This policy explains how H100 Solutions ("H100", "we"), which runs DockBay, handles personal data on the dockbay.io site, in pilot access requests and in the DockBay service (API, MCP server, events, webhooks and CLI, together the "Service"). It follows Brazil's General Data Protection Law (Law No. 13,709/2018, "LGPD"). This is a translation; if the versions differ, the Portuguese version prevails.
1. Who we are and how to reach us
H100 Solutions is the controller of the personal data described in this policy, except Email Content, which we process on behalf of the customer (see section 2.3). For questions, requests about your data and contact with our data protection officer, write to admin@h100.com.br.
2. Data we process
2.1 Pilot access requests
Name, email, organization (optional) and the description of the use case. The site form neither stores nor sends this data: it opens your email app with the message ready, and the data only reaches us if you send that message.
2.2 Account and configuration
Account name; name, scopes and allowed mailboxes of each API key; registered domains and the state of their DNS verification; webhook addresses and secrets; mailbox display names. API keys are stored only as a hash and shown in full once, when created.
2.3 Email Content
Messages sent and received by the account's mailboxes: senders, recipients, subjects, bodies, headers, attachments, conversations, events and delivery data. This content may contain personal data of third parties who write to the mailboxes or receive messages from them. The customer using the Service decides what is sent and received and is the controller of this content; we process it to provide the Service and, as described in section 3, to develop and improve DockBay.
2.4 Technical data
Source IP address and port, date and time, method, path (without parameters) and response code of requests to the Service, and the user agent. Technical logs do not include message bodies, attachments, API keys or URLs with credentials.
2.5 Site
The site does not use cookies, audience analytics or advertising pixels. It keeps in your browser, without sending it to us, your language choice (local storage) and the form draft while the tab is open (session storage). The site loads nothing from third parties: fonts, images and scripts are served by dockbay.io itself.
2.6 Communications
What you write to us by email, including support requests and replies to invitations.
3. Why we use data and on what legal basis
- Evaluating and answering access requests: steps prior to a contract, at your request (LGPD art. 7, V).
- Providing the Service: creating and operating mailboxes, sending, receiving and storing messages, delivering events and webhooks, authenticating keys and enforcing scopes: performance of a contract (art. 7, V).
- Security and abuse prevention: protecting accounts, enforcing usage limits, investigating improper sending and fraud: legitimate interest (art. 7, IX).
- Developing and improving DockBay: unless otherwise agreed in writing with the customer, we may use account data, technical data and Email Content to fix, evaluate and improve the Service and to build new features, including training, fine-tuning and evaluating artificial intelligence models and algorithms: legitimate interest (art. 7, IX), with the safeguards of art. 10, or consent where the law requires it. A customer who does not want this use needs a specific written agreement with H100.
- Meeting legal and regulatory obligations, including keeping the application access logs required by Brazil's Internet Civil Framework (Marco Civil da Internet, Law No. 12,965/2014): art. 7, II.
- Exercising rights in legal, administrative or arbitration proceedings: art. 7, VI.
- Announcing changes to the Service, these documents and the pilot: performance of a contract and legitimate interest.
We do not sell personal data and do not use it for targeted advertising.
Automated decisions
The Service applies automatic usage limits per key and per account, which may temporarily refuse operations. If a decision made solely by automated means affects your interests, you can request its review (LGPD art. 20) through the contact in section 1.
5. International transfers
Service data is stored in Brazil (São Paulo region). Some providers are based abroad and may process data outside the country, for example for support, security, or to deliver the site from the location closest to the visitor. These transfers follow LGPD art. 33 and the contractual data protection commitments made by those providers.
6. How long we keep data
- Messages and attachments: up to 30 days after they are received or sent; the full original message (MIME) for up to 7 days.
- Events, webhook deliveries and receiving records: up to 30 days.
- Account and configuration data: while the account exists; afterwards, for as long as the law requires or as needed to exercise rights.
- Database recovery copies: a few hours, on a rolling basis.
- Service access logs: 6 months, as required by the Marco Civil da Internet, or longer when ordered by an authority.
- Access requests and communications: as long as needed to evaluate and follow up on the request and at most 6 months after the last contact, unless you become a customer.
Anonymized or aggregated data may be kept indefinitely. Models already trained or fine-tuned do not need to be rebuilt after the data used for training is deleted.
7. Security
We use encrypted connections (HTTPS/TLS), encrypted storage, API keys stored only as hashes, scopes and mailbox restrictions per key, isolation between accounts, and technical logs without message content or credentials. No system is completely secure; if an incident occurs that may cause significant risk or harm, we will notify the affected data subjects and Brazil's National Data Protection Authority (ANPD), as the LGPD requires.
8. Your rights
Through the contact in section 1 you can request: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary or excessive data or data processed in breach of the law; portability; deletion of data processed on the basis of consent; information about who we share data with; information about the possibility of not consenting and its consequences; withdrawal of consent; objection to processing carried out without consent when it breaches the LGPD; and review of automated decisions. We answer within 15 days. We may ask for information to confirm your identity.
If your data is in the Email Content of a DockBay customer, that customer is the controller of that data: we will forward the request to them or tell you how to contact them. You may also lodge a complaint with the ANPD.
9. Children and adolescents
The Service is intended for people aged 18 or over and for organizations. We do not knowingly process data of children or adolescents. If you become aware of such a case, write to the contact in section 1.
10. AI agents
AI agents use the Service with the keys and permissions given by the account holder. Data that an agent sends, receives or reads through DockBay is handled like any other use of the account.
11. Changes to this policy
We may update this policy. The date at the top shows the version in force. Significant changes will be announced on the site and, for account holders, by email, before they take effect whenever possible.