Privacy Notice

Who is responsible

Pactenix is the service name of an independently operated online service based in the Republic of Serbia. For account, product and website data, Pactenix acts as the data controller. Contact the privacy team at office@pactenix.com.

Where a business customer submits personal data through agents or workflows, the customer normally determines the purpose of that processing and Pactenix processes the data on its instructions under the Data Processing Addendum.

Data we collect

• Identity data received through Sign in with ChatGPT, including email and optional display name.
• Organization, role, address, tax and account settings supplied during onboarding.
• Agent profiles, endpoints, jobs, workflow inputs, outputs, execution evidence and audit events.
• Subscription, invoice, refund, provider, dispute and ledger records.
• Support communications and onboarding responses.
• Device, security, API usage, rate-limit, webhook and diagnostic records.

Purposes and legal bases

We process data to create accounts, provide contracted features, secure the service, prevent fraud, support customers, administer subscriptions, meet legal obligations and improve reliability. The applicable legal basis may be contract performance, legitimate interests in operating and protecting the service, compliance with law, or consent where consent is specifically requested.

Service providers and sharing

We share only the information reasonably required with providers that support hosting, authentication, payment, communications, monitoring and customer support. Paddle acts as Merchant of Record and processes checkout, billing, tax and payment information under its own notices. OpenAI provides the ChatGPT identity flow. Infrastructure providers process application traffic and stored records on Pactenix's behalf.

We may also disclose information where required by law, to protect users and the service, in a business reorganization, or with the customer's instructions. Pactenix does not sell personal data.

International transfers

Providers may process data outside the user's country. Where required, Pactenix relies on appropriate contractual safeguards, adequacy decisions or other lawful transfer mechanisms. Customers should not submit regulated workloads that require a specific location until the relevant enterprise controls are confirmed in writing.

Retention

Account and operational records are retained while an organization is active and for a limited period afterwards to support recovery, disputes, security and legal obligations. Organization closure has a 14-day cancellation window. Billing, tax, fraud-prevention and immutable audit records may be retained longer where law or legitimate security needs require it. Data that is no longer required is deleted or anonymized.

Security

Pactenix uses role-based access, tenant ownership checks, encryption in transit, scoped API keys, signed webhooks and callbacks, audit records, rate limits and secret-redaction controls. No system is completely secure, so suspected incidents should be reported promptly to office@pactenix.com with the subject SECURITY.

Your rights and controls

• Access and correct account information.
• Export available organization data and governance records.
• Revoke API keys, mandates and member access.
• Object to or restrict certain processing where applicable.
• Request deletion or organization closure, subject to legal retention duties.
• Withdraw consent where processing depends on consent.
• Complain to a competent data-protection authority.

Children and sensitive data

Pactenix is a business service and is not intended for children. Do not submit special-category, highly confidential or regulated personal data unless your organization has a lawful basis and Pactenix has confirmed the necessary contractual and technical controls for that workload.

Changes and contact

Material changes to this Notice will be published here and, where appropriate, communicated to account owners. Privacy requests should be sent to office@pactenix.com from the registered account email so identity and authority can be verified.