Privacy policy

Condux is operated by Triple Down AB, Skeppargatan 55, 114 59 Stockholm, Sweden. For questions about this policy or about your personal data, write to privacy@condux.ai.

This policy covers the hosted service at condux.ai and app.condux.ai. It does not cover a self-hosted installation of Condux: if you run the software yourself, no data reaches us and you are the only party processing it.

For your account, we are the data controller. We decide what to collect and why, and this policy is our account of it.

For the error data your applications send us, we are a data processor and you are the controller. We hold it on your behalf, we act on your instructions, and what ends up in it is determined by your application rather than by us. The terms of that relationship are in our data processing agreement, which forms part of your contract with us.

Account

Your email address, and a hash of your password. We store the hash using Argon2id and never the password itself. If you sign in with Google or a company identity provider we store no password at all.

Sessions

A record of your signed-in sessions. We store only a SHA-256 hash of the session token, so a copy of our database cannot be used to sign in as you.

Workspace

The names and settings of the organisation, projects, alert rules and integrations you create.

Billing

Your plan, and identifiers linking you to our payment processor. Card numbers are handled entirely by Stripe and never reach our servers or our logs.

Correspondence

Anything you send us by email or in a support conversation.

Operational logs

Ordinary server logs needed to run and secure the service, including IP addresses of requests to our API.

We do not ask for your name, your phone number, your job title or your company size, because we do not need them.

When you install a Condux SDK, your application sends us error events. What they contain is determined by your code: typically an exception type and message, a stack trace with source context, breadcrumbs, tags, release and environment identifiers, and whatever you attach to them yourself. An error message can contain personal data if your application puts it there.

Before anything is stored, every event passes through a scrub at our ingest edge. That scrub:

• Redacts email addresses found anywhere in the text of an event.
• Redacts values that look like credentials, including API keys, access tokens and similar secrets.
• Drops the value of any field named like a secret, such as authorization, password, cookie, token, secret or api-key.
• Discards the end user's IP address entirely. We do not store it, and it never reaches our database.
• Replaces any end user identifier with a one-way hash, so we can count how many people an error affected without holding who they are.

The scrub runs a second time before anything is sent to the AI fix engine, so a secret that somehow survived the first pass is removed before a model could see it.

Be aware of its limits. Scrubbing recognises patterns. It cannot know that a particular free-text field in your application holds a customer name, so it will not remove it. You remain responsible for what your application chooses to send. If you handle sensitive categories of data, use the SDK options to strip it before it leaves your process.

Contract

Running your account, delivering the service you signed up for, and taking payment for it.

Legitimate interests

Keeping the service secure and available, preventing abuse, and answering your support requests. We have weighed these against your rights and consider them proportionate.

Legal obligation

Keeping the accounting records that tax law requires us to keep.

Your instructions

Error data is processed as a processor, on the documented instructions of the customer who sent it. See the DPA.

We do not sell personal data, we do not share it with advertisers, and we do not use it to train any machine learning model of our own.

Error events

30 days on the Free plan and 90 days on paid plans. Expiry is enforced automatically by the database against each stored row, not by a cleanup job somebody has to remember to run.

Aggregated counts

Issue counts and hourly volume statistics are kept while the issue exists. They contain no personal data.

Account data

For as long as your account is open. Delete your organisation and the issues and events belonging to it are deleted with it.

Sessions

Until they expire or you sign out.

Billing records

Kept as long as tax and accounting law requires, typically several years.

We use a small number of subprocessors to run the service. Every one of them, what they do and where they are, is listed on our trust page, which is the authoritative list and is updated when it changes.

The hosted service runs on infrastructure in Nuremberg, Germany. Two subprocessors are worth calling out here rather than leaving on a list:

• The AI model provider. If you use the Conductor, our fix engine, then a scrubbed extract of the source files behind an error is sent to a model provider in the United States. This only happens for issues you or your settings ask for a fix on. You can avoid it entirely: bring your own model key, run the fix agent on your own infrastructure, or simply never request a fix.
• Stripe. Payments and invoicing. Card data goes directly to Stripe and never passes through us.

Our infrastructure is in the EU. The exceptions are the model provider described above and Stripe, both of which are United States companies. Where personal data reaches them we rely on the European Commission's standard contractual clauses, together with the technical measures described in clause 4, which mean the data reaching a model has already had identifiers and credentials removed.

If your organisation cannot accept any transfer outside the EU, Condux can be run entirely on your own infrastructure, with your own model endpoint. In that arrangement we receive nothing at all.

The measures are described in full on the trust page. In short: everything travels over TLS, passwords are hashed with Argon2id, session tokens and machine credentials are stored only as hashes, stored secrets such as your model key are encrypted at rest, access between organisations is checked on every single request, and administrative actions are written to an audit trail.

Because Condux is source-available, you do not have to take our word for any of this. The code that does it is published and can be read.

Under the GDPR you may ask us for a copy of your personal data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use of it, and ask for it in a portable form. Write to privacy@condux.ai and we will answer within one month.

If the request concerns error data rather than your own account, the controller is our customer, not us. Contact them directly. If you do not know who they are, tell us what you can and we will help you find out.

You can also complain to your national data protection authority. We would rather you told us first, but it is your right either way.

The application sets only the cookies it needs to work: one to keep you signed in, one short-lived cookie to protect the sign-in redirect against forgery, and one that marks a read-only support session when our staff view an account with permission. There is no advertising cookie and no cross-site tracker.

The marketing site uses self-hosted, cookieless analytics to count page views. It sets no cookie, stores no identifier and cannot follow you to another website, which is why you are not being asked to dismiss a consent banner.

Condux is a tool for software teams and is not directed at children. We do not knowingly create accounts for anyone under 16.

If we change this policy in a way that affects your rights, we will tell account owners by email before it takes effect. The date at the top of the page always reflects the current version.

Privacy questions and data requests: privacy@condux.ai. Security reports: security@condux.ai, and please read our disclosure policy first.