Privacy Policy

What CEN processes, why it is needed, and the choices you have.

Effective September 27, 2026 · Terms of Service

1. Scope and contact

This policy covers the Community Exchange Network (“CEN,” “we,” or “us”) at cenpbx.com and its administration, API, documentation and account subdomains. It describes the current website, account system and routing directory. It does not cover independently operated community PBXs or Discord’s own services.

The CEN operator is the contact for information handled by this service. Send privacy questions, access, correction or deletion requests to [email protected]. Include your CEN account email and enough detail to identify your request. Do not send your password, API key or Discord access token.

2. Information we process

• Accounts: name, email address, password hash, account status and permissions, account timestamps, email verification and password-recovery records, and the time and version of accepted terms. Passwords are checked during authentication; the account database stores password hashes rather than readable passwords.
• Communities and exchanges: names, area codes, exchange blocks, router hostnames and ports, operational status, contact details, websites and notes supplied by operators, application descriptions and review decisions, delegated ownership, domain verification records and portal branding. Published portals expose the configured community name, message, contact email, website and area code to visitors.
• API access and routing: credential hashes and prefixes, credential status and usage timestamps, the number submitted for a routing lookup and the destination or intercept result. Infrastructure logs may include requested paths and query strings, including dialed numbers sent in lookup URLs.
• Security and operations: IP addresses, request and browser information in infrastructure logs, session records, errors, and administrative audit records showing the actor, action, time, affected record and selected changed values.
• Customer portals and support: community memberships, approval status, assigned Local Numbers, ticket subjects and message bodies, requester names and email addresses, internal operator notes, assignments, timestamps and email delivery records. The support mailbox is checked for new messages. Readable email text is imported; attachments are not imported. Original messages remain in the mailbox.

The current routing API resolves destinations; it does not carry or record call audio. Independent PBXs may handle audio, call records or recordings under their own policies. This policy will need to reflect any future CEN features that change how calls or personal information are processed.

3. Discord OAuth and account linking

Discord sign-in is optional. We request the identify permission, which allows Discord to return a basic profile. CEN uses and stores your Discord user ID to connect an existing CEN account and recognize you at later sign-ins. The current integration does not save the other profile fields returned by Discord.

We do not request the Discord email permission, messages, friend lists, server memberships or permission to join servers. We do not receive your Discord password. CEN does not use Discord data for advertising or sell it.

During authorization, your browser visits Discord. Discord receives the authorization request, the application identifier, redirect information and information associated with your visit. CEN exchanges the authorization code for an access token and uses that token to fetch your profile. The application does not persist Discord access or refresh tokens in its account database or session; it uses the access token during the callback. Temporary session state protects the authorization flow.

Connecting or disconnecting Discord is recorded in administrative audit history, which can include the Discord user ID. Disconnecting in Account Settings removes the active account link and prevents future sign-ins through that link. It does not automatically erase historical audit records or backups, revoke Discord’s authorization, or end a CEN session already signed in. Sign out of CEN to end your current session, and use Discord’s Authorized Apps settings to revoke authorization there.

To request removal or correction of stored Discord data, including historical records, email [email protected]. Requests are handled manually after appropriate identity verification. Discord data is used only for the stated sign-in and associated security purposes; deletion requests are handled promptly, subject to any retention required by law.

Discord handles information under its own Privacy Policy and Terms of Service. CEN’s integration is also subject to Discord’s Developer Terms; this policy does not override those requirements.

The FreePBX generator processes the prefix, hostname, port and peer name you submit to create a download; it does not ask for API keys or IAX passwords. Community portals are hosted by CEN at cenpbx.com subdomains and show only the portal name, message, contact email and website the community publishes; customer sign-in is also available inside published portals using the shared CEN identity.

4. Why we use information

We use information to authenticate users, manage community and exchange records, return routing responses, send email-verification and account-recovery messages, provide support, investigate abuse, protect the network and meet applicable legal obligations. Administrative records help identify who changed access or routing settings.

Where a legal basis is required, processing may be necessary to provide the service you request, for legitimate interests in operating and securing the network, to meet legal obligations, or with your consent where required. The applicable basis depends on the activity and local law. Choosing optional Discord authorization does not replace any consent required for unrelated processing.

5. Cookies and service providers

CEN uses session and request-verification cookies to keep you signed in and protect forms. The account session is shared across CEN subdomains. Blocking these cookies may prevent account features from working. The current application does not include advertising cookies or third-party marketing analytics.

Hosting and database infrastructure process information to run the service. Cloudflare handles website traffic and may process network and security information or set cookies for its services. The configured mail provider hosts the support mailbox and delivers account and ticket email; email delivery involves recipient addresses, message content and delivery information. Discord processes optional sign-in requests as described above. Providers may process information in countries other than yours under applicable arrangements and legal requirements.

Cloudflare Turnstile

Public signup, password sign-in, password-recovery and FreePBX download forms use Cloudflare Turnstile to help distinguish people from automated abuse. Your browser connects to Cloudflare and may provide technical signals such as IP address, browser and device characteristics, and challenge interaction information. CEN sends the resulting short-lived verification token to Cloudflare and checks the result, hostname and form action before processing the submission. We do not send your password, account form fields or API credentials to Turnstile. Cloudflare processes its service data under its Privacy Policy.

6. When information is shared

Authorized CEN administrators can access account, community, exchange and audit records for operation and support. Authenticated routing clients receive the destination details necessary to route a number, including the exchange block, destination host and port. This does not give them access to the account database or Discord IDs.

Information may be processed by service providers performing hosting, security and email functions, or disclosed when required by law. Requests for disclosure are assessed against applicable law and provider requirements. Discord-derived data is shared only as permitted by Discord’s Developer Terms, such as with service providers, when legally required, or when you expressly direct it. CEN does not sell personal information or share it for cross-context behavioral advertising.

CEN administrators and the relevant community operator can access that community’s customer memberships and support tickets. Internal support notes are hidden from customers. Other customers cannot read your tickets. Platform support requests emailed directly to CEN are handled by CEN administrators. Customer portal access does not expose network API keys or PBX credentials.

7. Retention and security

Account and configuration records are retained while needed to provide and administer the service. Security logs, audit history and backups may outlast an active account or Discord link where needed for security, recovery or legal obligations. There is currently no single automatic deletion period covering all these records; deletion requests require review of the relevant live records and backups. We consider the purpose, necessity and applicable legal requirements when deciding what must be retained.

We use HTTPS, access controls, hashed account passwords and API credentials, and restricted administration to protect information. No system guarantees absolute security. Keep credentials private and report suspected unauthorized access to the contact above. Do not put sensitive information or credentials in community notes or other free-text fields.

8. Your choices and requests

You can update your display name and password in Account Settings, disconnect Discord, and ask an administrator to correct account or community information. Contact us to request access, a copy, correction, restriction or deletion of your personal information, or to close your account. Depending on your location and the circumstances, you may also have rights to object, withdraw consent or complain to a privacy regulator. Withdrawing consent does not affect processing that was lawful before withdrawal.

We may need to verify your identity without collecting more information than necessary. We will explain applicable limitations or information that must be retained and respond within time limits required by applicable law. Closing your CEN account does not remove information held independently by Discord or another community; contact those operators separately.

9. Children and policy changes

CEN is not intended for children under 13 or anyone below a higher applicable minimum age. If you believe a child has provided personal information contrary to these requirements, contact us so we can investigate and address it.

We will update this page when practices change and revise the effective date. Material changes will be highlighted on the service or communicated where practicable; additional notice or consent will be provided where required.