Last updated 15 October 2026 · Effective 15 October 2026 · Version 1.0
1. Scope and roles
This statement explains what data Cordex-Rules stores, where it goes, and who is responsible for it. It forms part of the Cordex-Rules EULA and supplements our Privacy Policy.
For Customer Data, you decide what is collected and why, and you are responsible for it under privacy law. We are the provider of the Software. We do not host or receive your Customer Data through the Software.
2. What is stored, and where
- Your Dataverse environment: your records, rules, schedules, versions, run history, audit log, settings, secured connections and AI configuration. Credentials are stored encrypted and are not returned to a browser.
3. What reaches us
For licence checks, the Software sends Key-Warden your licence code, environment identifier, Plan and user count. It does not send us your records.
4. AI and connected services
Cordex AI is part of the AI edition and is off until an administrator sets up a provider. When a user asks it to draft or explain a rule, the Software sends the request and the rule, table and column details needed directly from your environment to the AI provider you configure, under your own account and key. It does not pass through us. The provider's retention and training settings are set in your agreement with it; choose a provider and plan that meet your obligations.
Rules you publish can send record data to Connected Services you configure, including flows, workflows, APIs, webhooks, email and Microsoft Teams. Each receives only what your rule sends it, and handles it under its own terms.
5. Security
We design the Software to keep Customer Data in your environment, run as the signed-in user, use encrypted connections, sign licence tokens, and avoid exposing secrets to the browser. You are responsible for the security of your tenants, accounts, roles, keys, connections and backups, and for the access you grant.
6. Retention and deletion
You control how long Customer Data is kept in your environment. Uninstalling the managed solution deletes its tables and settings, including any history they hold. Your own business records are not deleted. Export anything you need to keep first.
We keep licence, account and billing records for as long as needed to provide the service and meet legal obligations (generally 7 years for tax records), then delete or de-identify them.
7. Your obligations
You must have a lawful basis and any required consents for the data you process and send, give any required notices, respond to access and correction requests, and meet the Australian Privacy Principles and any sector laws that apply to you, including your own policies for AI use.
8. Overseas disclosure
Data in your environment stays where you host it. Our licensing and account records are held in Microsoft Azure in Australia. Payment providers and any Connected Service you choose may process data overseas under their own terms.
9. Contact
MYITANDAPPS PTY LTD · ABN 82 659 633 888 · PO Box 7570, Redland Bay QLD 4165, Australia
Email: cordex-rules@myitandapps.com.au