Privacy Policy

1. Introduction

Welcome to Haxact.com and the Haxact platform (collectively, "our Services"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Services. We respect your privacy and are committed to protecting your personal data.

Please read this Privacy Policy carefully. By accessing or using our Services, you agree to the collection and use of information in accordance with this policy.

2. Who We Are

Haxact is the controller and responsible for your personal data (referred to as "we," "us," or "our" in this Privacy Policy).

Contact Email: privacy@haxact.com

3. Information We Collect

We collect the minimum personal data necessary to provide and improve our Services:

3.1 Website Data

• User-provided information: Email address and any details you submit through contact or sign-up forms
• Session data: IP address and basic device information collected temporarily for session management and abuse prevention
• Security-relevant data: Information necessary to protect our Services against automated bots, credential stuffing, and other security threats

3.2 Platform Data

• Account information: Email address and organization name
• Authentication information: Authentication factors and session tokens managed by our identity provider for secure access
• Asset and scope metadata: Information about the assets you submit for auditing (e.g., hostnames, IP ranges, application URLs, in-scope rules) and the findings produced against them
• Engagement artifacts: Logs, requests, responses, and reproductions generated by our agents during an audit, retained for reporting and verification
• Payment information: Processed directly by Stripe (our payment processor) and not stored on our servers

4. How We Use Your Information

We use your information only for the following legitimate purposes:

• To provide, operate, and maintain our Services
• To authenticate your identity and secure your account
• To run security audits against the assets you have explicitly authorized
• To communicate with you regarding your account, audits, or our Services
• To process transactions (via Stripe)
• To respond to your inquiries and support requests
• To improve our agents, detection capabilities, and reporting quality
• To comply with legal obligations

5. How We Share Your Information

We do not sell, trade, or rent your personal information to third parties. We use the following third-party service providers to facilitate the delivery and operation of our Services:

5.1 Third-Party Services

• Stripe: Handles payment processing for purchases made through our Services. When you make a payment, you interact directly with Stripe, which may collect payment details and your email address to deliver confirmations and support.
• Cloud infrastructure providers: Our Services are hosted on infrastructure operated by reputable cloud providers that maintain ISO 27001 and/or SOC 2 certifications. Your data may be stored and processed on this infrastructure under appropriate contractual safeguards.
• Identity provider: We use a third-party identity provider to handle authentication, session management, and multi-factor authentication.
• Email and transactional messaging: We use email delivery providers to send account-related and transactional messages.
• Anti-abuse and bot mitigation: We use bot-mitigation services to protect our Services from automated attacks and abuse.

These service providers are contractually obligated to use your information only for the purposes of providing services to us and in compliance with applicable data protection laws. We encourage you to review the privacy policies of these third parties to understand how they process your information.

This is not an exhaustive list. If you have questions about a specific sub-processor, please contact us.

5.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

6. Data Security

We implement appropriate technical and organizational measures to protect your personal data and your engagement data against unauthorized or unlawful processing, accidental loss, destruction, or damage. All data is encrypted in transit (using TLS) and at rest. The infrastructure and service providers we rely on maintain ISO 27001 and/or SOC 2 certifications. Audit artifacts are stored under strict access controls and are only accessible to authorized personnel involved in delivering or supporting your engagement. No method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for legal, regulatory, tax, accounting, or reporting requirements. Audit findings and reports are retained for the duration of your account unless you request earlier deletion.

When you delete your account, we will delete or anonymize your personal data within 30 days, except where we are legally required to retain certain information.

8. Your Data Protection Rights

Depending on your location, you may have various rights regarding your personal data:

8.1 For European Economic Area (EEA) Residents (Under GDPR)

• Right to access: Request a copy of your personal data
• Right to rectification: Request correction of inaccurate data
• Right to erasure: Request deletion of your personal data
• Right to restrict processing: Request limitation of how we use your data
• Right to data portability: Request transfer of your data
• Right to object: Object to our processing of your data
• Right to withdraw consent: Withdraw consent at any time

To exercise any of these rights, please contact us at privacy@haxact.com.

8.2 For California Residents (Under CCPA/CPRA)

• Right to know: Request information about personal information collected, used, and shared
• Right to delete: Request deletion of personal information
• Right to opt-out: Opt-out of the sale of personal information (though we do not sell personal information)
• Right to non-discrimination: Receive equal service and pricing even if you exercise your privacy rights

To exercise any of these rights, please contact us at privacy@haxact.com.

8.3 For Other Jurisdictions

Various other privacy laws may grant you similar rights. Please contact us at privacy@haxact.com if you wish to exercise any of these rights.

9. Cookies and Similar Technologies

9.1 Cookies We Use

We use only strictly necessary cookies required for the operation of our Services:

• Session cookies: To maintain your session information and ensure security

We do not use tracking, marketing, or analytics cookies.

9.2 Your Cookie Choices

Most web browsers allow you to control cookies through their settings. However, if you disable cookies, certain features of our Services may not function properly.

10. Children's Privacy

Our Services are not directed to children under the age of 18, and we do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

11. International Data Transfers

Your information may be transferred to and processed in countries other than the country in which you reside. These countries may have different data protection laws. The regions in which we and our service providers operate are the EU and the US. By using our Services and/or providing us with your personal information, you consent to this.

12. Third-Party Links

Our Services may contain links to third-party websites or services that are not owned or controlled by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

14. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about our data practices, please contact us at privacy@haxact.com.

15. Complaint Resolution

If you have a complaint about our use of your information, please contact us directly first. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.