Tycoon

GDPR overview

GDPR is addressed concretely rather than claimed. Section 3 of the privacy policy names the legal bases used for the EEA, the UK and Switzerland: contract, legitimate interest, consent and legal obligation. Section 9 lists access, correction, deletion, portability, opting out of service-improvement use and the right to complain to a supervisory authority, with a 30-day response commitment. Section 11 covers transfers to the United States under the European Commission's Standard Contractual Clauses, and a copy of the mechanism is available on request. Section 7 commits to breach notification within 72 hours where GDPR requires it. A dedicated help article confirms that a Data Processing Agreement is provided on request. Two gaps remain: no Article 27 EU representative is designated, and no data protection officer is named — everything routes to support@tycoon.us.

Who owns the data?

You keep every right to what you submit. Section 8 of the Terms grants HeyMall, Inc. only a limited, non-exclusive, worldwide, royalty-free licence to process your content, and solely to provide, operate and improve the Service. Work produced by the agents belongs to your organisation, subject to the usage policies of the underlying model providers. The platform itself — software, design, agent infrastructure and proprietary models — remains the publisher's. Data is shared only with hosting providers, model APIs, the identity provider, the payment processor and the integrations you authorise; the privacy policy states that personal information is never sold. Deletion of your content and workspace data is requested from support@tycoon.us.

Reuse rights

Yes. Because you retain ownership of your content and your organisation owns the agents' work product, you can reuse both without asking permission — publish it, sell it, or build on it. Two limits apply. First, outputs remain subject to the usage policies of the AI model providers behind them, so those licences travel with the deliverable. Second, section 4 of the Terms forbids using the Service to develop, train or improve a competing agent-operations platform. The Terms also make you responsible for reviewing anything an agent produces before it is published or sent to a third party. Export is supported through the workspace data export and the portability right in the privacy policy.

Data retention & training

Hosting summary

Tycoon's servers run on Google Cloud Platform and AWS, and the privacy policy states that user data is stored and processed in the United States. Accessing the service from elsewhere means the data is transferred to the US; for users in the EEA, the UK and Switzerland that transfer relies on the European Commission's Standard Contractual Clauses, with a copy of the mechanism available on request. Conversation content is sent to model APIs — Anthropic Claude via AWS Bedrock — under data processing agreements that exclude training the providers' public models. Authentication runs through WorkOS and payments through Stripe, both under DPAs. Security measures include TLS in transit, AES-256 at rest, role-based access controls, least-privilege policies, encrypted and tested backups, and production isolated from development; third-party credentials are encrypted and never logged in plaintext. There is no data-residency option outside the United States, and no certification such as SOC 2, ISO 27001 or HIPAA is claimed.