Cognixa Labs LLC ("we", "us", "Restorix") respects your privacy. This Privacy Policy explains what data we collect, how we use it, and your rights under the GDPR (EU), CCPA (California), and other applicable privacy laws.
1. Data Controller
Cognixa Labs LLC is the data controller for personal data processed through Restorix. Contact our Data Protection Officer at [email protected].
2. Data We Collect
2.1 Data you provide
- Account data: email address, password (bcrypt-hashed), display name
- Payment data: transaction IDs, amounts, timestamps (processed by Stripe/Cryptomus, we never see or store your card number)
- Usage data: domains you restore, job history, deploy target configurations (credentials encrypted with AES-256-GCM)
2.2 Data collected automatically
- Technical data: IP address (hashed for affiliate fraud detection), browser type, device type
- Usage logs: API requests, timestamps, error logs (retained 90 days)
- Cookies: see our Cookie Policy for details
3. How We Use Your Data
- Service delivery: process restores, manage your balance, deliver ZIP files
- Authentication: verify your identity, manage sessions
- Communication: email verification, password resets, renewal reminders, support responses
- Affiliate program: track referrals and commissions (IP-hashed only)
- Security: rate limiting, fraud detection, abuse prevention
- Legal compliance: retain financial transaction records as required by law
4. Legal Basis for Processing (GDPR Article 6)
- Contract performance: processing necessary to deliver the Service you requested
- Legal obligation: financial record retention (tax/accounting laws)
- Legitimate interest: security, fraud prevention, service improvement
- Consent: cookies, marketing communications (you can withdraw anytime)
5. Data Sharing
We do NOT sell your personal data. We share data only with:
- Payment processors: Stripe, Cryptomus, Heleket, PayPro (transaction processing only)
- Email provider: Resend (transactional emails)
- Infrastructure: our hosting provider (database, file storage)
- Legal authorities: only when required by valid legal process
International transfers: Your data may be processed in the United States. EU/UK data is transferred under Standard Contractual Clauses (SCCs). Wayback Machine queries go to the Internet Archive (US-based).
6. Data Retention
- Account data: retained while your account is active
- Restored files (S3): auto-deleted after 90 days via lifecycle policy
- Financial records: retained 7 years (legal/tax requirement)
- Server logs: retained 90 days
- Audit logs: retained for security/forensic purposes
7. Your Rights
7.1 GDPR rights (EU/UK residents)
- Access: request a copy of your personal data
- Rectification: correct inaccurate data
- Erasure: request deletion of your data ("right to be forgotten")
- Restriction: limit how we process your data
- Portability: receive your data in a machine-readable format
- Objection: object to processing based on legitimate interest
- Withdraw consent: for consent-based processing (cookies, marketing)
7.2 CCPA rights (California residents)
- Know: what personal data we collect and how it's used
- Delete: request deletion of your personal data
- Opt-out: of the "sale" of personal data (we do not sell data)
- Non-discrimination: equal service regardless of rights exercised
To exercise any right, use our Data Request form or email [email protected]. We respond within 30 days. You may also lodge a complaint with your local data protection authority (e.g., ICO in the UK, CNIL in France).
8. Data Security
We use industry-standard security measures: AES-256-GCM encryption for credentials at rest, TLS in transit, bcrypt password hashing, Redis-backed rate limiting, CSRF protection, and a dedicated security middleware. Payment processing is fully delegated to PCI-DSS-compliant processors.
9. Children's Privacy
The Service is not intended for anyone under 18. We do not knowingly collect data from minors. If you believe we have, contact [email protected].
10. Changes to This Policy
We may update this Privacy Policy. Material changes will be notified via email. The "Last updated" date above reflects the most recent revision.
11. Contact
For any privacy questions or requests:
Email: [email protected]
Mail: Cognixa Labs LLC, 525 Randall Ave Ste 100, Cheyenne, WY 82001, USA
