Privacy Policy
Last updated: November 7, 2026
1. Who we are
Obelinf is a network infrastructure management platform operated by André Ribeiro, an individual entrepreneur established in Brazil, trading as Obelinf. In this policy, "Obelinf", "we", "us", and "our" refer to that operator, and "Service" refers to the Obelinf web application, API, MCP server, and website at obelinf.com.
We are established in Brazil. For the personal data described in this policy we act as the controller. When your organization stores records in the Service that contain personal data, for example contact records or device details that identify a person, your organization is the controller of that data and we act as its processor. In that role we process the data only to provide and secure the Service, on your organization's instructions, and we do not use it for our own purposes.
We are not required to appoint a Data Protection Officer. Privacy requests go to [email protected], and we answer within 30 days.
2. What this policy covers
This policy covers personal data we process as a controller: account holders, organization members, people who contact us, and visitors to our website. It does not cover the infrastructure records your organization chooses to store in the Service, which remain under your organization's control, or the practices of third-party services you connect to the Service.
3. Personal data we collect
Account and organization data
Your name, email address, profile image, authentication identifiers, organization name and slug, memberships, roles, and invitations. If you sign in with GitHub, Google, LinkedIn, or Microsoft, we receive your name, email address, profile image, and provider account identifier from that provider. We never receive your password.
Customer content
Everything you or your organization enters into the Service: sites, racks, devices, IP addresses, VLANs, circuits, cables, contacts, notes, and uploaded files. Some of this may identify a person, for example a contact record or a username in a change history entry. Your organization decides what to enter.
Billing data
Plan, subscription status, invoice history, billing country, and the last four digits and expiry of your payment method. Card details are submitted directly to Stripe and are never stored on our systems.
Usage, security, and technical data
IP address, browser and device type, request paths, timestamps, authentication events, and the audit entries generated when you change a record. We use this to operate the Service, enforce plan limits and rate limits, investigate abuse, and diagnose failures.
Communications
Messages you send through the sales form, by email, or through support, including the name, email address, company, phone number, and content you provide. We also record whether transactional email was delivered or bounced.
Website data
Standard server logs and aggregate analytics about page views, referrers, country, and device type. Analytics is self-hosted on our own infrastructure and does not use cookies or cross-site identifiers. Some forms may be protected by Cloudflare Turnstile, which processes a challenge token and technical signals to distinguish people from bots.
Where the data comes from
Most of it comes from you or your organization. Some comes from your identity provider when you sign in, from Stripe when a payment succeeds or fails, from your browser and network, and from email delivery reports. We do not buy personal data from data brokers.
4. Why we use it and our legal bases
Where the GDPR or UK GDPR applies, we rely on the legal bases below. Where the Brazilian LGPD applies, the corresponding legal hypotheses are contract execution, legal obligation, and legitimate interest.
| Purpose | Data | Legal basis |
|---|---|---|
| Create and administer your account, authenticate you, and provide the Service | Account, organization, customer content | Art. 6(1)(b) contract |
| Process payments, issue invoices, and meet tax and accounting obligations | Billing data | Art. 6(1)(b) contract and Art. 6(1)(c) legal obligation |
| Send service messages such as security alerts, invitations, and onboarding guidance | Account data, usage data | Art. 6(1)(b) contract and Art. 6(1)(f) legitimate interests |
| Keep the Service secure, prevent abuse, enforce rate limits, and debug failures | Usage and technical data, audit entries | Art. 6(1)(f) legitimate interests |
| Understand product usage and track errors | Pseudonymous organization and resource identifiers, event names, error traces | Art. 6(1)(f) legitimate interests |
| Measure website traffic with self-hosted analytics | Page path, referrer, country, device type | Art. 6(1)(f) legitimate interests |
| Respond to sales and support enquiries | Contact details, message content | Art. 6(1)(b) pre-contractual steps and Art. 6(1)(f) legitimate interests |
| Send product updates and occasional follow-up email to existing users | Name, email address, organization | Art. 6(1)(f) legitimate interests, with opt-out in every message |
| Comply with legal requests and enforce our terms | Any data needed for the request | Art. 6(1)(c) legal obligation and Art. 6(1)(f) legitimate interests |
| Protect the sales form from automated abuse | IP address, challenge token, browser signals | Art. 6(1)(f) legitimate interests |
Where we rely on legitimate interests, we have balanced them against your rights. The processing is limited to operating and securing a business service, and you can object at any time using the contact details in section 15. We do not sell personal data, and we do not use your customer content to train machine learning models.
5. Cookies
We use one cookie. It keeps you signed in and expires after 30 days or when you sign out. Because the Service cannot work without it, the law does not require us to ask for your consent to set it.
We do not use advertising cookies, and we do not track you across other websites. Our website analytics does not use cookies at all. We measure product usage on our own servers rather than in your browser. Some forms use Cloudflare Turnstile for bot protection, which may set a short-lived cookie.
6. Who we share it with
We share personal data only where it is necessary to run the Service or where the law requires it. The categories of recipients are:
- Service providers. Hosting, payments, analytics, email delivery, and network security providers act as our subprocessors under written contract. The current list, with purpose, location, and transfer mechanism, is in Schedule 1 of our Terms of Service.
- Your organization. Your name, email address, and role are visible to other members of the organizations you join, and to administrators of those organizations.
- AI assistants you connect. If you or your organization connect an AI assistant through our MCP server, that assistant reads and, if you allow it, writes infrastructure data. It processes that data under its own terms, not ours.
- Professional advisers. Accountants and lawyers, where necessary and under confidentiality obligations.
- Authorities. Courts, regulators, and law enforcement where we are legally required to respond, and only to the extent required.
- A successor. A buyer or successor in a merger, acquisition, or transfer of assets, on the same terms as this policy.
7. International transfers
We are established in Brazil. Our application, database, cache, and self-hosted analytics run on a tier-1 cloud infrastructure provider in the United States. Some subprocessors are located in or route data through the United States and other countries.
If you are in the European Economic Area, the United Kingdom, or Switzerland, your personal data is transferred outside those areas. We rely on the European Commission's Standard Contractual Clauses (Decision 2021/914, Module Two), the UK Addendum, and, where the recipient is certified, the EU-US Data Privacy Framework. Transfers from Brazil are made under the LGPD's international transfer rules.
Where a customer needs a specific transfer instrument, we will enter into the European Commission's Standard Contractual Clauses with that customer. You can request a copy of the applicable safeguards at [email protected].
8. How long we keep it
| Data | Retention |
|---|---|
| Account, organization, and membership data | While the account is active, then 30 days after deletion |
| Customer content | While the account is active, then 30 days after deletion |
| Audit and change history | 7 days on Free, 90 days on Teams, 180 days on Scale, custom on Enterprise |
| Billing and tax records | 5 years after the transaction, as required by tax law |
| Server and security logs | 90 days |
| Product analytics and error events | Up to 12 months |
| Sales enquiries | 24 months after the last contact |
| Email login codes | 10 minutes, single use |
When a retention period ends we delete the data or, where deletion is not immediately possible, isolate it and block further processing until deletion completes.
9. How we protect it
We encrypt your data while it travels between you and us, and while it is stored. Only the people who need access to it have it, and they sign in with multi-factor authentication. Every change to a record is logged, so you can see who changed what and when.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant authority as the law requires.
10. Your rights
Subject to applicable law, you have the right to:
- access the personal data we hold about you and receive a copy;
- correct data that is inaccurate or incomplete;
- delete data we no longer have a lawful reason to keep;
- restrict or object to processing, including direct marketing;
- receive your data in a portable, machine-readable format;
- withdraw consent where processing is based on consent, without affecting prior processing;
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
Send requests to [email protected]. We may ask you to verify your identity. We answer within 30 days and will tell you if we need longer and why.
If your request concerns records your organization stored in the Service, your organization is the controller and should handle it through the application, which supports export and deletion. We assist our customers with these requests when they ask us to.
You are not required by law to give us personal data. We cannot create an account without an email address, and we cannot bill a paid plan without billing details.
11. How to complain
If you are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority. In Brazil that is the Autoridade Nacional de Proteção de Dados (ANPD). If you are in the European Economic Area you can complain to the supervisory authority in the country where you live, work, or where the alleged infringement happened. In the United Kingdom that is the Information Commissioner's Office. We would appreciate the chance to resolve the issue first.
12. Automated decision making
We do not make decisions with legal or similarly significant effects about you through automated processing, and we do not profile you for advertising. Rate limiting and abuse detection can temporarily block a request, but they do not evaluate you as a person.
13. Children
The Service is a business tool and is not directed to anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us and we will delete it.
14. Changes to this policy
We may update this policy as the Service changes. For material changes we will give notice by email or in the application at least 30 days before the change takes effect, and we will update the date at the top of this page. If a change requires your consent, we will ask for it rather than assume it.
15. Contact
Controller: André Ribeiro, an individual entrepreneur established in Brazil, trading as Obelinf. Privacy enquiries: [email protected]. General and security enquiries: [email protected].