Privacy Policy

CDE Inc , Privacy Policy for CDE CAD System

Effective Date: 01/01/2025 · Last Updated: 09/26/2026

This Privacy Policy (“Policy”) describes how CDE Inc (“CDE,” “we,” “us,” or “our”) collects, uses, stores, and protects your personal information when you use the CDE CAD System and related services. By accessing or using our services, you acknowledge that you have read, understood, and consent to the practices described in this Policy. If you do not agree with this Policy, you must discontinue use of our services.

This Policy should be read in conjunction with our Terms of Service, which govern your use of CDE Inc services.

1

Information We Collect

We may collect the following types of information when you use CDE CAD or related services:

1.1 Account Information

• Discord user ID, username, avatar, and linked email (via Discord OAuth)
• Email address provided during registration or billing
• IP addresses (login, session, and historical)
• Browser type, version, and user agent string
• Device type, operating system, and screen resolution
• Geographic location data derived from IP addresses
• Account creation date, login timestamps, and session duration

1.2 CAD Usage Data

• In-game character data, records, and reports created within the CAD
• Community and department configurations
• Dispatch logs, call history, and activity records
• Feature usage, interaction data, and access patterns
• API call logs and integration activity
• User-generated content, notes, and attachments

1.3 Payment & Billing Information

Payment processing is handled by third-party providers (e.g., Stripe, PayPal). CDE Inc does not directly store full credit card numbers or complete payment credentials. However, we do collect and retain:

• Transaction records, invoice details, and payment confirmation IDs
• Subscription status, plan type, and billing cycle information
• Billing name, address, and partial payment method identifiers (e.g., last four digits of card)
• Chargeback and dispute records, including communications with payment processors
• Payment failure logs and retry history

1.4 Automatically Collected Data

We automatically collect certain information when you access our services, including server logs, access times, pages viewed, referring URLs, and interaction data. This data is used for service optimization, security monitoring, and fraud prevention.

1.5 Sign-In History and Linked Accounts

To stop people who were banned from coming back under a new account, we keep a short sign-in history and compare it between accounts. Matches are flagged for a person to review. Nothing is blocked or banned automatically.

• Each time you sign in, we record the time, a one-way hash of your network address and of its surrounding address block, your browser type and operating system (not the version), and a one-way hash of a random device ID your browser creates and keeps. The random ID identifies that browser, not your hardware, and clearing your site data replaces it. We keep this history for 90 days. When we started keeping it, we also added the network addresses from the previous 90 days of our sign-in security log, and each account's last recorded sign-in address, in the same hashed form. CDECAD staff who can already read that security log see a shared network only in a shortened form, such as 203.0.x.x.
• When you play on a community's FiveM server that uses CDECAD, that server sends your game identifiers (FiveM licence, Steam, Xbox, Microsoft, Cfx.re and Discord) with its requests to CDECAD. We store only one-way hashes of them, so we can tell that two accounts used the same identifier but cannot read the identifier back. Your network address and hardware tokens from the game are not sent.
• For community owners who pay by card, we keep a one-way hash of the card fingerprint Stripe provides, which tells us when the same card pays for two communities. We never receive the card number.
• If an account looks like one a community removed, that community's admins see its name, the name of the removed member and plain reasons such as “signed in from the same browser”. They never see network addresses, identifiers, hashes, or anything from other communities.

2

How We Use Your Information

We use the information we collect for the following purposes:

• Provide, maintain, operate, and improve the CDE CAD System and related services
• Authenticate users, manage access permissions, and verify identities
• Process subscriptions, payments, renewals, and billing inquiries
• Communicate with you about your account, service updates, or policy changes
• Monitor for abuse, fraud, chargebacks, and security threats
• Enforce our Terms of Service, including investigating potential violations
• Analyze usage patterns and metrics to improve our products
• Respond to and defend against chargebacks, payment disputes, and legal claims by providing transaction records, usage logs, IP data, and account activity as evidence
• Prevent fraudulent transactions and detect unauthorized account access
• Comply with applicable legal obligations, court orders, and regulatory requirements
• Pursue collections on outstanding debts, including amounts owed due to chargebacks

3

Data Storage & Security

We implement reasonable technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure.

• Data is stored on secure servers within the United States
• Access to personal data is restricted to authorized personnel only
• Encrypted connections (HTTPS/TLS) are used for all data transmission
• Regular security reviews and updates are performed

4

Data Sharing & Third Parties

We do not sell your personal information to third parties for marketing purposes. However, we may share your data in the following circumstances, which you expressly consent to by using our services:

• Service Providers: Third-party services that help us operate, including payment processors, hosting providers, analytics platforms, and email services
• Stripe: Card payments are processed by Stripe, which receives your card details directly and never passes the full card number to us. Stripe acts as an independent controller for fraud prevention and for meeting its own legal obligations, under Stripe's Privacy Policy
• Sentry: When the CAD hits an error in your browser, we send the error and a replay of that visit to Sentry, the service we use to find and fix bugs. The replay covers the minute before the error and the rest of that visit, and it rebuilds the page layout, clicks and page changes. Every piece of text, every form field and every image is hidden in your browser before anything is sent, so the replay shows the shape of the page, not what was on it. We may also record a small share of visits that had no error, hidden the same way. Sentry deletes error reports and replays after at most 90 days
• Payment Processors & Financial Institutions: We share transaction data, account activity, usage logs, IP addresses, and device information with payment processors and banks to process payments, verify transactions, and respond to chargebacks or payment disputes
• Chargeback & Fraud Prevention: In the event of a chargeback, payment dispute, or suspected fraud, we may share your personal information (including name, email, IP addresses, login history, usage data, transaction records, and any other relevant account information) with payment processors, financial institutions, chargeback representment services, fraud prevention databases, and dispute resolution bodies to contest the dispute and protect CDE Inc's interests
• Collections Agencies: If you owe outstanding balances (including amounts resulting from chargebacks, fees, or unpaid subscriptions), we may share your account information, contact details, and billing records with third-party collections agencies to recover the amounts owed
• Legal Requirements: When required by law, court order, subpoena, or government request, or when we believe in good faith that disclosure is necessary to comply with legal obligations
• Safety & Protection: To protect the rights, property, or safety of CDE Inc, our users, or the public, including to prevent fraud or other illegal activity
• Legal Proceedings: In connection with any legal proceeding, arbitration, or dispute resolution, we may disclose relevant personal information as evidence or in the course of legal discovery
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your data may be transferred as part of the transaction

The sign-in history, game identifier hashes and card fingerprint hashes described in section 1.5 are used only to link accounts that belong to one person. They are not sold, and they are not shared with other communities.

5

Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Upon account termination or subscription cancellation:

• CAD data (records, reports, community configurations) may be deleted without prior notice or opportunity for export
• Account information, billing records, and usage logs may be retained for legal, operational, or fraud prevention purposes
• No guarantee is made regarding data recovery after termination

We may retain certain data beyond account termination as required by law or for legitimate business purposes, including but not limited to:

• Billing & Transaction Records: Retained for three (3) years for tax, accounting, and financial compliance
• Recent Payments: If you paid for a community in the last 180 days, your name, email address, Discord ID, billing records, and sign-in history are kept for up to 180 days after your last payment so we can answer a payment dispute, even after you ask us to delete your account. While they are kept, your account is switched off and cannot sign in
• Chargeback & Dispute Records: Retained until the dispute, chargeback, or unpaid balance is resolved, and for 180 days after that, to answer the payment processor and any follow-up claim
• Sign-In History: The hashed sign-in records described in section 1.5 are deleted automatically after 90 days
• Fraud Prevention Data: For accounts we terminate or ban for abuse, IP addresses, device identifiers, and account activity are retained for as long as the ban is in place, to prevent re-registration and detect patterns of abuse. For accounts deleted at the owner's request, they follow the periods above
• Legal Compliance: Any data required to comply with applicable laws, regulations, legal processes, or enforceable governmental requests
• Collections: Account and billing information may be retained as long as an outstanding balance remains, including during and after collections proceedings

6

Cookies & Tracking

We may use cookies and similar technologies to:

• Maintain your session and authentication state
• Remember your preferences and settings
• Analyze site traffic and usage patterns
• Improve the performance and functionality of our services

You may configure your browser to reject cookies, though this may affect your ability to use certain features of the CDE CAD System. Section 8 describes the analytics and advertising cookies specifically, including how to turn them off without losing access to the CAD.

7

Your Rights

Depending on your jurisdiction, you may have the right to:

• Request access to your personal data
• Request correction of inaccurate data
• Request deletion of your personal data
• Object to or restrict processing of your data
• Request data portability

To exercise any of these rights, use the data request form or email [email protected]. We respond within 30 days.

8

Analytics & Advertising Technologies

We use Google Analytics 4 and a Google Ads tag on our public marketing pages. These are provided by Google LLC and its affiliates, which set their own cookies and identifiers in your browser.

8.1 What these tools collect

• Pages you view, how long you stay, and the links you follow
• An approximate location derived from your IP address
• Device type, operating system, browser, and screen size
• The site or advertisement that referred you to us
• Cookie identifiers that let Google recognise the same browser across visits and, where Google Ads is involved, across other sites in its network

8.2 Google's role

For some of this processing Google acts as an independent controller and uses the data for its own purposes under its own terms. See Google's Privacy Policy and How Google uses data when you use our partners' sites.

8.3 How to opt out

• Install the Google Analytics Opt-out Browser Add-on
• Adjust your Google ad settings at adssettings.google.com
• Configure your browser to reject or delete third-party cookies
• Use the cookie controls we provide where they are offered to you

These tools run on our public marketing pages. They are not used to profile the operational CAD records inside a community's dispatch system.

9

If You Are in the EEA, UK, or Switzerland

The GDPR and UK GDPR give you rights in addition to those in section 7, and require us to tell you the legal basis on which we process your data.

9.1 Our legal bases

• Performance of a contract: operating your account and delivering the CAD system you or your community signed up for
• Legitimate interests: keeping the service secure, preventing fraud and abuse, defending against chargebacks, and improving the product - balanced against your rights
• Consent: analytics and advertising cookies, and marketing email. You may withdraw consent at any time, which does not affect processing already carried out
• Legal obligation: tax, accounting, and responding to lawful requests

9.2 Your rights

You may request access, rectification, erasure, restriction of processing, and portability, and you may object to processing carried out on the basis of our legitimate interests. We do not make decisions producing legal or similarly significant effects about you by solely automated means.

You also have the right to lodge a complaint with your local supervisory authority. In the UK that is the Information Commissioner's Office. In the EEA, a list is maintained by the European Data Protection Board.

9.3 Sending your data to the United States

Our servers and staff are in the United States, so using our service means your data is transferred there, where data protection law differs from your own.

Where personal data leaves the EEA, the UK, or Switzerland, we work to keep it protected to the standard those laws expect, and we choose providers that offer recognised transfer protections. The main ones we rely on, Google and Stripe, participate in the EU-US Data Privacy Framework, and you can check their current status on that public list rather than taking our word for it.

If you want to know what applies to a particular transfer, or you run a community and need specific safeguards put in writing, contact us at [email protected] and we will tell you what is in place.

10

If You Are in California or Another US State

California, and a growing number of other states, give residents specific rights over personal information. Where those laws apply to you, you may:

• Ask what categories of personal information we have collected, where it came from, why we collected it, and who we disclosed it to
• Ask for a copy of that information
• Ask us to correct information that is wrong
• Ask us to delete it, subject to the exceptions those laws allow
• Opt out of the sale or sharing of personal information
• Appeal a refusal, where your state provides an appeal

We do not sell personal information for money. The advertising tags described in section 8 may nonetheless count as “sharing” for cross-context behavioural advertising under California law. You can opt out using the controls in section 8.3, and we honour the Global Privacy Control signal where your browser sends one.

We will not deny you service, charge you a different price, or give you a lower quality of service for exercising these rights. You may use an authorised agent to make a request on your behalf; we may ask you to verify that you gave them permission.

11

Communities, and Who Controls Your Records

CDE CAD is used by independent roleplay communities. Two different relationships are going on at once, and which one applies changes who you should ask about your data.

• Your CDE CAD account - your login, email, and billing. We decide how this is handled, so this Policy governs it and you can come to us directly.
• The records inside a community - your roleplay character, department membership, call history, reports, and disciplinary records. The community that runs the server decides what is collected and how long it is kept. We process it on their instructions, as their service provider.

For records inside a community, ask that community's owner or staff first, since they control them. If you cannot reach them, contact us and we will help where we are able to. We may need the community's instruction before we can change or delete records they control.

If you operate a community and need a data processing agreement to meet your own obligations, contact us at [email protected] and we will provide one.

12

Consent to Data Use in Payment Disputes

By using CDE Inc services, you expressly consent to the collection, retention, and disclosure of your personal information for the purpose of responding to and defending against chargebacks, payment disputes, fraud claims, and related legal proceedings.

This includes consent for CDE Inc to share the following data with payment processors, banks, card networks (e.g., Visa, Mastercard), dispute resolution services, and collections agencies:

• Your name, email address, and billing information
• IP addresses and device information associated with account activity
• Login timestamps, session data, and usage logs demonstrating service delivery
• Transaction records, subscription history, and payment confirmations
• Any communications between you and CDE Inc
• Evidence of service access, feature usage, and account activity

This consent survives account termination and is irrevocable with respect to data already collected during your use of our services.

13

Children's Privacy

Our services are not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete it promptly. If you are a parent or guardian and believe your child has provided personal information to CDE Inc, please contact us at [email protected].

In the EEA and the UK the age at which someone can agree to online services on their own is set by each country, and ranges from 13 to 16. If you are under that age where you live, a parent or guardian has to agree on your behalf. Communities running a server are responsible for the age of their own members, and should set a minimum age that meets the law where their members are.

14

International Users

CDE Inc operates from the United States, and our servers and staff are there. If you use our services from anywhere else, your information is transferred to, stored in, and processed in the United States, where data protection law differs from your own.

If you are in the EEA, the UK, or Switzerland, section 9 covers how those transfers are handled and the rights you have. Those rights apply whether or not you agree to this Policy - we do not treat your continued use of the service as a substitute for them.

15

Changes to This Policy

CDE Inc reserves the right to update this Privacy Policy at any time. Changes will be posted on this page with an updated “Last Updated” date. It is your responsibility to review this Policy periodically. Continued use of our services after changes are posted constitutes your acceptance of the revised Policy. If you do not agree with any changes, you must discontinue use of our services.

16

Contact

If you have questions or concerns about this Privacy Policy or how your data is handled, please contact us:

CDE Inc

Email: [email protected]

Website: https://cdecad.com

Related Policies

Please also review our Terms of Service for the complete agreement governing the use of our services.