Privacy Policy

1. Overview

This Privacy Policy explains how Pixelite SL, which operates Permaura ("Permaura", "we", "us"), collects, uses and protects personal data when you use our website, console and hosted services (the "Service"). We are the data controller for the personal data described here.

We serve customers worldwide. Where the EU General Data Protection Regulation (GDPR), the UK GDPR, or Andorran data-protection law applies, we comply with it for the relevant individuals.

2. Information we collect

Account information

Your name, email address, authentication identifiers, organisation and plan.

Billing information

Purchases are handled by Paddle as our Merchant of Record, and Paddle collects and processes your payment details. We receive only limited billing data, such as your plan, billing country, subscription status and card type or last four digits. We do not receive or store your full card number.

Usage and technical data

Log data, IP address, device and browser information, and how you interact with the Service, used to operate, secure and improve it.

Audit metadata

To provide a tamper-evident audit trail, we store metadata about actions taken through the Service, such as which agent requested what, which policy decided, and a hash and summary of a call. We do not store the secret values themselves.

Communications

Messages you send us for support, and the records of that correspondence.

3. Secrets and credentials

Permaura is a credential-custody product, so we treat the credentials you store with particular care. Secrets are sealed and are not returned to AI models, prompts, logs or agent processes. In local mode they remain on your device and are not transmitted to us. In hosted mode they are encrypted at rest and only briefly decrypted in memory at the moment of an authorised call; we do not retain plaintext secrets, and our staff do not have routine access to them. This is an architectural safeguard, described honestly: it reduces risk substantially, but no system removes it entirely.

4. How and why we use information

We use personal data on the following legal bases:

• to provide and operate the Service (performance of our contract with you);
• to take payment and prevent fraud (contract, legal obligation and our legitimate interests);
• to secure, debug and improve the Service (our legitimate interests);
• to communicate with you about the Service (contract and legitimate interests);
• to send optional marketing where you have consented (consent, which you can withdraw at any time); and
• to comply with legal obligations.

5. Payments

Payments are processed by Paddle (Paddle.com Market Limited and its affiliates) as Merchant of Record and as an independent controller of the payment data it collects. Paddle's handling of your data is governed by its privacy notice at https://www.paddle.com/legal/privacy.

6. Service providers and sub-processors

We use a small number of trusted providers to run the Service, for example cloud hosting and databases, content delivery, email delivery, push notifications and payments. They process data on our behalf under appropriate agreements, or as independent controllers where applicable (such as Paddle). A current list of sub-processors is available on request at privacy@permaura.com.

7. International data transfers

We are based in Andorra, and our providers may process data in the EU, the United Kingdom, the United States and elsewhere. Where personal data protected by the GDPR or UK GDPR is transferred outside those areas, we rely on an appropriate safeguard, such as an adequacy decision or standard contractual clauses. Andorra benefits from an EU adequacy decision for data protection.

8. Data retention

We keep personal data for as long as needed to provide the Service and for legitimate business and legal purposes, such as accounting and dispute resolution. Audit records may be kept for the period needed to provide tamper-evident history. When data is no longer needed, we delete or anonymise it.

9. Security

We use technical and organisational measures appropriate to the risk, including envelope encryption of secrets, encryption in transit, key management, access controls, and ed25519-signed, hash-chained audit records. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, restrict or object to the processing of your personal data, and to withdraw consent where processing is based on it.

To exercise these rights, contact privacy@permaura.com. You also have the right to complain to a data-protection authority, such as the Andorran Data Protection Agency (APDA) or the supervisory authority in your country.

11. Cookies

We use essential cookies needed to sign you in and keep the Service secure, and may use limited analytics to understand and improve usage. You can control cookies through your browser, and where required we ask for your consent to non-essential cookies.

12. Children

The Service is not directed to children and is intended for users aged 18 or over. We do not knowingly collect personal data from children.

13. Changes

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, where changes are material, provide additional notice.

14. Contact

For privacy questions or to exercise your rights, contact privacy@permaura.com. Permaura is operated by Pixelite SL, a company registered in Andorra.