Privacy Policy

1. Information We Collect

2. How We Use Your Information

• To process your data files and generate reports
• To manage your account and provide customer support
• To send transactional emails (receipts, password resets, report notifications)
• To send marketing emails if you opt in (you can unsubscribe at any time)
• To improve the Service and develop new features

3. Data Retention

Uploaded files are automatically deleted 30 days after processing. Generated reports are retained for 90 days. Account information is retained as long as your account is active. You can request deletion of your data at any time by contacting support.

4. Data Sharing

We do not sell your personal information or uploaded data. We share data only with:

• Stripe — for payment processing
• SMTP2Go — for transactional and marketing emails
• Third-party API providers — only the minimum data required to process your tool requests (e.g., addresses for geocoding)

5. Cookies and IP-based rate limiting

We use a small number of cookies. The Strictly Necessary and Analytics categories below are set without explicit consent (opt-out model under CCPA); Functional cookies require opt-in via the consent banner.

• Strictly necessary: cdx_session keeps you signed in after login (HttpOnly). cdx_consent remembers your cookie choice so we do not show the banner on every page load.
• Analytics & conversion attribution (opt-out): We load Google Analytics 4 and Google Ads via Google Tag Manager (container GTM-5FR8Q7GV) to measure aggregate site traffic and attribute conversions to our paid campaigns. Google sets first-party cookies (e.g. _ga, _ga_* for analytics; _gcl_* for Ads click attribution) on the cdxstreamer.com domain. When a user signs up, verifies their email, or completes a purchase, the corresponding Google Ads conversion tag sends a SHA-256-hashed version of the user’s email and name to Google so cross-device conversions can be matched (Enhanced Conversions). Raw email and name are never sent — only the irreversible hashes. We do not run remarketing or personalized advertising (ad_personalization remains disabled). Click Reject non-essential in the consent banner to opt out; we will then send Google a “denied” consent signal across all four Consent Mode v2 fields and GA4 + Google Ads will stop receiving your activity.
• Conversion attribution (functional, no cookie): When you arrive via a Google Ads click, we also read the gclid parameter from the URL and store it in your browser’s localStorage so that if you later sign up or purchase we can credit the campaign server-side. The identifier is sent only to our own backend on conversion events; no third-party request is made for this specific record.
• Functional (opt-in): cdx_visitor_id stores a random UUID used solely to apply guest preview limits more accurately than IP alone. It is only set if you accept functional cookies in the consent banner. It carries no profile information and is never shared with third parties.

We also record the IP address of preview requests for the same rate-limiting purpose, on the basis of legitimate interest in protecting the Service from automated abuse. You can change your cookie choice at any time by clicking Reject non-essential in the banner (clear the cdx_consent cookie to make the banner reappear).

6. Security

We use industry-standard security measures including HTTPS encryption, hashed passwords, session-based authentication with HttpOnly cookies, and regular security audits. Uploaded data is processed in isolated environments.

7. Your Rights

You have the right to access, correct, or delete your personal information. You can export your data, close your account, or opt out of marketing emails at any time. Contact support@cdxstreamer.com for any data requests.

8. Changes to This Policy

We may update this policy periodically. Material changes will be communicated via email. Continued use of the Service after changes constitutes acceptance.