Privacy Policy

1. Controller

Infivector Technologies Private Limited is the controller for the Infivector website, Conduit account data and licensing metadata described here. Our registered office is Om Chambers, 648/A, 1st Stage, 4th Floor, Binnamangala, Indiranagar, Bangalore North, Bangalore 560038, Karnataka, India. Contact [email protected] for privacy requests.

2. The customer-controlled product boundary

Conduit's engine and coordination store run in your environment, on a workstation or an interactive cloud host. The Infivector hosted service does not receive repository content, prompts, agent responses, tool output, worktree content or model provider credentials. Installed agent tools may send content to their own providers according to your configuration and their privacy terms.

3. Data we process

• Account email, normalized account identifier and sign-in method.
• Google subject and hosted-domain claims when you select Google sign-in. We do not retain Google access or refresh tokens.
• Plan, entitlement, renewal, cancellation, refund and risk status.
• Dodo customer, subscription, checkout-attempt and billing-event identifiers. We do not receive card details.
• Random installation identifiers, activation time and assigned Team seat.
• Organization identifier, owner, member roster, seat capacity and signed policy metadata for Team or Enterprise.
• Terms version and acceptance time recorded when checkout starts.
• Hashed network address and short time bucket used to limit anonymous download requests.
• Support messages and information you choose to send us.
• Website page and interaction analytics only after you accept analytics.

4. Why we process it

We process account and licensing data to provide Conduit, authenticate users, issue entitlements, administer seats, prevent duplicate or unauthorized activation, deliver downloads, provide support and comply with accounting or legal duties. These purposes rely on performance of our contract, legitimate interests in operating and protecting the service, compliance with law or consent where consent is required.

Optional analytics rely on consent. Rejecting analytics does not affect the website, checkout or Conduit. Use “Analytics settings” in the site footer to change the choice at any time.

5. Payment and service providers

Dodo Payments is merchant of record and an independent controller for payment, tax, invoicing, fraud review, refunds and chargebacks. We use AWS for hosted infrastructure, Resend for magic-link email and Google for sign-in only when selected. Google Analytics or Google Tag Manager receives website analytics only after consent. See the Subprocessor and Provider List.

6. International processing

The licensing service runs in the AWS US East region. Providers may process data in other countries. Where required, we use contractual transfer safeguards or rely on another lawful transfer mechanism. Team and Enterprise customers can use our Data Processing Addendum.

7. Retention

• Sign-in transactions become unusable after 15 minutes. Native completion codes become unusable after one minute.
• Browser and native licensing sessions expire after 24 hours.
• Anonymous download-rate records expire after about two minutes.
• Account, entitlement, device and organization metadata is kept while the account or subscription is active.
• After a verified deletion request, we delete or de-identify account data within 30 days unless it must be retained for billing, disputes, fraud prevention or law.
• Billing-event, consent and operator-audit records may be retained for up to seven years.
• Support records are retained for up to two years after the request closes unless a longer period is needed for a dispute.
• Optional analytics data is configured for no more than 14 months.

A provider may need additional time to complete deletion from backups. Expired authentication records are rejected even if a provider's physical deletion process has not completed.

8. Your rights

Depending on your location, you may request access, correction, deletion, restriction, portability or an objection to processing. You may withdraw consent for optional analytics. You may complain to the data-protection authority available in your jurisdiction. We may ask you to verify the account before acting on a request. We will not discriminate against you for exercising a privacy right.

9. Security

We use access controls, encryption in transit, restricted cloud roles, non-exportable signing keys, owner-scoped account routes and limited retention for short-lived authentication records. No system can guarantee absolute security. Contact [email protected] if you believe personal data has been exposed.

10. Children

Conduit paid accounts are not intended for anyone under 18. Contact us if you believe a child provided account data without proper authority.

11. Changes and contact

We will update the effective date and provide reasonable notice of a material change. Email [email protected] or write to Infivector Technologies Private Limited, Om Chambers, 648/A, 1st Stage, 4th Floor, Binnamangala, Indiranagar, Bangalore North, Bangalore 560038, Karnataka, India.