Coreflux Privacy Policy 2026

1. Who we are and what this policy covers

Coreflux Portugal, SA (“Coreflux”, “we”, “us”) is the controller of the personal data described in this policy. Our registered office is at Rua Engenheiro Ferreira Dias, 978, Escritório A (Centro Via Rápida), 4149-008 Porto, Portugal (NIPC 517225310).

This policy covers personal data we process when you:

• visit coreflux.org, docs.coreflux.org and our other websites (the “Sites”);
• create an account or sign in with Google or GitHub;
• use our products: Coreflux Broker (self-hosted and managed), Hub 2.0, Language of Things (LoT), Routes/Connectors and the AI Assistant (together, the “Services”);
• buy a subscription or licence, contact us, join a webinar, the Academy or a beta programme, or subscribe to our newsletter.

It does not cover data that our customers process inside a broker they run or that we host for them, such as MQTT payloads from their devices. For that data the customer is the controller and we act as its processor under our Terms of Service and data processing terms. Third-party sites we link to, such as Discord, GitHub, LinkedIn and YouTube, have their own policies.

2. Personal data we collect

We collect only what we need to run the Services, sell them and support you. Most of it you give us; the rest comes from your use of the Sites and Services, or from the sign-in provider you choose.

We do not ask for special-category data, such as health or biometric data, and ask you not to send it to us.

You are not required by law to give us personal data. Some of it is needed to sign a contract with us: without an email we cannot create an account, and without billing details we cannot sell you a subscription or issue an invoice.

3. Why we use your data and our legal basis

We use personal data only for the purposes below, each with a legal basis under Article 6(1) GDPR. Where we rely on legitimate interests, the last column says which interest; you can object to it at any time (section 9).

We will not use your data for a new purpose that is incompatible with these without telling you first and, where the law requires, asking for your consent.

4. Cookies and similar technologies

We set strictly necessary cookies without asking. Everything else (analytics and marketing) is off until you accept it in the cookie banner, as Lei 41/2004 (art. 5) and the ePrivacy Directive require. You can change your choice at any time from the “Cookie settings” link in the footer of every page, and rejecting is as easy as accepting.

Cookie names, providers and lifetimes are listed in our Cookie Policy. You can also block or delete cookies in your browser settings; blocking strictly necessary cookies may break sign-in.

Our newsletters contain a tracking pixel that records opens and clicks. You can turn this off by disabling image loading in your email client, or unsubscribe from any email.

5. Who we share your data with

We do not sell your personal data or share it for cross-context behavioural advertising. We share it only with the service providers below, who act as our processors under written contracts (Article 28 GDPR) and may use it only on our instructions.

We may also disclose personal data to:

• our accountants, auditors and lawyers, who are bound by professional secrecy;
• courts, the tax authority (Autoridade Tributária) and other public authorities, when the law requires it;
• a buyer or investor, and their advisers, if Coreflux is involved in a merger, acquisition or sale of assets, under confidentiality terms.

When you sign in with Google or GitHub, or follow us on Discord, LinkedIn or YouTube, those companies process your data as independent controllers under their own privacy policies.

6. Transfers outside the EU

We host our Sites and Services on AWS in the EU. Some of the providers in section 5 are based in, or may access data from, the United States or other countries outside the European Economic Area (EEA).

We transfer personal data outside the EEA only when one of these safeguards applies:

• the country has an EU adequacy decision, such as the United Kingdom or Switzerland;
• the US recipient is certified under the EU-US Data Privacy Framework, which the European Commission found adequate in July 2023 and the EU General Court upheld on 3 September 2025;
• we have signed the European Commission’s Standard Contractual Clauses (2021) with the recipient, with the UK Addendum where UK data is involved, and checked that the recipient can honour them.

You can ask us for a copy of the safeguards for a given transfer by writing to contact@coreflux.org.

7. How long we keep your data

We keep personal data only as long as the purpose needs it, then delete or anonymise it. Where a legal claim is open, we keep the relevant data until it is resolved and the limitation period has run out.

8. How we protect your data

We use technical and organisational measures suited to the risk, as Article 32 GDPR requires. They include:

• encryption in transit (TLS) on the Sites, Hub 2.0 and managed brokers, and encryption at rest on AWS;
• passwords stored only as salted hashes;
• multi-factor authentication and least-privilege access for staff, with access reviewed regularly;
• logging and monitoring of access to production systems;
• encrypted backups, tested for recovery;
• confidentiality obligations for all staff and contractors, and data processing agreements with every processor.

No system is completely secure. If a breach puts your data at risk, we will notify the Comissão Nacional de Proteção de Dados (CNPD) within 72 hours of becoming aware of it. If the risk to you is high, we will also tell you directly, without undue delay, and say what you can do to protect yourself.

You can help by using a strong, unique password, turning on multi-factor authentication where we offer it, and telling us at once at contact@coreflux.org if you think your account has been compromised.

9. Your rights

You can exercise any of the rights below free of charge by emailing contact@coreflux.org. We reply within one month; for complex or numerous requests we may extend this by up to two further months and will tell you why within the first month. We may ask you to confirm your identity first.

If you think we have not handled your data lawfully, you can complain to the Comissão Nacional de Proteção de Dados (www.cnpd.pt), Av. D. Carlos I, 134, 1º, 1200-651 Lisboa, or to the authority where you live or work. In the UK, that is the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to resolve your concern first.

10. Automated decisions, AI features and children

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects (Article 22 GDPR).

AI Assistant. When you use the AI Assistant in our documentation or in VS Code, you are talking to an AI system, not a person. We say so in the interface, as Article 50 of the EU AI Act requires since 2 August 2026. Your questions are sent to our AI model provider to generate the answer and are kept as set out in section 7. We do not use your questions to train AI models, and our provider is contractually barred from doing so. Answers can be wrong: check them before relying on them in production, and do not type passwords, licence keys or personal data about others into the Assistant.

Children. Our Sites and Services are meant for professionals and businesses. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to contact@coreflux.org and we will delete it.

11. Testing and beta programmes

We test every new product, version and feature after development and before we release it to all customers. Testing happens in two stages: internal testing by Coreflux, then external testing with beta testers.

Joining a beta is voluntary, and you can leave at any time by writing to contact@coreflux.org. Beta versions, such as the AI Assistant (Beta), may collect more detailed usage data and error reports than general releases; we tell you what is collected when you join.

We never use data from your brokers, such as MQTT payloads, in testing unless you ask us to, for example to reproduce a problem you have reported. We keep beta feedback and diagnostics as set out in section 7.

12. Changes to this policy

We review this policy at least once a year and whenever our Services or the law change. The “Last updated” date at the end shows the current version.

For material changes, such as a new purpose, a new category of data or a new kind of recipient, we will email account holders and show a notice on the Sites at least 30 days before the change takes effect. Where a change needs your consent, we will ask for it. Previous versions are available on request at contact@coreflux.org.

13. How to contact us

For any question about this policy or your personal data, contact:

• Company: Coreflux Portugal, SA
• Address: Rua Engenheiro Ferreira Dias, 978, Escritório A (Centro Via Rápida), 4149-008 Porto, Portugal
• Email: contact@coreflux.org (subject line “Privacy”)
• Phone: +351 221 180 460

We have not appointed a Data Protection Officer, as our activities do not require one under Article 37 GDPR. Our Chief Information Security Officer (CISO) is responsible for data protection at Coreflux and handles all privacy requests sent to contact@coreflux.org.