Privacy policy

1. Scope

This policy describes how P4 Software, operator of cifraHQ Enterprise ("we", "the company"), collects, processes, stores and protects personal information in the context of the cifraHQ Enterprise B2B SaaS service. It applies to the public site at enterprise.cifrahq.com and to the operational platform delivered to Enterprise customers.

2. Data we collect

We collect two categories of data:

• Account data. Name, business email, job title, company and access credentials of users authorized by the Enterprise customer.
• Usage analytics. Aggregate usage metrics of the public site via Plausible Analytics. Plausible does not use cookies, does not track personal identity and does not build per-visitor profiles. Data is aggregated at the page level.

3. Processing purposes

Data is processed for the following purposes:

• Delivery of the contracted service: authentication, authorization, execution of ERP operations.
• Operational notices: incidents, scheduled maintenance, contractual changes.
• Technical support and Customer Success throughout the contract lifecycle.
• Internal audit, regulatory compliance and evidence for SOC 2 Type I.
• Product improvement through aggregate usage analytics (no personally identifiable data).

4. Subprocessors

The service operates on the following subprocessors:

• Microsoft Azure. Application hosting, per-tenant SQL Server database and encrypted storage. Specific regions negotiated by contract.
• Azure Communication Services. Transactional email delivery for notifications, invitations and operational alerts.
• Plausible Analytics. Public-site analytics. No cookies, no individual tracking, no linkage to personal identity.

The current list of subprocessors and the tenant-specific deployment regions form part of the security exhibit of the Enterprise contract.

5. Data retention

Customer operational data is retained for the duration of the contract. Upon termination, the customer has ninety days to export their data via the public API or the export-bridge; after that period, the tenant database is irreversibly deleted. Internal audit data required by SOC 2 and regulatory obligations is retained for an additional period defined in the contract exhibit.

6. Data-subject rights

Data subjects have the rights of access, rectification, cancellation and opposition recognized by applicable law in their jurisdiction. We align with the regulatory frameworks of the jurisdictions where we operate, including Panama's Ley 81 de Protección de Datos Personales, Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), and equivalent legislation in Colombia, Costa Rica and other Latin American jurisdictions.

To exercise any of these rights, the data subject may write to the contact address indicated in section 9 of this document. Requests are processed within the timeframes established by applicable law.

7. Data transfers

Customer data resides in the Azure region agreed in the contract. By default it is deployed in regions within Latin America or the United States for regional customers, with specific residency negotiable when the customer requires it for local regulation. Cross-region transfers, when they occur (for example, for geographic backup), are encrypted in transit and remain within the Microsoft Azure network.

8. Security

The security controls applicable to the service are described in detail at /en/security and in the security exhibit of the contract. They include encryption at rest and in transit, tenant isolation, secret management in Azure Key Vault, and audited processes under SOC 2 Type I.

9. Contact

For privacy-related requests, exercise of data-subject rights or reports of incidents involving personal data, contact us through the contact page. The compliance team formally follows up on every request within legal timeframes.

10. Changes to this policy

Material changes to this policy are communicated to active Enterprise customers at least thirty days in advance via email to the designated administrative contact. The date of the last revision is indicated at the top of this document.