Privacy Notice
Draft for operator review before production launch
What Hexa Shield processes
Hexa Shield may process account information, authentication data, configured domains and origins, billing records, API-key metadata, security events, traffic analytics, and operational logs required to run the service.
Authentication data
Password hashes, session-token hashes, API-key hashes, verification tokens, and external identity metadata are handled by the backend. Raw API-key secrets are intended to be shown once at creation and not stored afterward.
Traffic and security telemetry
Protected traffic can generate aggregate counters and security events such as request path, action, rule information, IP address, and user-agent data. Sensitive request headers should not be retained in plain form by the security-event pipeline.
Payments
When online billing is enabled, payment checkout is handled through the configured payment provider. Hexa Shield stores local payment status and provider identifiers required to reconcile the transaction, but card details should remain with the payment provider.
Retention
Retention periods depend on the deployed service configuration. The current live analytics implementation uses a short Redis-backed retention window; durable account, domain, billing, and security-event records remain in PostgreSQL until removed according to the operator's policy.
Operator responsibility
This draft must be reviewed and completed with the legal entity name, jurisdiction, contact details, actual retention periods, subprocessors, and user-rights procedures before public launch.