Privacy Policy — SuperDMZ

• Account: name, email and password (stored only as a one-way hash — not even we can recover it; bcrypt algorithm).
• Billing: handled entirely by Stripe. We do not store credit card numbers on our servers — we only receive the payment status, last 4 digits and brand.
• Service usage: tunnels created (hostname, allowed IPs, port), aggregated traffic per tunnel and per month, online/offline status.
• Technical logs: IP address, browser, date and time, actions performed in the panel (create/edit/delete tunnel, login). Tunnel access tokens are automatically redacted in logs.
• Communication: messages sent through the contact or support forms (name, email and content).

• Operate and maintain the service (authentication, tunnel provisioning, billing).
• Send operational notifications by email (2FA verification, tunnel offline, payment receipts).
• Detect and prevent fraud, abuse and attacks against the infrastructure.
• Comply with legal and tax obligations.
• Improve the product (aggregated and anonymous usage analytics).

• Stripe (USA) — payment processing. Receives name, email and card data (sent directly from your browser via Stripe Elements, never passing through our servers).
• Brevo / Sendinblue (EU) — transactional email delivery (2FA, welcome, alerts).
• GoDaddy (USA) — creation and removal of DNS records (CNAME for HTTP tunnels on the dmzgate.com domain).
• Cloudflare (USA) — authoritative DNS for the superdmz.com domain (does not receive your personal data — only DNS queries).
• Anthropic (USA) — AI provider used in specific features (automatic translation of admin-panel notices and silent-flag signup analysis to detect manifestly fictitious data). When a signup is analyzed, we send name, email, declared country and source IP to the Anthropic API. We do not use the response to automatically block signups: the result is only used to display a friendly warning to the user and for administrator audit. Per Anthropic's commercial terms, data sent via the API is NOT used to train models.

We never sell, rent or assign your data for third-party advertising or marketing.

• PHPSESSID — required to keep your session logged in (essential).
• sdmz_lang — stores your selected language (preference, expires in 1 year).
• _csrf — protects forms against CSRF attacks (essential).
• sdmz_cookie_ok — records that you have seen this notice (preference).

We do not use ad-tracking cookies, social network cookies or third-party analytics.

• Active account: for as long as your account exists.
• Deleted account: data is purged 48h after deletion confirmation (there is a recovery window via email link).
• Invoices and tax records: 5 years after the last payment, per legal requirement (tax and accounting).
• Access logs (nginx): 14 days, with tokens automatically masked.
• Application logs (audit): 90 days.

• Request access to your data.
• Fix incorrect data directly in the panel (Account page).
• Change your primary email (with code confirmation + alert to the old email).
• Request account deletion directly in the panel.
• Request data portability (export in a readable format).
• Withdraw consent and revoke processing authorizations.
• File a complaint with the data protection authority (ANPD in Brazil, your local DPA in the EU).

Written requests: [email protected].

In compliance with applicable data protection law (LGPD Art. 14 in Brazil, GDPR in the EU), if we become aware that an account was created by someone under 18 without the specific and highlighted consent of at least one parent or legal guardian, the account will be suspended and associated data will be deleted. Legal guardians who identify this situation can request immediate deletion at [email protected].