Legal

Privacy policy

Last updated: 2026-09-01. We collect the minimum needed to run the platform, and we do not sell or train on your data.

1. What we collect

  • Account: name, email, password (scrypt-hashed, never stored in plaintext), and workspace role.
  • Usage: which endpoints you call, function executions, and coarse metrics (counts, latency) needed to bill, debug and size the platform.
  • Device: IP, user-agent and device ID for abuse prevention and channel-bound sessions. We do not fingerprint you across unrelated sites.
  • Your data: the tables, records, formulas and functions you create — processed only as the Service itself, not for analytics beyond aggregate, non-identifying rarity metrics.

2. How we use it

To operate, protect and improve the Service; to communicate with you about billing, security and product changes; to comply with law; and to enforce the terms of service. We do not use your personal data for advertising, and we do not build profiles from it.

  • Contract: to provide the Service you've signed up for.
  • Legitimate interest: security, abuse prevention, and product improvement, weighed against your privacy.
  • Consent: where we need it, e.g. optional marketing emails (opt-in, revocable any time).

4. Who we share with

Subprocessors bound by written DPA, limited to what each needs: cloud hosting (e.g. AWS), object storage, and email delivery. We never sell personal data. A full subprocessor list is available on request to dpo@cidbee.example.

5. Retention

Account data is kept while your workspace is active, plus 90 days after closure, then anonymised or deleted. Audit logs are retained 24 months and are append-only. You may request deletion at any time — see §7.

6. International transfers

Data may be processed in the EU and the US under appropriate safeguards (Standard Contractual Clauses). BYODB tenants keep the database within their own infrastructure.

7. Your rights

You may access, correct, export (JSONL/CSV) and delete your data, restrict processing, and object to legitimate-interest processing. To exercise rights or file a complaint, contact dpo@cidbee.example — we answer within 30 days. You also have the right to lodge a complaint with your supervisory authority.

8. California (CCPA/CPRA)

We do not sell or share personal information. We honour opt-out-of-sale signals for the online portion of our service. You may exercise access and deletion rights per §7.

9. Contact

cidbee, Inc., IO 'Cupboard' – Truck 23, Baleskin, 10, County Dublin, Ireland · dpo@cidbee.example.