Privacy Policy

Last updated: 24 September 2026

This Privacy Policy explains how Cavinx Studio SARL-S ("Cavinx", "we", "us") processes personal data when you use the cavinx.com website, the Cavinx Studio PM 2026 mobile application, your Cavinx account, and the related services (together, the "Services").

1. Data controller and contact

CAVINX STUDIO S.à r.l.-S
10A, Rue des Mérovingiens
L-8070 Bertrange
Luxembourg
Luxembourg Business Register: B307226
VAT number: LU37464544
Business permits: 10193605/1, 10193605/3, 10193605/2 and 10193605/0
Email: contact@cavinx.com
Phone: +352 621 23 62 10
Website: https://cavinx.com/

2. Data we process

Depending on how you use the Services, we may process:

  • Account and identity data: email address, account identifier, authentication information, display name, username and account preferences. Passwords are handled by our authentication provider and are not readable by Cavinx.
  • Profile and community data: biography, avatar, banner, privacy choices and content or information that you choose to publish or submit.
  • Order and transaction data: products, quantities, order status, billing or delivery details, transaction references and receipts. Payment-card details are processed directly by Stripe and are not stored by Cavinx.
  • Communications: messages sent to support, newsletter choices and records needed to manage your requests.
  • Technical and usage data: IP address, browser or device information, operating system, app or site events, diagnostic logs, security events, cookie identifiers and similar technologies.
  • Mobile-app data: information generated when the Cavinx Studio PM 2026 application accesses the same Cavinx account and Services. If a device permission is required for a feature, Android will request it at the relevant time.

3. Why we use personal data and our legal bases

  • To create and secure accounts, provide profiles, purchases, subscriptions and requested features: performance of a contract.
  • To provide support and communicate about the Services: performance of a contract and our legitimate interests.
  • To process payments, deliveries, refunds, accounting and tax records: performance of a contract and compliance with legal obligations.
  • To protect users, prevent fraud, troubleshoot problems and improve service reliability: our legitimate interests.
  • To send optional newsletters or marketing and to activate non-essential analytics or advertising technologies: consent, which you may withdraw at any time.
  • To establish, exercise or defend legal claims and comply with lawful requests: legal obligations and our legitimate interests.

4. Service providers and recipients

We share data only where necessary for the purposes described above. Providers may include:

  • Supabase: authentication, database, account metadata, server functions and file storage.
  • Stripe: checkout, payments, billing portal, fraud prevention and transaction records.
  • Brevo: transactional email, optional newsletters and customer communications.
  • Sevalla: hosting and delivery of the website and web application.
  • Directus and Sanity: management of editorial content; personal data is not intentionally placed in public editorial content unless it is meant to be published.
  • Axeptio: recording and management of cookie and tracking choices.
  • Google, Meta and TikTok: analytics or marketing technologies only when configured and permitted by your consent choices.
  • Delivery and logistics providers, including DPD: information required to fulfil and track an order.

We may also disclose information to professional advisers, competent authorities or other parties when required by law, necessary to protect rights and security, or involved in a corporate reorganisation. We do not sell personal data.

5. Cookies, analytics and marketing

Essential storage is used to operate authentication, security, shopping and your privacy choices. Optional analytics, chat and marketing technologies are activated only in accordance with the choices presented by our consent-management tool. You can change those choices at any time through the cookie settings available on the website. See our Cookie Policy for more information.

6. International transfers

Some providers may process data outside Luxembourg or the European Economic Area. Where required, we rely on an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful transfer safeguard.

7. Retention

We keep personal data only for as long as needed for the relevant purpose:

  • Account and profile data are retained while your account is active and are deleted or anonymised following a valid deletion request, subject to data that must be retained for legal or security reasons.
  • Order, payment and accounting records are retained for the period required by applicable commercial, tax and accounting law.
  • Support records and security logs are retained only as long as reasonably necessary to resolve requests, maintain security and establish legal claims.
  • Newsletter data are retained until you unsubscribe or withdraw consent, unless a limited suppression record is needed to respect that choice.
  • Consent records are retained as evidence of your choices for the period necessary to demonstrate compliance.

Residual copies may remain temporarily in protected backups until they are overwritten under our backup cycle.

8. Account and data deletion

You may request deletion of your Cavinx account and associated personal data by emailing contact@cavinx.com from the email address connected to your account. Please use the subject “Cavinx account deletion request”. We may need to verify your identity before completing the request.

Deleting an account removes or anonymises the associated account and profile data. Information may be retained where necessary to comply with legal obligations, complete transactions, prevent fraud, resolve disputes or enforce agreements. Any retained information is restricted to those purposes and removed when the relevant period ends.

9. Your rights

Subject to applicable law, you may request access to, correction of, deletion of, restriction of, or portability of your personal data. You may object to processing based on legitimate interests and withdraw consent at any time without affecting processing carried out before withdrawal.

To exercise these rights, contact contact@cavinx.com. You may also lodge a complaint with the Luxembourg National Commission for Data Protection (CNPD): https://cnpd.public.lu/.

10. Security

We use appropriate technical and organisational measures designed to protect personal data, including access controls, encrypted connections, restricted server credentials and separation of public and private data. No system can guarantee absolute security, and users should protect their credentials and notify us of suspected unauthorised access.

11. Children

The Services are not intended for children under 16. Users under 18 should use the Services only with the involvement of a parent or legal guardian where required by applicable law. If you believe that a child has provided data contrary to this policy, please contact us.

12. Third-party links and services

The Services may link to third-party websites or platforms. Their privacy practices are governed by their own notices. We encourage you to review them before providing personal data.

13. Changes to this policy

We may update this policy when the Services, providers or legal requirements change. The latest version will remain available at https://cavinx.com/privacy/, with its revision date shown above. Material changes may also be communicated through the Services or by email where appropriate.