Privacy Policy — Cadrix Cloud

This policy explains what personal data Cadrix Cloud processes, why, and what your rights are under Brazil's General Data Protection Law (LGPD) and, where applicable, the EU General Data Protection Regulation (GDPR). The controller is LEGAL NAME, CNPJ CNPJ, ADDRESS. Data protection officer: DPO NAME, suporte@cadrix.app.

1. Data we process

Account: your email and language preference.
Access: sign-in links and sessions, stored only as hashes; the cc_session session cookie, which expires after 30 days.
Billing: Stripe customer and subscription identifiers and your plan. Card details are collected and stored by Stripe; we never receive them.
Instance: the address you chose, plan, region, state, installed version, technical errors and periodic signals from the VM (free disk space, uptime and whether agents are running).
Security: your IP address is used momentarily, in memory, to rate-limit sign-in attempts, and the dashboard does not record it. The network logs of our servers (firewall and administrative access) keep IP addresses of refused or maintenance connections for up to 30 days.
Support: whatever you send us by email.

2. The content of your VM

Repositories, files, agent conversations and the AI provider credentials you connect stay on your VM's disk; credentials are encrypted and never pass through our management system. We do not access this content in the normal course of the service; technical administrative access exists and is only used for maintenance, to investigate a failure or abuse, at your request, or when required by law. When your agents call an AI provider, traffic goes directly from the VM to the provider, which processes it as an independent controller under its own policy.

3. Purposes and legal bases

Creating and operating your account and VM, billing and support: performance of a contract.
Keeping tax and billing records: legal obligation.
Protecting the service, preventing abuse and alerting our team about failures: legitimate interest.

We do not sell your data, do not profile you for advertising and do not send marketing email.

4. Who we share data with

We use the following processors, only to provide the service:

Hetzner Online GmbH (Germany and Finland): hosting of the VMs and the management system.
Cloudflare, Inc. (USA, global network): DNS and hosting of this website.
Stripe (USA and Ireland): payments.
Resend (USA; sending from São Paulo): sign-in emails.
Slack (USA): internal alerts to our team, which may include your email, your instance address and the error that occurred.

We may also share data when required by law or by an order of a competent authority.

5. International transfers

Some processors are outside Brazil. These transfers rely on each provider's contractual data protection safeguards under art. 33 of the LGPD and, for data subject to the GDPR, on the standard contractual clauses approved by the European Commission.

6. How long we keep data

Sign-in links: 15 minutes. Sessions: up to 30 days.
The VM and all its content: until the subscription ends, when they are permanently deleted.
Account data: for as long as the account exists; you can ask for deletion at any time.
Billing records: for the period required by tax law, usually 5 years.
Technical logs of the management system: up to 30 days.

7. Cookies and browser storage

We only use the essential cc_session session cookie in the dashboard and store your language choice in your browser's local storage. We use no analytics, advertising or tracking cookies. Stripe's payment pages set their own cookies, described in Stripe's policy.

8. Your rights

You may ask for confirmation of and access to your data, correction, anonymization or deletion, portability, information about who we share it with, and you may object to processing or withdraw consent. Write to suporte@cadrix.app from your account's email; we answer within 15 days. You may also complain to Brazil's data protection authority (ANPD) or, in the EU, to your country's supervisory authority.

9. Security

All traffic uses TLS; sign-in and session tokens are stored only as hashes; the VM's initial password is encrypted and deleted once shown; VMs are firewalled and only install Cadrix releases signed by us. No system is fully immune; if an incident affects your data, we will notify you and the authorities as the law requires.

10. Minors

The service is not intended for anyone under 18 and we do not knowingly collect their data.

11. Changes to this policy

Material changes are announced by email before they take effect. The date of the last update is shown at the top of this page.