T-X (“T-X,” “we,” “us,” or “our”) provides a financial analysis platform that helps financial controllers and CFOs parse bank data, categorize transactions, and generate cash-flow forecasts through an AI-powered chat interface (the “Service”). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices and rights you have.
This Policy applies to visitors of t-x.ai (the “Site”) and to users of the Service (“Customers” and their authorized end users, together “Users”). It does not apply to information our Customers process through the Service about their own end customers, vendors, or employees (“Customer Data”) — that data is governed by our agreement with the Customer and, where applicable, our Data Processing Addendum, not by this Policy.
This Policy is written for a US-based company serving US customers. If we begin serving customers in the EU/UK, we will publish a supplemental notice covering GDPR/UK GDPR rights before doing so.
Account and contact information. Name, work email, company name, job title, and password (stored as a salted hash, never in plaintext) when you or your company signs up for the Service.
Customer Data you or your company uploads or connects. Bank statement files (e.g., BAI2 files), transaction records, account balances, categorization rules, and forecast inputs/outputs you upload to or generate within the Service. This is the core financial data the Service is built to process. We treat this as Customer Data under our agreement with your company, and we access it only as needed to provide, secure, and support the Service.
Usage and device data. Log data (IP address, browser type, pages visited, actions taken, timestamps), and diagnostic/error data we collect automatically when you use the Site or Service.
Communications. Information you provide when you contact support, respond to a survey, or otherwise communicate with us.
Cookies and similar technologies. We use cookies and local storage on the Site and in the Service for authentication (session tokens), preferences, and basic analytics. See Section 6.
We do not knowingly collect more than the categories above, and we do not collect sensitive categories of personal information (e.g., health, biometric, or precise geolocation data) as part of the Service.
We use the information above to:
We do not use Customer Data (your company’s bank/transaction data) to train shared or third-party AI models, and we do not sell personal information. See Section 5 for how AI features work.
De-identified and aggregated data. We may create de-identified data by aggregating Customer Data across customers — data that does not identify, and cannot reasonably be used to infer information about or be linked to, you, any individual, any bank account, or any transaction. We use de-identified data to produce industry benchmarks and to analyze and improve the Service, including after your subscription ends. We take reasonable measures to ensure de-identified data cannot be associated with you or any individual, do not attempt to re-identify it, contractually require any recipient not to re-identify it, and publish or share benchmarks only in a form that combines data from enough customers that no single customer can be identified. De-identified data is not Customer Data or personal information.
We do not sell personal information. We share information only in the following circumstances:
Service providers (subprocessors). We use a small number of vendors to operate the Service, under contracts that limit their use of your data to providing services to us:
| Vendor | Purpose | What it can access |
|---|---|---|
| Microsoft Azure | Cloud hosting (Kubernetes/AKS), database (PostgreSQL), file storage (Blob Storage) | Encrypted infrastructure hosting all Service data |
| OpenAI | Natural-language processing for the AI chat interface (interpreting your questions, generating readable responses) | Your chat text/questions only — not your underlying bank account numbers, transaction ledgers, or raw financial records, which are processed within our own infrastructure before and after any OpenAI call |
We do not use a separate third-party identity provider — user authentication runs on Keycloak, which we self-host inside our own infrastructure, so no login credentials leave our environment through that component.
Legal and safety. We may disclose information if required by law, subpoena, or legal process, or if we believe disclosure is necessary to protect the rights, property, or safety of T-X, our users, or others.
Business transfers. If T-X is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to standard confidentiality obligations.
With your direction. If you ask us to share information with a third party (e.g., an integration you request), we will do so as instructed.
We retain information for as long as your account is active and as needed to provide the Service. Specifically:
You or your company may request earlier deletion of Customer Data at any time by contacting dk@t-x.ai; we will complete such requests within 30 days, except where we are required to retain information by law or for active legal, security, or billing disputes.
The Service includes an AI-powered chat interface used to answer questions and generate forecasts in natural language. To power the natural-language portions of this feature, we send the text of your questions and generated explanations to OpenAI’s API. We do not send raw bank statement data, full transaction ledgers, or account numbers to OpenAI as part of this processing — financial computation and data retrieval happen within our own infrastructure, and only the natural-language layer (your question and our response) touches the third-party model. We do not permit OpenAI to use data sent through our account to train their models, consistent with OpenAI’s API data usage terms.
Before sending data to OpenAI, we replace company, vendor, employee and account identifiers with pseudonymous codes. OpenAI receives amounts and categories, not who they relate to. Data is encrypted in transit and is not used to train OpenAI’s models.
We use strictly necessary cookies (session/authentication) and a limited set of functional cookies (remembering preferences). You can control cookies through your browser settings; disabling essential cookies may prevent you from logging in.
If you are a California resident, you have the right to:
To exercise these rights, email dk@t-x.ai with “Privacy Rights Request” in the subject line. We will verify your identity before responding and will respond within the timeframes required by law. If you are an end user of a T-X Customer and your request concerns Customer Data, we may direct you to that Customer, who controls that data.
We take a defense-in-depth approach to protecting information, including encryption in transit and at rest, role-based access control, and infrastructure hardening. See our Security Overview for details.
The Service is intended for business use by adults and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact dk@t-x.ai and we will delete it.
The Service is currently offered only to customers based in the United States, and all data is processed and stored in the United States via Microsoft Azure US regions. If we expand to other regions, we will update this Policy accordingly.
We may update this Policy from time to time. If we make material changes, we will notify Customers by email or through the Service prior to the change taking effect. The “Last Updated” date above reflects the most recent revision.
Questions about this Policy or our privacy practices:
T-X
Email: dk@t-x.ai
T-X