end of the financial year (Art. 958f Swiss Code of Obligations), then deleted.
  • Referral partners: during the referral contract; statements and payment details for 10 years afterwards (Art. 958f Swiss Code of Obligations).
  • Server and download logs and data at Stripe: according to the providers’ retention periods.

8. Your rights

You have the right to:

  • access your data (Article 15 UK GDPR), free of charge and within one month (Article 12(3) UK GDPR);
  • have inaccurate data corrected (rectification, Article 16 UK GDPR);
  • have your data deleted (erasure, Article 17 UK GDPR), unless we are legally required to keep it;
  • restrict processing (Article 18 UK GDPR);
  • receive your data in a structured, commonly used and machine-readable format (data portability, Article 20 UK GDPR);
  • withdraw any consent we ask you for at any time, without affecting processing before the withdrawal (Article 7(3) UK GDPR).

If we rectify, erase or restrict data, we tell the recipients to whom we disclosed it, where this is possible and proportionate (Article 19 UK GDPR).

Right to object (Article 21 UK GDPR): where we process your data on the basis of our legitimate interest (Article 6(1)(f) UK GDPR), you can object at any time on grounds relating to your particular situation. You can switch the usage counts off in the app at any time without giving reasons (section 4.11).

How: write to support@frontierx.ch. We may ask for proof of identity.

Complaints to us: you can complain to us about how we handle your personal data, by email to support@frontierx.ch with the subject ‘Data protection complaint’. We acknowledge receipt within 30 days, look into your complaint without undue delay and tell you the outcome (section 164A of the Data Protection Act 2018).

Complaints to the regulator: you also have the right to complain to the Information Commission, the UK data protection regulator (ico.org.uk). In Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) is responsible.

9. Security

Protection in transit:

  • encrypted transmission between the app and the service;
  • signed licences.

Access:

  • row-level security in the database; only the service itself can read and write data;
  • the service’s secret keys for signatures, payment, email and the database are kept only in the service, never in the app;
  • sign-in links, device codes and keys are stored only as hashed values.

Data minimisation:

  • the service accepts only the defined fields and rejects all others;
  • the interface between the app and the service does not allow project content, file names, paths, conversation text, specification or standard clauses or API keys to be sent;
  • the service’s logs contain no email addresses and no content.

Personal data breaches: we notify the Information Commission without undue delay and, where feasible, within 72 hours of any breach that is likely to result in a risk to people’s rights and freedoms (Article 33 UK GDPR), and inform the people concerned where the risk is high (Article 34 UK GDPR).

10. Automated decisions

The licence check automatically switches the app to read-only mode depending on the status of the trial, of the payment or of the seat. The app tells you when this happens. For such a switch we give you the safeguards of Article 22C UK GDPR: you can make representations to us, ask for a person at TYTOS to review the switch and contest it, by writing to support@frontierx.ch. We make no other decisions about you based solely on automated processing.

11. Changes

We update this notice when the app, the service or the law changes. The version published here applies. We tell admins about material changes by email.