Last updated: March 2026 · Version 1.0
Require ApS operates conexor.io and is committed to protecting your personal data. This policy explains what we collect, why, and your rights under GDPR.
Require ApS (CVR: DK46342070) ("we", "us", "our") is a Danish private limited company that operates conexor.io — a SaaS platform that connects databases to AI models via the Model Context Protocol (MCP).
For the purposes of GDPR, Require ApS acts:
This Privacy Policy covers our role as data controller. For information about how we process data in our role as data processor, see our Data Processing Agreement.
Data collected: Email address, name, organisation/company name, hashed password, TOTP MFA secret, user ID, role within organisation.
Why: To create and manage your account, authenticate you, and allow your organisation to administer users.
Legal basis: Article 6(1)(b) — performance of a contract with you (the Terms of Service).
Retention: For the duration of your active subscription, plus 90 days after termination.
Data collected: Name, email address, company name, invoice address, VAT number, subscription plan, invoice history, payment status.
Not collected: We never see or store your card details. Payment processing is handled entirely by Stripe, Inc.
Why: To process payments, issue invoices, and fulfil our legal bookkeeping obligations.
Legal basis: Article 6(1)(b) — contract performance; Article 6(1)(c) — legal obligation (Danish Bookkeeping Act).
Retention: 5 years from invoice date (required by Danish bookkeeping law).
Data collected: User ID, IP address, action performed, resource ID, timestamp.
Not collected: We do not store query results or the content of data retrieved from your databases.
Why: Security monitoring, incident investigation, debugging, and compliance.
Legal basis: Article 6(1)(f) — legitimate interests (platform security and integrity).
Retention: 12 months.
Data collected: Encrypted connection strings for databases you connect to the platform.
Why: To enable the platform to relay AI queries to your database. Connection strings are encrypted at rest using AES-256.
Legal basis: Article 6(1)(b) — contract performance.
Retention: Deleted upon disconnection or account termination (within 90 days).
Data collected: Your name, email address, and the content of your support inquiry.
Why: To respond to and resolve your support requests.
Legal basis: Article 6(1)(b) — contract performance; Article 6(1)(f) — legitimate interests.
Retention: 2 years from closure of the support ticket.
Data collected: Email address, name, company, subscription status.
Why: To send product updates, feature announcements, and relevant service information to customers.
Legal basis: Article 6(1)(f) — legitimate interests for existing customers; Article 6(1)(a) — consent for others.
Retention: Until you unsubscribe, or 3 years after last interaction, whichever is earlier.
When you connect your database to conexor.io, you remain the data controller for any personal data within that database. We act as your data processor.
We do not sell personal data. We do not share personal data with third parties for their own marketing purposes. See the full Sub-Processor List.
Our platform runs on Microsoft Azure in the EU (West Europe / Netherlands). Your personal data remains in the EU for core platform storage.
For sub-processors located in the USA (Stripe, Anthropic, OpenAI), we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914/EU). Copies are available upon request at [email protected].
To exercise your rights, contact us at [email protected]. We will respond within 30 days.
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.
Our Services are not intended for children under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact [email protected] and we will delete it.
We may update this Privacy Policy from time to time. We will notify you of material changes by email (to the address on your account) or by prominent notice on our website, at least 30 days before the changes take effect. Continued use of the Services after the effective date constitutes acceptance of the updated policy.
For any privacy-related queries, data subject requests, or complaints:
Require ApS — Attn: Privacy/Legal
[email protected]