ArchX

Privacy Notice (United States)

Last updated: October 13, 2026

This notice applies to:

  • the ArchX desktop app for Mac and Windows (the “app”);
  • the online service for license, trial, purchase, seats, invoices, updates and support, including its web pages such as the download page, the purchase page for the United States and “Manage seats” (the “service”).

It is addressed to customers with their place of business in the United States and to everyone whose data we process in this context, for example members of the customer’s staff who have a seat. TYTOS has its registered office in Switzerland; our processing follows the Swiss Federal Act on Data Protection (FADP). Nothing in this notice limits rights you have under a law that applies to you.

ArchX is offered to businesses only. It is not directed to children, and we do not knowingly process personal data of children.

1. Who we are

TYTOS GmbH
Arsenalstrasse 40
6010 Kriens
Switzerland
UID CHE-351.360.864

Data protection contact: support@frontierx.ch
More about us: Company information

2. The key points

  • We do not process your project data.
    • The app keeps drawings, documents, instructions, conversations, quantities and cost data on your device, not at TYTOS.
    • For the AI work, they go directly from your device to the AI provider you choose in the app: through your ChatGPT account to OpenAI, or with an API key to the provider of that key.
    • Your business and that provider are responsible for this, not TYTOS (section 3).
    • The app keeps an API key only in the operating system’s key store on your device. TYTOS never receives it.
  • We process only what we need for the contract and for running the service: your email address and installation ID for the license; purchase and billing data, including your billing address in the United States and your confirmation that you buy for your business; support reports; update requests and error codes.
  • No usage counts from U.S. practices. The service does not store the optional daily usage counts for practices in the United States (section 4.11).
  • No sale, no tracking. We do not sell personal information, and we do not share it for cross-context behavioral advertising. The app contains no analytics or tracking component, and our web pages use no analytics or advertising cookies.
  • Project data reaches us only if you send it yourself: as an attachment with “Report a problem” or by email to support. We then process it only on your behalf and only to deal with your request (section 4.8).
  • A plain overview of what the app sends where, with our recommendations for personal data of your clients, is on the page Data and AI.

3. What does not reach us: project data and AI providers

What goes to the AI provider: the app works with OpenAI’s Codex core. For every instruction, the core sends the following to the AI provider you chose in the app (with an API key, through a compatibility layer in the app itself):

  • the text of the instruction, attachments and the conversation so far;
  • the content of files the agent reads;
  • tool results and images;
  • the beginning of a new instruction, so that the provider can suggest a title for the conversation;
  • if “Approve for me” is selected, the agent’s requests for approval, which an AI then decides on.

Which provider: the connection runs directly from your device to the provider, without any service in between. TYTOS does not receive this data, sees neither content nor keys and is neither controller nor processor for this processing. The provider depends on how you set up AI access in the app:

  • Your ChatGPT account: the data goes to OpenAI.
  • An API key: the data goes to the provider of the key. You can choose:
    • OpenAI (api.openai.com);
    • Anthropic (api.anthropic.com);
    • Google (generativelanguage.googleapis.com);
    • Mistral (api.eu.mistral.ai): the app uses Mistral’s European location, with data centers in the EU or in a European Free Trade Association (EFTA) country;
    • xAI (api.x.ai).

With your ChatGPT account: your contract and OpenAI’s privacy terms apply. Your password and the access tokens of your ChatGPT account stay with OpenAI or in the operating system’s key store on your device. From the account, the service receives at most its email address (sections 4.1 and 4.8).

Whether OpenAI uses your content for training depends on your plan and your settings. According to OpenAI, content from ChatGPT Business, Enterprise and Edu is not used for training by default (OpenAI: Enterprise privacy). With Plus and Pro, it is used as long as the setting to improve the model is switched on; according to OpenAI, this setting also applies to tasks through Codex and therefore through ArchX (OpenAI: Data Controls).

Personal data of your clients and of others in your documents: your business decides how this data is used and is responsible for it, and the AI provider you choose processes it under your contract with that provider. We recommend ChatGPT Business or Enterprise, or an API key, with the provider’s data processing terms, for documents that contain personal data; with Plus or Pro, at least switch off the setting to improve the model. Details are on the page Data and AI.

With an API key: your business enters into a contract for the use of the models directly with the provider. Its business or API terms and privacy terms apply, and the provider bills your business directly.

  • The app checks the key with the provider and keeps it only in the operating system’s key store on your device: on a Mac in the Keychain, on Windows in the Credential Manager. The key is not stored in any file and is sent only to the chosen provider.
  • According to the providers (checked in October 2026), OpenAI, Anthropic, Google and xAI do not use API data to train their models by default. For Google, this applies only to the paid tier: according to Google’s Gemini API Additional Terms, Google uses content submitted to its unpaid services to provide, improve and develop its products, so use a key with the paid tier. With Mistral, you must switch training off in your Mistral account.
  • To detect abuse, OpenAI, Anthropic, Mistral and xAI keep API data for up to 30 days, and Google for 55 days; longer if a breach of their terms is suspected. Each provider sets out the details in its terms and documentation.

What the core itself could report: the Codex core has its own features for usage statistics, metrics and feedback to OpenAI. The app switches them off each time it starts the core. The app itself contains no analytics, tracking or crash-reporting component.

Tools you connect yourself: the browser tool, Model Context Protocol (MCP) servers, plugins and account apps connect to the providers you choose. You or the provider concerned are responsible for these data flows.

Downloads directly from third parties: the app fetches some components and public data directly from their source. These sources see your IP address but receive no data from us:

  • new versions of the Codex core from npm (registry.npmjs.org), only versions we have released;
  • directories of plugins and apps that the Codex core fetches from OpenAI or chatgpt.com and from the providers of the plugins, and plugin directories you add yourself, for example from GitHub;
  • your practice’s own website, only after you have confirmed that the agent may read it;
  • on Windows, the speech model from Hugging Face, only if you set up speech input;
  • on a Mac, language packs from Apple;
  • on Windows, spell-checking dictionaries from a Google server. According to Electron, no input is transmitted.

4. What data we process and why

What you have to provide: without a license email address, the app cannot hold a license. Without the practice’s name, email address, billing address in the United States and your confirmation that you buy for your business, we cannot complete a purchase. A discount or referral code is voluntary.

4.1 Sign-in and license (app)

  • Data:
    • your license email address: with a ChatGPT account, initially the email address of the ChatGPT account, which the app reads from the sign-in with OpenAI, or another address you enter in the app and confirm with a code (section 4.2); with an API key, always an address you enter and confirm in this way;
    • a random installation ID the app creates once;
    • operating system (Mac or Windows), processor type, version of the app and of the Codex core;
    • the time of the check and the license status;
    • the IP address of the request; to limit requests, we store only hashed values of IP and email addresses; in addition, Vercel’s server logs (section 4.12).
  • When: when the app starts and then every 24 hours.
  • Purpose:
    • to check the license and return it signed;
    • to enforce the limit of 2 active devices per seat;
    • to tell the app which update version has been released;
    • to detect abuse and to keep the service secure.

4.2 Device confirmation

  • When:
    • for paid and free seats: each device must be confirmed once with a code sent to the seat’s email address;
    • if you enter a license email address in the app that is not the address of your ChatGPT account, you confirm it in the same way, even during the trial; with an API key, you always enter the address yourself and confirm it in this way;
    • otherwise, there is no device confirmation during the trial.
  • How: we send a 6-digit code to this email address. The code is valid for 15 minutes. The installation then receives a confirmation key.
  • What we store: the code and the key only as hashed values, together with the installation ID, the email address, the time of the confirmation and the device details from section 4.1.
  • Purpose: to prevent anyone from using a seat with someone else’s email address.

4.3 Trial

  • Data: email address, start and end of the trial, the installation that started it, and the version of the License Terms you accepted in the app by clicking “Connect with ChatGPT,” “Connect” or “Start trial” directly above the line that names them (License Terms, section 1.5), with the time the trial started. The app keeps that version and the time of your click on your device; it sends only the version.
  • Practice account: at the start of the trial, the service creates a practice account, with you as admin and your address as its first seat.
  • Your practice’s admin: if an admin of a practice account uses an email address on the same domain as yours (not a public email provider), the “Manage seats” page shows them your address and the date your trial started, but not how you use ArchX.
  • Practice name: if the app starts the trial automatically, the service derives the name from the domain of your email address; for public email providers, it uses “My office.” Your admin can change it.
  • Purpose: to grant the trial, to show which version of the terms was accepted and to make sure each address receives the trial only once.

4.4 Purchase, practice account and seats

  • Data:
    • on the purchase page: name of the practice, email address, number of seats, billing address in the United States (section 4.5), billing interval, your confirmation that you buy for your business, for yearly billing the initials you enter to confirm the automatic renewal, and, optionally, a discount or referral code;
    • the time of the order, the version of the terms you accepted and, for yearly billing, the time you entered your initials;
    • for the seats: the email addresses your admin assigns, and who assigned them and when;
    • admin accounts: email address and role;
    • free seats TYTOS provides to your practice.
  • Purpose: to conclude the contract and show that it was concluded, to manage seats, to send invitations, to apply a discount and to link the purchase to the referral partner who introduced you.

4.5 Business confirmation and billing address

  • What: we sell in the United States only to businesses. On the purchase page, you confirm by ticking a box that you buy for your business and not as a consumer, and you give a billing address in the United States: street, city, state and ZIP code.
  • What we store: the confirmation with the time it was given, and the billing address. Stripe also receives the billing address for the payment and the invoice (section 4.6).
  • Purpose: to show that we sold to a business in the United States, to issue correct invoices and to determine which taxes apply to the purchase.

4.6 Billing

  • Data:
    • practice name, billing address, invoice email address;
    • subscription, number of seats, payment method, invoices;
    • payment events: amount, tax details, time, status.
  • Payment details such as card numbers are entered directly with Stripe. We do not receive them.
  • Purpose: invoicing, receiving payments, reminders, accounting and commission to referral partners who introduced you. We keep accounting records as Swiss law requires (Art. 958f Swiss Code of Obligations).

4.7 The “Manage seats” page

  • Sign-in: with a link sent by email. The link is valid for 15 minutes and can be used only once.
  • Cookie: for the session, we set a strictly necessary cookie. It lasts 12 hours or until you sign out.
  • Purpose: to let your admin manage seats, invoices and payment methods.

4.8 Support

How to contact support: by email to support@frontierx.ch or with the “Report a problem” button in the app.

What “Report a problem” always sends. Nothing is sent until you click to send. Before that, you see your text and the attachments you choose; the following details are always added:

  • installation ID and the email address of the ChatGPT account (if you are signed in with ChatGPT);
  • operating system and its version, processor type, version of the app and of the core;
  • with ChatGPT: plan and remaining allowance as a percentage;
  • whether a specification catalog is connected (yes or no), and the license status;
  • up to 50 recent error codes with their time, for example “ACC-003”;
  • your text.

Only if you choose it: up to 2 attachments – a screenshot of the app window, messages you select one by one (at most 40), or both. These can contain project data.

Never included automatically: the log of the Codex core, conversations, project files, the specification catalog, sign-in details and API keys.

What the service adds: practice, seat and license status from its own data, so that we can match the report to your account.

Where: the service stores reports and attachments in its database in Zurich. We do not currently use an external support tool. Emails to support are kept in the mailbox at Infomaniak in Switzerland. The service fetches them there and stores sender, subject, date and text in the same database in Zurich; attachments stay only in the mailbox, and the service records their name and size. We use other tools or AI services for support data only if they are named in section 5.

Purpose: to answer your request and fix errors. If you gave an email address, we confirm receipt by email; the confirmation contains only the number of the report.

Project data in support: if your text, attachments or emails contain personal data from your projects, we process it only on behalf of your business and only to deal with your request, under the commitments in section 13.4 of the License Terms.

4.9 Updates and downloads

  • Data: IP address, time, channel, operating system, processor type and the file requested. This data is recorded in Vercel’s standard server logs (section 5).
  • Purpose: to deliver updates and installation packages, and to prevent abuse.

4.10 Error codes

  • What the app stores: only error codes with their time, locally on your device; no message text, paths or content.
  • When they reach us: only with “Report a problem” (section 4.8).

4.11 Optional usage counts

The app can count, per day, how often it started, how many specification files its tools created, whether the initial setup is complete and how often the core crashed, without any content. From practices in the United States, the service does not store these counts. License verification and the device data needed for security still work as described in section 4.1.

If we ever want to keep such counts for practices in the United States, we will update this notice first.

4.12 Web pages of the service

Server logs: IP address, time, page requested, browser; kept at Vercel, for delivery and security.

Cookies and analytics: the web pages set only the session cookie of the “Manage seats” page (section 4.7) and, for people at TYTOS, a session cookie for TYTOS’s internal administration pages. We use no analytics or advertising cookies and no tracking tools.

“Do Not Track” and similar signals: our web pages do not track you over time or across other websites, and they allow no third party to do so. They therefore work the same whether or not your browser sends a “Do Not Track” or Global Privacy Control signal.

Campaign and referral links: links can carry a referral code (ref) and campaign tags (utm_source, utm_medium, utm_campaign, utm_term and utm_content). The service accepts bounded campaign labels only. They link a trial or purchase to the introducing campaign or referral partner, without advertising cookies, device fingerprinting, email-open tracking or collecting browsing history. We use them to understand which campaigns lead to contracts. You may remove these tags from the address before using the link, or object to this processing by writing to us. Trial attribution is kept with the practice account; paid-order attribution follows the accounting retention period.

Contact by email: we use your details to answer your request.

4.13 Emails from the service

The service sends emails through Resend: sign-in links, device codes, invitations, order confirmations and confirmations of changes to the subscription, a reminder one day before the end of the trial, invoices, confirmations of a cancellation and acknowledgments of support reports. For this, Resend receives the recipient’s address and the content of these emails. The service sends no marketing emails.

4.14 Referral partners

For people who refer customers to us, we process:

  • name, email address, postal address, evidence of their business or self-employment, and their tax status;
  • bank details and commission statements.

We process this data to perform the referral contract and for our accounting.

5. Recipients and places of storage

We pass data only to recipients we need to run the service. They act as processors on our behalf and on our instructions, unless stated otherwise. For each recipient, we name the country and its data processing terms.

  • Vercel Inc., USA: running the service and its web pages; storing the installation packages and updates in Vercel Blob.
    • The functions of the service and the Blob storage run in Frankfurt (Germany). Delivery goes through Vercel’s worldwide network, which caches content; Vercel also processes data in the USA.
    • Terms: Vercel’s Data Processing Addendum.
  • Supabase Pte. Ltd., Singapore: database of the service, stored in Zurich (Switzerland) at Amazon Web Services. Supabase and its sub-processors, such as Supabase, Inc. in the USA for support, may occasionally access it from other countries.
  • Stripe: payments, invoices and customer portal. Our contracting party is Stripe Payments Europe, Limited (Ireland), and for payment services in Switzerland also Stripe Payments UK Ltd (United Kingdom). Stripe passes data to Stripe, LLC in the USA. Stripe acts partly as a controller in its own right, for example for fraud prevention and because of legal obligations.
  • Resend (Plus Five Five, Inc.), USA: sending the service’s emails (section 4.13). The data is stored in the USA.
  • Infomaniak Network SA, Geneva: email mailbox for contact and support. The data is stored in Switzerland.
  • Referral partners who introduced you: for their commission, they receive a monthly statement with your practice’s name, the date and the net amount of your payments. They are not our processors.
  • Help Scout PBC, USA: not currently used. Before we process support reports there, we will amend this notice.

In addition, where necessary, our tax and legal advisers, and authorities where the law requires it.

The AI providers, that is OpenAI and the providers of the API keys, are not recipients of data we process. The connection to them runs through your own ChatGPT account or your own API key (section 3).

6. Where your data is processed

TYTOS has its registered office in Switzerland. The service’s database is in Zurich (Switzerland), and its functions run in Frankfurt (Germany). The recipients in section 5 also process data in the USA, in Ireland and in other countries, as stated there.

When we disclose personal data from Switzerland to another country, we observe the rules of the Swiss FADP for disclosures abroad (Art. 16 FADP), in particular through the recipients’ data processing terms or their certification under the Swiss-U.S. Data Privacy Framework. On request, we will give you a copy of the safeguards.

7. Retention and deletion

The service deletes expired data in a daily run.

  • Sign-in links and device codes: valid for 15 minutes and stored only as hashed values. The daily run deletes expired device codes and sign-in links, the latter one day after expiry. Sessions of the “Manage seats” page end after 12 hours.
  • Hashed values of IP and email addresses used to limit requests: about 2 hours.
  • Installations (ID, device, versions, device confirmation, last seen): we delete them 24 months after the last activity, that is, the last license check.
  • Support reports: we delete them 24 months after receipt.
  • Attachments of support reports: deleted in the service 30 days after they were forwarded to the support inbox, and in any event no later than 90 days after receipt. As long as we do not use an external support inbox, they are deleted 90 days after receipt. We delete emails to support once they are no longer needed, and in any event no later than 24 months after receipt.
  • Practice accounts, seats and admin accounts: kept during the trial or the contract. If the trial ends without a purchase or the contract ends, we anonymize the personal data in the practice account, such as email addresses, 24 months after the end.
  • Invoices, payment events, orders with their business confirmation and billing address, and commission statements: 10 years from the end of the financial year (Art. 958f Swiss Code of Obligations), then deleted.
  • Referral partners: during the referral contract; statements and payment details for 10 years afterwards (Art. 958f Swiss Code of Obligations).
  • Server and download logs and data at Stripe: according to the providers’ retention periods.

8. Your choices and requests

Whatever law applies, you can ask us to:

  • tell you whether we process your data and give you access to it, free of charge;
  • correct inaccurate data;
  • delete your data, unless we are legally required to keep it;
  • restrict how we use it;
  • give you a copy of your data in a structured, commonly used and machine-readable format;
  • stop using your data for campaign and referral attribution (section 4.12);
  • review a switch to read-only mode by a person (section 10).

If we correct, delete or restrict data, we tell the recipients to whom we disclosed it, where this is possible and proportionate.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use your data for targeted advertising.

How: write to support@frontierx.ch. We answer within one month. We may ask for proof of identity.

Complaints: you can complain to us about how we handle your personal data, by email to support@frontierx.ch with “Data protection complaint” as the subject. We acknowledge receipt within 30 days, look into your complaint without undue delay and tell you the outcome. In Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) supervises our compliance with the FADP.

9. Security

Protection in transit:

  • encrypted transmission between the app and the service;
  • signed licenses.

Access:

  • row-level security in the database; only the service itself can read and write data;
  • the service’s secret keys for signatures, payment, email and the database are kept only in the service, never in the app;
  • sign-in links, device codes and keys are stored only as hashed values.

Data minimization:

  • the service accepts only the defined fields and rejects all others;
  • the interface between the app and the service does not allow project content, file names, paths, conversation text, specification texts or API keys to be sent;
  • the service’s logs contain no email addresses and no content.

Security breaches: if a breach of security leads to personal data being lost, disclosed or accessed without authorization, we inform the Swiss Federal Data Protection and Information Commissioner where the FADP requires it, and we inform the customers and people concerned, and authorities, where the law requires it.

10. Automated decisions

The license check automatically switches the app to read-only mode depending on the status of the trial, of the payment or of the seat. The app tells you when this happens. You can tell us your view, ask for a person at TYTOS to review the switch and contest it, by writing to support@frontierx.ch. We make no other decisions about you based solely on automated processing.

11. Changes

We update this notice when the app, the service or the law changes. The version published here applies. We tell admins about material changes by email.