1. Controller and scope
Diviga, operator of Actae (“Actae”, “we”, “us”), is the controller for personal data processed through actae.dev, marketing communications, evaluations, the customer portal, licensing control plane, support, and our commercial relationship. Our legal identity is also displayed at checkout and on order documentation. Privacy questions and rights requests can be sent to hello@actae.dev.
This Policy does not make us controller of personal data processed solely inside a customer-operated self-hosted Actae runtime. For that data, the customer determines the purposes and means of processing. Where we process Actae Cloud execution data on a business customer’s instructions, that customer is generally controller and we act as processor, subject to the applicable agreement.
2. Data we collect
Account and identity
Name, email address, organization, authentication provider identifiers, password hashes, verification status, session records, security events, and account preferences.
Commercial and billing
Plan, installation, subscription and entitlement identifiers, order status, billing country, tax and invoice metadata, and limited payment information received from Polar. Polar processes full payment-card details; Actae does not store full card numbers or card security codes.
Product and technical data
Installation identifiers, runtime version and platform, enrollment and key lifecycle metadata, subscription synchronization, usage totals and quota status, IP address, request timestamps, user agent, audit records, errors, and security/availability telemetry.
Community downloads (anonymous)
Downloading the free self-hosted community build is anonymous and needs no account. We record one non-identifying event per successful download — release platform and version, a coarse country code, a coarse user-agent class, and a one-way HMAC of the IP address (never the raw IP or user agent) — to measure reach. It is never linked to a person. An unlinked self-hosted instance sends us nothing; only if you optionally link it to an account (actae enroll) does that instance report the same usage, version, enrollment, and subscription metadata as any enrolled installation.
Actae Cloud Customer Data
If you use Actae Cloud, the dedicated runtime stores the events, state snapshots, tool results, lineage, metadata, and other content your application sends. Self-hosted execution payloads remain in the PostgreSQL environment you operate and are not uploaded to the SaaS control plane as part of normal operation.
Communications
Support requests, evaluation applications, survey responses, meeting notes, and other information you choose to send us.
3. Sources
We collect data directly from you, your organization’s administrators and users, your Actae installation or SDK, and the devices and browsers used to access our Services. We also receive relevant data from providers you choose or that support the Services, including Polar for orders and subscriptions, Google or GitHub when used for sign-in, and email, hosting, security, and infrastructure providers.
4. Why we process data and our legal bases
We do not use Customer Data to train general-purpose AI models. We do not sell personal data or use it for cross-context behavioral advertising.
5. Cookies and local storage
We use strictly necessary cookies and browser storage for sessions, authentication, security, checkout continuity, and saved interface preferences. Optional analytics is provided by Google Analytics (GA4, measurement ID G-8V15ZZ83QN) and loads only after you allow optional cookies; choosing “Necessary only” leaves it disabled. Browser settings can remove stored data, but blocking necessary storage may prevent login or portal use.
6. Who receives data
We disclose data only as needed to operate the Services: to Polar as merchant of record and payment/reseller provider; hosting, database, backup, content-delivery, email, authentication, monitoring, security, and support vendors; professional advisers; and competent authorities where legally required. Organization administrators may access information associated with their workspace.
Providers process data under contractual and confidentiality obligations appropriate to their role. Polar independently controls buyer, payment, tax, invoice, fraud, and regulatory data under its own privacy terms. We may disclose data in a merger, financing, reorganization, or sale, subject to appropriate protection and notice where required. We do not sell or share personal information as those terms are used in applicable U.S. privacy laws, and we do not use Customer Data for cross-context behavioral advertising.
7. International transfers
Some providers may process data outside your country or the European Economic Area. Where required, we use a lawful transfer mechanism such as an adequacy decision or approved standard contractual clauses, together with supplementary safeguards where appropriate. Contact us for information relevant to your data.
8. Retention
We keep personal data only as long as necessary for the purposes described: account data while the account is active; subscription and entitlement data through the commercial relationship; security and operational logs for a limited period appropriate to investigation and reliability; Actae Cloud Customer Data for the retention period of the selected plan and deletion lifecycle; and tax, invoice, transaction, dispute, and legal records for periods required by law.
When you delete an account, active data is removed or anonymized unless retention is required for legal obligations, fraud prevention, dispute resolution, or security. Deletion of a Cloud installation queues removal of its runtime, volumes, credentials, and managed backup snapshots. Residual encrypted backup copies may persist until the applicable backup-rotation period ends. Self-hosted data deletion is controlled by the customer operating that runtime.
9. Security
We use measures designed for the nature of the data and current scope, including TLS, access controls, credential hashing, scoped secrets, audit logging, tenant isolation for Cloud runtimes, encrypted off-host backups, dependency and configuration controls, and incident monitoring. No system is perfectly secure. Keep credentials confidential and contact us immediately if you suspect compromise.
Our public Security page describes current controls and limitations. Actae does not claim certifications or security guarantees that are not expressly stated.
10. Your rights
Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing; receive portable data; withdraw consent without affecting earlier processing; and complain to a competent data protection authority. Where processing relies on legitimate interests, you may object based on your situation. We do not make solely automated decisions producing legal or similarly significant effects about Actae users.
Use portal export and deletion tools where available or contact hello@actae.dev. We may verify identity and authority before acting. If the request concerns data controlled by your employer or another Actae customer, contact that organization first; we will assist it as required.
11. U.S. state privacy rights and appeals
Where a U.S. state privacy law applies, you or an authorized agent may request access, correction, deletion, or a portable copy of personal information, and may exercise any applicable opt-out right by emailing hello@actae.dev with the subject line “Privacy request.” We do not sell or share personal information for cross-context behavioral advertising, so a sale/share opt-out is not currently applicable. We respond within the time required by applicable law, subject to permitted extensions and identity verification.
If we deny a request, you may appeal by replying to the decision or emailing hello@actae.dev with the subject line “Privacy appeal.” Please include the original request and the reason you believe the decision was incorrect. We will review the appeal and explain the outcome and any available escalation route required by applicable law.
12. Security incidents and Customer Data
If we confirm a security incident affecting Actae Cloud Customer Data, we will investigate, contain it, and notify the affected customer without undue delay as required by the applicable agreement and law. The customer remains responsible for determining whether notice to individuals, regulators, or other parties is required for Customer Data it controls. Contact hello@actae.dev to report a suspected vulnerability or incident.
13. Children
The Services are business software and are not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided data, contact us so we can investigate and delete it where appropriate.
14. Changes
We may update this Policy as the Services, providers, or law change. The effective date identifies the current version. We will provide reasonable notice of material changes, especially where they affect how existing account or Customer Data is used.