Privacy Policy

This policy explains how FlexRay processes personal data in connection with the FlexRay Service, in accordance with the Brazilian General Data Protection Law (LGPD, Law 13.709/2018). For customers outside Brazil we apply equivalent protections and, where applicable, the GDPR and CCPA.

Our Data Protection Officer (Encarregado) can be reached at privacy@flexray.com.br.

We process:

• Account data — names, work email addresses, organization, hashed credentials, roles.
• Billing data — plan, instance counts, payment references (card and PIX details are handled by our payment processors, not stored by us).
• Telemetry — performance, cost, capacity and security metrics collected by the agent from your infrastructure. This is data about your systems; it may incidentally include identifiers such as hostnames or process names.
• Cloud metadata — resource inventory, configuration and billing records read from your connected cloud accounts.
• Usage and security logs — audit records of actions in the Service, and authentication events.

Under the LGPD we rely on:

• Performance of a contract (Art. 7, V) — to provide, bill and support the Service.
• Legitimate interests (Art. 7, IX) — to secure, maintain and improve the Service, balanced against your rights.
• Legal obligation (Art. 7, II) — to keep records the law requires.
• Consent (Art. 7, I) — where we ask for it, such as enabling optional AI features that send data to a third-party model provider.

We do not sell personal data. We share data with the service providers (operators) listed below, who process it only on our instructions and under contract, and with authorities where legally required. Our current subprocessors:

The full, current list is also at /subprocessors.

Our production infrastructure is hosted in Brazil (AWS sa-east-1). Some subprocessors (for example our AI and international card-payment providers) process data in the United States. Where data leaves Brazil we rely on the LGPD's international-transfer provisions (Art. 33), including adequate safeguards and contractual clauses.

We keep account data for the life of your account and as long as the law requires afterward. Telemetry is retained according to your plan (Starter 15 days, Pro 30 days, Enterprise 90 days by default); cost-attribution data up to 365 days; audit logs longer where required for security and legal compliance. On account deletion we erase your data as described below.

Under the LGPD (Art. 18) you may request confirmation and access, correction, anonymization or deletion, portability, information about sharing, and to withdraw consent. You can export your data or request account deletion from your organization settings, or by contacting privacy@flexray.com.br. Export produces a machine-readable bundle of your data; deletion removes your data across our systems after any stated grace period. You may also lodge a complaint with the ANPD.

We protect data with encryption in transit, tenant isolation (row-level security), scoped access controls, and audit logging. No system is perfectly secure; we notify affected customers and the ANPD of incidents as the law requires.

We use only strictly-necessary cookies to keep you signed in. We do not use advertising or third-party analytics cookies. See the Cookie Policy.

We may update this policy; the version and date appear at the top. For any privacy question or to exercise a right, contact our DPO at privacy@flexray.com.br.