DevQuaySign inStart a private trial
Draft
This text is under review and is not in force. Bracketed details are still to be completed.

DevQuay Privacy Policy

Version 0.2 (paid beta) · Effective date: [EFFECTIVE DATE] · Last updated: 2026-10-30

This policy explains how Joao P M Pereira, Estrada Fraze, 90, Teresopolis, RJ, Brasil ("DevQuay", "we") handles personal data about people who use DevQuay, visit our websites, or are contacts of our business customers.

1. Who is responsible

We are the controller for account, billing, usage, security and website data described in section 2, which we process to run our business and the Service.

We are a processor for personal data contained in Customer Content: the standards, catalogs, templates, runbooks, imported files and other material an organization stores in DevQuay (for example names of service owners or reviewers written into a document). For that data, the customer organization is the controller and our [Data Processing Addendum](data-processing-addendum.md) applies. If you want to exercise rights over data in an organization's content, contact that organization; we will help it respond.

Paddle (Paddle.com Market Limited) sells DevQuay subscriptions as merchant of record and is a separate controller for payment, tax and fraud-prevention data. See Paddle's privacy notice: <https://www.paddle.com/legal/privacy>.

We are established in Brazil, and the Lei Geral de Proteção de Dados (Law 13.709/2018, "LGPD") applies to us. The GDPR and UK GDPR apply where their own rules bring our processing within them.

Contact for privacy questions: privacy@devquay.com. This is also our communication channel for data subjects under the LGPD. We have not appointed a data protection officer under the GDPR. We have not appointed an encarregado under the LGPD, because we rely on the exemption for small processing agents in ANPD Resolution CD/ANPD No. 2/2022. We have not appointed a representative in the EU or UK under Article 27 of the GDPR or UK GDPR.

2. What we collect, why, and on what legal basis

| Data | Source | Purpose | Legal basis (GDPR Art. 6) | | --- | --- | --- | --- | | Account data: name, email address, profile image, authentication identifiers, organization memberships and roles | You, when you sign up or accept an invitation; the organization owner who invites you; our authentication provider Clerk | Create and secure your account, let you sign in, show who did what inside your organization, send service messages | Performance of a contract with you or the organization you work for (6(1)(b)); our legitimate interest in running a secure multi-user service for business customers (6(1)(f)) | | Session and security data: IP address, user agent, session identifiers, sign-in events, OAuth grants and service-credential metadata (prefix, creation, last use, expiry; secrets are stored only as hashes) | Your browser, CLI or agent; Clerk; Cloudflare | Authenticate requests, enforce rate limits, detect and investigate abuse and security incidents | Legitimate interest in protecting the Service and our customers (6(1)(f)) | | Activity and audit records: which user or agent created, reviewed, published or changed content, when, and with which request | The Service | Show the organization an accountable history; investigate problems | Contract (6(1)(b)); legitimate interest in accountability and security (6(1)(f)) | | Usage data: request counts and latency, context-resolution metadata (target, release, digest, number of uses), job status, AI usage (provider, model, token counts, cost) and allowlisted product events linked to opaque organization and user identifiers | The Service | Operate and bill for the Service, enforce plan limits and budgets, understand which features are used, fix problems | Contract (6(1)(b)) for metering and limits; legitimate interest in improving the Service (6(1)(f)) | | Billing data: subscription plan and status, Paddle customer and subscription identifiers, billing contact email, transaction status | Paddle | Manage the subscription and entitlements, answer billing questions | Contract (6(1)(b)); legal obligation for accounting records (6(1)(c)) | | Communications: messages you send to support, security or sales, and our replies | You | Answer you and keep a record of the conversation | Legitimate interest in responding to enquiries (6(1)(f)); contract where it concerns your subscription | | Notification preferences and email delivery data: which notifications you receive, delivery and bounce status | You; our email provider | Send the notifications you choose and stop sending to addresses that bounce | Contract (6(1)(b)); legitimate interest (6(1)(f)) | | Website requests: IP address and request metadata when you visit `devquay.com` or `docs.devquay.com` | Your browser, via Cloudflare | Deliver and protect the websites | Legitimate interest (6(1)(f)) |

We do not use personal data for advertising, we do not sell it, and we do not make decisions with legal or similarly significant effects about you by automated means. We do not send marketing email without your consent; if we ask for it, you can withdraw consent at any time.

Under the LGPD, the same processing rests on the corresponding bases in Article 7: performance of a contract (V), compliance with a legal obligation (II), the regular exercise of rights (VI), legitimate interest (IX), and consent (I) where we ask for it.

Product analytics. Our analytics events are sent from our servers, not from trackers in your browser. They contain only allowlisted event names and properties with opaque identifiers. They never contain the text of content, prompts, source code, secrets or captured pages. You can object to analytics processing by writing to privacy@devquay.com.

AI features. If your organization enables a hosted AI provider, the content excerpts needed for a request are sent to that provider. We filter content by your access rights and remove recognised secrets before sending. We do not use your data to train AI models and we do not opt in to any provider programme that allows training on it. Full prompts and outputs are not stored by default; if your organization turns on assistant transcript retention, transcripts are kept for 7 days.

3. Who receives your data

  • Subprocessors that host and operate the Service: listed with their purpose, data and location in [Subprocessors](subprocessors.md).
  • Paddle, as merchant of record, for billing.
  • Your organization: owners and admins of an organization can see the members, roles and activity records of that organization.
  • Integrations your organization connects, such as GitHub or an AI provider, receive what is needed for the integration.
  • Authorities or other parties where the law requires it, or to protect rights and safety, after checking that the request is lawful.
  • A successor if our business or the Service is transferred, under the same protections.

4. International transfers

DevQuay is operated from Brazil. The DevQuay API runs on servers in Helsinki, Finland, and the production database runs in Frankfurt, Germany. Object storage is configured for Western Europe. Some subprocessors are based in, or process data in, the United States, Brazil or other countries, and Cloudflare processes traffic at the location nearest the user. The European Commission has adopted an adequacy decision for Brazil (Implementing Decision (EU) 2026/179), which covers transfers of data from the EEA to us. When we transfer personal data out of Brazil, we rely on a mechanism allowed by Articles 33 to 36 of the LGPD. Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss amendments where needed) or the provider's certification under the EU–US Data Privacy Framework, as stated for each provider in [Subprocessors](subprocessors.md). You can ask us for a copy of the relevant safeguards at privacy@devquay.com.

We do not offer a data-residency guarantee.

5. How long we keep data

| Data | Retention | | --- | --- | | Account data and memberships | While your account or membership exists. When you are removed from an organization, your membership is marked removed so the history of what you did stays accountable; your name and email in it are kept for as long as the organization keeps that history, and pseudonymised when the organization is deleted. | | Records of access to the Service (date, time and IP address) | 6 months, as required by Article 15 of Brazil's Marco Civil da Internet (Law 12.965/2014) | | Other security logs | 90 days | | Activity and audit records inside an organization | 90 days, and deleted with the organization if that comes first | | Telemetry (traces and logs) | Up to 90 days | | Usage and AI-usage records | While the organization exists, then deleted with it, except records needed for billing | | Billing records | For the period required by accounting and tax law: 5 years from the first day of the year after the record, and longer while a related tax or legal claim is open. Paddle keeps its own records under its policy. | | Support communications | 2 years after the conversation ends, unless needed longer for a legal claim | | Assistant transcripts (only if your organization turns them on) | 7 days | | Backups | Database backups are kept for up to 30 days and then overwritten |

Customer Content is retained and deleted as described in the [Terms of Service](terms-of-service.md) (section 11) and the [Data Processing Addendum](data-processing-addendum.md).

6. Security

We protect data with organization-level isolation enforced in the database, encryption in transit, hashed credentials, encrypted integration secrets, least-privilege access, audit logging and tested backups. The [Data Processing Addendum](data-processing-addendum.md) describes these measures in more detail. No system is perfectly secure; we will notify affected customers and authorities of a personal data breach as the law requires.

7. Your rights

Depending on where you live, you may have the right to access your personal data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent where processing is based on consent.

Under Article 18 of the LGPD you may also ask us to confirm that we process your data, to anonymise, block or delete data that is unnecessary, excessive or processed unlawfully, to tell you who we shared it with, and to explain what happens if you refuse consent. You may ask for a review of decisions made solely by automated means (Article 20), although we do not make such decisions about you.

To exercise these rights, write to privacy@devquay.com. We will answer requests under the LGPD for confirmation or access within 15 days, and other requests within one month. We may need to confirm your identity first. For data inside an organization's content, we will refer you to that organization.

You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work. Our authority in Brazil is the Autoridade Nacional de Proteção de Dados (ANPD), <https://www.gov.br/anpd>. We have no establishment in the EU, so we have no lead authority there; where the Standard Contractual Clauses need an EU authority, it is the Irish Data Protection Commission.

8. Cookies

We use only cookies and browser storage that are strictly necessary: sign-in cookies set by Clerk, a theme preference cookie, and local storage for unsaved editor drafts. We do not use advertising or analytics cookies. Details are in the [Cookie Notice](cookies.md).

9. Children

DevQuay is a business service and is not directed at children. Users must be at least 16. We do not knowingly collect personal data from children; if you believe a child has given us personal data, contact us and we will delete it.

10. Changes

We will publish any change to this policy with a new version and effective date, and notify organization owners by email of material changes before they apply.