Privacy Policy | Cathrix Network

This Privacy Policy explains how Cathrix Network Inc. (“Cathrix,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects personal information.

It applies to all websites, customer portals, billing services, and infrastructure operated by Cathrix (collectively, the “Services”).

1. Scope and Roles

1.1 Cathrix as Controller

This policy covers personal information where Cathrix decides why and how data is processed, such as your account registration, billing details, portal usage, and fraud-detection telemetry.

1.2 Customer Content as Processor

When you host applications, run virtual instances, or route end-user data through our network infrastructure (“Customer Personal Data”), you act as the Controller, and Cathrix acts as a Processor governed by our Data Processing Addendum (DPA).

2. Information We Collect

2.1 Information Categories

Account and Identity: Name, organization, email, billing address, phone number, and account credentials.
Billing and Transaction Data: Payment tokens, transaction history, tax IDs, and fraud-risk assessments. Payment card credentials are collected and processed directly by our payment processor (Stripe) and are never stored on Cathrix servers.
Fraud Prevention and Device Fingerprinting: Browser configuration, canvas and hardware attributes, screen resolution, operating system, IP address, request headers, proxy indicators, and behavioural risk scores. These are collected strictly to maintain infrastructure security, prevent abusive bot attacks, and protect accounts; they are never used for commercial profiling, targeted marketing, or sold to third parties.
Network and Diagnostics: IP addresses, connection timestamps, protocol logs, DNS queries, bandwidth consumption, and error crash dumps.
Support and Communications: Contents of support tickets, emails, and diagnostic communications.

2.2 How We Collect Information

Directly from you: During registration, purchase, and support requests.
Automatically: Through server telemetry, security logs, and operational cookies.
Third-Party Integrations: Fraud risk scores from Stripe, routing registries, and delivery receipts.

2.3 Obligatory vs. Voluntary Information

Providing your Account, Identity, and Billing Data is mandatory to enter into a service agreement and use our Services; failure to supply this information will make it impossible to create an account, complete payments, or provision infrastructure. Providing Support and Diagnostic inquiries is voluntary.

2.4 Children’s Privacy

Our Services are intended exclusively for adults and businesses. We do not knowingly collect or solicit personal information from individuals under the age of 18 (or the applicable age of majority under local law). If we learn that we have collected information from a minor, we will promptly delete it.

3.1 Business Purposes

We process your personal information strictly for:

Provisioning, operating, and maintaining network services;
Processing payments, calculating taxes, and invoicing;
Fraud detection, risk control, and bot mitigation;
Sending transactional alerts, service status, and critical billing notifications;
Application stability and error tracking;
Complying with statutory accounting, legal, and tax obligations.

3.2 Disclosures to Service Providers

We do not sell personal information or share it for cross-context behavioural advertising. We share necessary data only with trusted vendors under strict confidentiality and security terms:

Hosting & Infrastructure: Cloudflare, Inc., Fly.io, Inc., Oracle Canada ULC, and OVH Singapore Pte. Ltd.
Payment & Risk: Stripe Payments Canada, Ltd.
Email & Communications: Lark Technologies Pte. Ltd.
Application Diagnostics: Functional Software, Inc. (Sentry)
Legal and Compliance: When formally required by court order, warrant, or regulatory requirement.

4. Storage, Transfers, and Retention

4.1 Storage Locations & Cross-Border Transfers

All primary hosting, user accounts, and core infrastructure databases are hosted and stored in Canada and the United States. Ancillary transactional communication services (such as email delivery via Lark) may route and store operational logs in other secure jurisdictions, including Japan and Singapore.

Notice to International Users:
By accessing or using our Services from outside Canada and the United States, you understand and acknowledge that your personal information will be directly transmitted to, stored, and processed in Canada, the United States, and the respective service provider locations identified in Section 3.2 for the purposes described in this policy.

4.2 Security Measures

We implement defence-in-depth security, including TLS in transit, AES encryption at rest for sensitive assets, automated vulnerability scanning, access isolation, and audit logging.

4.3 Retention Limits

Billing and Tax Records: Retained for 7 years to satisfy statutory financial requirements.
Security and Access Logs: Retained up to 12 months for forensic auditing.
Device Fingerprints and Risk Data: Retained for up to 180 days for ongoing abuse analysis, then purged or aggregated.
Support Records: Retained for 3 years.

5. Your Privacy Rights

5.1 Multi-Jurisdictional Privacy Rights

Depending on your jurisdiction and applicable data protection legislation, you hold the following rights regarding your personal information, subject to statutory exceptions:

Access and Copy: Request confirmation of processing, access to, and a copy of the personal information we hold about you.
Correction and Deletion: Request rectification of inaccurate records or deletion of your personal data where retention is no longer necessary for legal, security, or billing purposes.
Withdrawal of Consent: Withdraw previously granted consent at any time.
Data Portability: Request a copy of your personal data in a structured, commonly used technological format where provided by applicable law.
No Sale / No Targeted Advertising: We do not sell your personal data or share it for cross-context behavioural advertising under any privacy legislation.
Non-Discrimination & Appeals: You will never receive discriminatory pricing or service denial for exercising privacy rights. If your request is denied, you may appeal the decision by contacting our Privacy Officer.

5.2 Exercising Your Rights

To submit an access, correction, deletion, or portability request, email [email protected] with the subject “Privacy Request”. We verify your identity prior to releasing or modifying data and respond within 30 days of receipt.

5.3 Privacy Officer Contact

The designated Person in Charge of Personal Information Protection / Privacy Officer can be reached at:

Privacy Officer
Cathrix Network Inc.
Email: [email protected]

Document History