1. Scope
This Privacy Policy applies when you visit Enfyra websites, create an account, use Enfyra Cloud, connect an infrastructure provider, pay for a management subscription, or contact support.
2. Service model
Enfyra Cloud manages Enfyra projects in infrastructure accounts you own. The selected provider hosts project services and data under its own privacy terms. Railway is the first supported provider. Enfyra is not the infrastructure reseller and does not receive the provider's complete billing record.
3. Data we collect
We may collect account details such as name, email address, authentication metadata, account settings, security events, IP address, request metadata, error reports, and support communications.
For Cloud management, we may collect project names, subdomains, selected provider, provider account and workspace identifiers, OAuth connection status, encrypted provider tokens, provider resource identifiers, deployment and reconciliation state, configuration metadata, operational logs, generated management credentials, domain state, and backup-operation records.
4. Provider connections
Enfyra uses OAuth credentials to perform authorized management actions. Provider secrets and refresh tokens are encrypted and are not published to customer-facing APIs. Disconnecting a provider stops future Enfyra management access but does not delete provider resources or provider-held data.
5. Payment data
PayPal processes Enfyra management subscriptions. PayPal may collect payment instrument, payer, transaction, tax, currency, and fraud-prevention data under its own privacy terms. Enfyra receives identifiers and status information needed to create subscriptions, record billing history, verify signed events, control entitlement, and meet accounting or legal obligations. Enfyra does not store full card numbers.
6. Customer project data
Application records, database contents, uploaded files, code, and configuration remain your data. With the customer-owned provider model, project data is primarily stored in your provider account and any external object-storage account you configure. Enfyra may access only the data or management endpoints needed to provision, secure, troubleshoot, back up, update, or support the service.
You are responsible for your application's lawful basis, user notices, access rules, retention, exports, and deletion procedures.
7. How we use data
We use data to authenticate users, operate the console, connect providers, provision and reconcile resources, manage subscriptions, perform requested operations, secure the service, prevent abuse, diagnose failures, communicate service information, provide support, and comply with legal obligations. We do not sell personal data.
8. Service providers and disclosure
We may share the minimum necessary data with infrastructure providers, PayPal, email, DNS, security, logging, and support services. We may also disclose data when required by law, to protect rights and safety, or in connection with a business transfer subject to appropriate safeguards.
9. Cookies and local storage
Enfyra may use essential cookies for authentication, OAuth handoff, security, and session continuity, and local storage for interface preferences such as theme. We do not use this essential storage for cross-site advertising. If non-essential analytics or marketing tracking is introduced, this policy and any required consent flow will be updated.
10. Security and retention
We use access controls, encrypted transport, encrypted provider credentials, scoped management tokens, monitoring, and operational restrictions designed to protect service data. No system is perfectly secure.
We retain account, subscription, security, and operational records only as long as needed for service delivery, fraud prevention, disputes, accounting, legal obligations, and legitimate operational needs. Provider-hosted resources and data follow the provider account's retention and deletion controls even after Enfyra management ends.
11. Your rights and choices
Depending on your location, you may have rights to access, correct, export, delete, restrict, or object to processing of personal data. Some records may be retained for billing, security, fraud prevention, dispute resolution, or legal compliance. Provider-hosted project data must be managed through the relevant provider or project tools.
12. International processing and children
Enfyra and service providers may process data in countries other than where you live using safeguards appropriate to the service. Enfyra is not intended for children and does not knowingly collect personal data from children.
13. Changes and contact
We may update this policy as Enfyra, supported providers, payment processing, or legal requirements change. For privacy questions or requests, contact Enfyra at [email protected].