Privacy Policy

Depending on how you use the Services, we may act as:

• Controller — for account registration, billing, marketing, website analytics, and support data that we collect and process for our own purposes.
• Processor (or service provider) — for customer content and operational data that we process on your instructions when delivering managed services, AI agent operations, and cloud automation.

If you are an end user of a customer (for example, a member of your organization), your organization is typically the controller of your data and you should refer to their privacy practices.

We use the information we collect to:

• Provide and operate the Services — including cloud provisioning, deployment automation, AI agent operations, database management, and observability.
• Authenticate users — manage accounts, SSO sessions, and role-based access controls.
• Process payments — administer subscriptions, billing, invoicing, and cost tracking.
• Deliver AI and automation features — power agentic workflows, cost optimization recommendations, security scanning, and intelligent provisioning.
• Maintain security — detect threats, prevent fraud, investigate incidents, and enforce our Terms.
• Provide support — respond to requests, troubleshoot issues, and communicate service updates.
• Improve the Services — analyze usage patterns, performance metrics, and feedback to enhance features, reliability, and user experience.
• Comply with legal obligations — satisfy regulatory requirements, respond to lawful requests, and enforce our agreements.

Where required by applicable data protection law (such as the GDPR, PDPA, or similar regulations), we rely on one or more of the following legal bases:

• Performance of a contract — to deliver the Services you have subscribed to.
• Legitimate interests — to secure, improve, and operate the Services, prevent fraud, and provide customer support.
• Compliance with legal obligations — to meet regulatory, tax, and reporting requirements.
• Consent — for certain cookies, marketing communications, and optional data processing (which you can withdraw at any time).

We use cookies and similar technologies for the following purposes:

• Essential cookies — required for authentication, session management, security (CSRF protection), and core functionality. These cannot be disabled.
• Preference cookies — remember your settings such as language, theme (light/dark mode), and dashboard layout.
• Analytics cookies — help us understand how pages are used, measure performance, and identify areas for improvement. We use aggregated data where possible.

You can control non-essential cookies through your browser settings. If you disable cookies, some features (such as persistent login sessions or theme preferences) may not function properly.

We do not sell your personal information.

We may share information in the following circumstances:

• Vendors and subprocessors — trusted third parties that help us provide the Services (e.g., cloud hosting of our platform, payment processing, analytics tools, customer support systems, email delivery). They are bound by contractual obligations consistent with this policy and process data only as instructed.
• Cloud providers — when you authorize us to manage resources on your behalf, we interact with your cloud provider accounts (AWS, Azure, Google Cloud, Oracle Cloud, DigitalOcean, etc.) using credentials you provide.
• OAuth providers — when you authenticate via Google, GitHub, Microsoft, or GitLab, limited data is exchanged as part of the authentication flow.
• Customer-authorized recipients — when you direct us to share information (e.g., integrating third-party tools, connecting Git repositories, or granting team member access).
• Legal and safety — when required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect rights, safety, or prevent fraud.
• Business transfers — in connection with a merger, acquisition, restructuring, or sale of assets (subject to applicable protections and notice).

Our Services include AI agents and automated features that process your data to deliver infrastructure recommendations, cost optimizations, security insights, and operational automation.

• AI features may process infrastructure metadata, logs, configuration data, and usage patterns to generate recommendations and execute automated actions.
• We may use anonymized and aggregated interaction data to improve our AI models and features. We do not use your proprietary source code, credentials, or personally identifiable information to train general-purpose AI models.
• You can control the scope of AI agent access through permission settings in the Services.
• You have the right to request human review of significant decisions made by automated processing, where required by applicable law.

We retain information for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods vary by data type:

• Account data — retained while your account is active and for up to 90 days after deletion request.
• Billing records — retained for up to 7 years to comply with tax and accounting regulations.
• Operational logs — retained for 30–90 days depending on log type, unless a longer retention is configured by you.
• Credentials and secrets — permanently deleted upon account termination or when you remove them.
• Website session logs — retained for up to 12 months.

Where feasible, we de-identify or aggregate information for analytics and product improvement purposes.

We use administrative, technical, and organizational safeguards designed to protect information, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent).
• Role-based access controls (RBAC) and least-privilege principles.
• Audit logging and real-time monitoring for anomalous activity.
• Regular security assessments and vulnerability scanning.
• Secure software development practices and code reviews.

No security measure is perfect. You are responsible for protecting your own credentials, enforcing least-privilege access in your cloud environments, and conducting your own security assessments.

We are based in Singapore. We may process information in Singapore and other countries where we or our vendors operate (which may include the United States, European Union, and other regions).

Where required by law (such as GDPR for transfers outside the EEA), we implement appropriate safeguards for cross-border transfers, including standard contractual clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms.

Depending on your location and applicable law, you may have the following rights regarding your personal information:

To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law (typically 30 days).

If we process your information on behalf of an organization, we may direct you to that organization to fulfil your request.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us:

• Email: [email protected]
• Address: prodxcloud Pte. Ltd., 68 Circular Road, #02-01, Singapore 049422

See also our Terms of Service for additional information about your use of the Services.