Privacy Policy

1. Information We Collect

We collect information necessary to operate, authenticate, and secure DEVOXN renewal management workspaces:

Account & Identity Data: Name, work email address, authentication credentials, and Google OAuth identifiers when signing in with Google.
Workspace & Renewal Records: Metadata concerning cataloged corporate obligations, vendor names, expiration dates, cancellation notice windows, internal reference numbers, departmental allocations, and audit history.
Attached Documents: Files uploaded to the Document Vault (e.g., PDF agreements, certificates, policy schedules), which undergo SHA-256 integrity inspection and are stored in private encrypted cloud storage.
Notification & Recipient Data: Designated recipient email addresses and delivery timestamps for automated renewal reminder alerts configured by workspace members.
Billing & Subscription Metadata: Customer identifiers, subscription identifiers, price tier references, and transaction state processed via our Merchant of Record, Paddle. We do not collect, process, or store raw payment card numbers.
Technical & Telemetry Data: IP address, browser type, device information, and session timestamps necessary for rate limiting, security logging, and abuse defense.

2. How We Use Information

Collected information is used strictly for legitimate business, operational, and contractual purposes:

Provisioning, maintaining, and authenticating access to your organization's workspace.
Evaluating expiration timelines and dispatching scheduled email reminder alerts.
Enforcing subscription tier limits, quotas, and role-based access control policies.
Monitoring platform stability, preventing unauthorized access, and defending against abuse.
Communicating critical service announcements, security notices, and billing receipts.

3. Cookies & Tracking Technologies

DEVOXN uses first-party HTTP-only session cookies managed via Supabase Auth strictly to authenticate users and maintain session integrity. On public pages, optional analytics technologies (Google Analytics and Microsoft Clarity) are used solely when affirmative consent is granted via our Cookie Consent Banner to evaluate website performance.

Workspace Privacy Guarantee: Session recording and behavioral telemetry (Microsoft Clarity) are strictly disabled across all authenticated workspace routes (/workspace/*) to protect confidential contract and renewal information. DEVOXN does not deploy cross-site advertising retargeting trackers. For complete details, see our Cookie Policy.

4. Data Isolation & Security Architecture

We implement multi-layered defense-in-depth protections across every architectural layer:

PostgreSQL Row Level Security (RLS): Database engine policies enforce strict tenant isolation, ensuring workspace data is accessible only to authenticated members of that workspace.
Private Document Access: Uploaded attachments are stored in private buckets and accessed exclusively through cryptographically signed URLs with short 120-second TTLs.
Rate Limiting & Constant-Time Verification: Endpoints are protected by sliding-window rate limiting, and all cryptographic verifications (Paddle HMAC-SHA256, cron tokens) use constant-time comparisons.

5. Third-Party Sub-Processors

We never sell customer data. We share data only with verified infrastructure sub-processors essential to providing the service:

Supabase Inc.: Cloud database, authentication, and encrypted object storage infrastructure.
Paddle.com Inc. / Paddle Payments Ltd.: Merchant of Record for global checkout, subscription billing, invoice generation, and tax compliance.
Resend Inc.: Transactional email infrastructure for dispatching automated renewal reminders and workspace invitations.
Vercel Inc.: Application hosting, serverless execution, and scheduled background cron infrastructure.
Google LLC (Google Analytics): Aggregated public website traffic analysis (operates on public pages strictly subject to affirmative user consent).
Microsoft Corporation (Microsoft Clarity): Public web experience telemetry and heatmap analysis (operates on public pages strictly subject to affirmative user consent; completely excluded from authenticated workspaces).

6. Data Retention & Deletion

Workspace records and historical audit logs remain stored for the duration of your active workspace. Workspace administrators may soft-archive or delete individual renewal items and uploaded documents at any time.

To request complete workspace closure, account termination, or enterprise data erasure under applicable privacy regulations, workspace owners may contact our privacy team at privacy@devoxn.com. We process verified deletion requests promptly, subject to statutory record-retention requirements for commercial accounting and tax compliance.

7. Contact Us & Privacy Requests

If you have questions, data subject access requests (DSARs), or general inquiries regarding our data practices, please contact our privacy team at: privacy@devoxn.com.

1. Information We Collect

We collect information necessary to operate, authenticate, and secure DEVOXN renewal management workspaces:

Account & Identity Data: Name, work email address, authentication credentials, and Google OAuth identifiers when signing in with Google.

Workspace & Renewal Records: Metadata concerning cataloged corporate obligations, vendor names, expiration dates, cancellation notice windows, internal reference numbers, departmental allocations, and audit history.

Attached Documents: Files uploaded to the Document Vault (e.g., PDF agreements, certificates, policy schedules), which undergo SHA-256 integrity inspection and are stored in private encrypted cloud storage.

Notification & Recipient Data: Designated recipient email addresses and delivery timestamps for automated renewal reminder alerts configured by workspace members.

Billing & Subscription Metadata: Customer identifiers, subscription identifiers, price tier references, and transaction state processed via our Merchant of Record, Paddle. We do not collect, process, or store raw payment card numbers.

Technical & Telemetry Data: IP address, browser type, device information, and session timestamps necessary for rate limiting, security logging, and abuse defense.

2. How We Use Information

Collected information is used strictly for legitimate business, operational, and contractual purposes:

Provisioning, maintaining, and authenticating access to your organization's workspace.

Evaluating expiration timelines and dispatching scheduled email reminder alerts.

Enforcing subscription tier limits, quotas, and role-based access control policies.

Monitoring platform stability, preventing unauthorized access, and defending against abuse.

Communicating critical service announcements, security notices, and billing receipts.

3. Cookies & Tracking Technologies

4. Data Isolation & Security Architecture

We implement multi-layered defense-in-depth protections across every architectural layer:

PostgreSQL Row Level Security (RLS): Database engine policies enforce strict tenant isolation, ensuring workspace data is accessible only to authenticated members of that workspace.

Private Document Access: Uploaded attachments are stored in private buckets and accessed exclusively through cryptographically signed URLs with short 120-second TTLs.

Rate Limiting & Constant-Time Verification: Endpoints are protected by sliding-window rate limiting, and all cryptographic verifications (Paddle HMAC-SHA256, cron tokens) use constant-time comparisons.

5. Third-Party Sub-Processors

We never sell customer data. We share data only with verified infrastructure sub-processors essential to providing the service:

Supabase Inc.: Cloud database, authentication, and encrypted object storage infrastructure.

Paddle.com Inc. / Paddle Payments Ltd.: Merchant of Record for global checkout, subscription billing, invoice generation, and tax compliance.

Resend Inc.: Transactional email infrastructure for dispatching automated renewal reminders and workspace invitations.

Vercel Inc.: Application hosting, serverless execution, and scheduled background cron infrastructure.

Google LLC (Google Analytics): Aggregated public website traffic analysis (operates on public pages strictly subject to affirmative user consent).

Microsoft Corporation (Microsoft Clarity): Public web experience telemetry and heatmap analysis (operates on public pages strictly subject to affirmative user consent; completely excluded from authenticated workspaces).

6. Data Retention & Deletion