Last updated 15 October 2026 · Effective 15 October 2026 · Version 1.0
1. Scope and roles
This statement explains what data Cordex AI Gateway stores, where it goes, and who is responsible for it. It forms part of the Cordex AI Gateway EULA and supplements our Privacy Policy.
For Customer Data, you decide what is collected and why, and you are responsible for it under privacy law. We are the provider of the Software. We do not host or receive your Customer Data through the Software.
2. What is stored, and where
- Your Dataverse environment: your records, gate and approval settings, provider configuration, the audit log and licence data. Provider secrets are held in a secured column.
3. What reaches us
For licence checks, the Software sends Key-Warden your licence code, environment identifier, Plan and user count. It does not send us your records.
4. AI and connected services
When a request passes the gates you configure, the Software sends it, with any data it includes, directly from your environment to the AI provider you configure, under your own account and key. It does not pass through us. The provider's retention and training settings are set in your agreement with it; choose a provider and plan that meet your obligations. Requests that do not pass the gates are not sent.
5. The audit log
Every call through the gateway is written to an append-only, hash-chained audit log in your environment. What each entry records is described in the product documentation. The log may contain personal information from requests; you control access to it and how long it is kept.
6. Security
We design the Software to keep Customer Data in your environment, run as the signed-in user, use encrypted connections, sign licence tokens, and avoid exposing secrets to the browser. You are responsible for the security of your tenants, accounts, roles, keys, connections and backups, and for the access you grant.
7. Retention and deletion
You control how long Customer Data is kept in your environment. Uninstalling the managed solution deletes its tables and settings, including any history they hold. Your own business records are not deleted. Export anything you need to keep first.
We keep licence, account and billing records for as long as needed to provide the service and meet legal obligations (generally 7 years for tax records), then delete or de-identify them.
8. Your obligations
You must have a lawful basis and any required consents for the data you process and send, give any required notices, respond to access and correction requests, and meet the Australian Privacy Principles and any sector laws that apply to you, including your own policies for AI use.
9. Overseas disclosure
Data in your environment stays where you host it. Our licensing and account records are held in Microsoft Azure in Australia. Payment providers and any Connected Service you choose may process data overseas under their own terms.
10. Contact
MYITANDAPPS PTY LTD · ABN 82 659 633 888 · PO Box 7570, Redland Bay QLD 4165, Australia
Email: cordex-ai-gateway@myitandapps.com.au