Privacy Policy

Effective: July 28, 2026 · FAVZ Group · Wyoming, USA

1. Who We Are

FAVZ Group operates HexTyx (hextyx.com), an AI red team security platform. This Privacy Policy explains how we collect, use, and protect information when you use our website and services.

Contact: legal@hextyx.com

2. Information We Collect

Information you provide:

Email address (waitlist, account registration)
Payment information (processed by Stripe — we never store card numbers)
Target system URLs submitted for security scanning
Communications you send us

Information collected automatically:

IP address (stored as a one-way SHA-256 hash — never in plaintext)
Browser type, operating system, referring URL
Pages visited, time on site, click interactions (via Google Analytics)
Cookies (see our Cookie Policy)

3. How We Use Your Information

To provide and operate the HexTyx platform
To process payments and manage your subscription
To send transactional emails (scan reports, receipts, account alerts)
To send product updates and security advisories (you may opt out at any time)
To improve our service through aggregated, anonymised analytics
To comply with legal obligations

4. Data Isolation Architecture

HexTyx operates a dual-vault data architecture:

Vault A (Identity) — stores account and billing data only. Contains no scan data.
Vault B (Scan Data) — stores scan results and findings only. Contains no personally identifiable information. The only link between vaults is a pseudonymised UUID that cannot identify you without Vault A credentials.

Sensitive fields (target URLs, exploit payloads) are encrypted at rest using AES-128-CBC. Your scan data is never used to train AI models.

5. Data Sharing

We do not sell your personal data. We share data only with:

Anthropic — AI inference for security analysis (scan content only, no PII)
Supabase — database hosting (encrypted at rest, SOC 2 Type II)
Stripe — payment processing (PCI DSS Level 1)
Railway — application hosting (SOC 2 Type II)
Google — analytics (anonymised, IP masked)

See our Sub-processor List for the complete registry.

6. Data Retention

Account data: retained while your account is active, deleted within 30 days of account closure
Scan reports: retained for 12 months by default; deletable on request
Payment records: retained for 7 years (legal requirement)
Analytics data: aggregated and anonymised after 14 months

7. Your Rights (GDPR / CCPA)

Depending on your location, you have the right to:

Access — request a copy of your personal data
Correction — update inaccurate information
Erasure — request deletion of your data (Art. 17 GDPR)
Portability — receive your data in a structured format (Art. 20 GDPR)
Objection — opt out of marketing communications at any time

To exercise any right, email legal@hextyx.com. We respond within 30 days.

8. Cookies

We use essential cookies for site functionality and analytics cookies (Google Analytics, with IP anonymisation enabled). See our Cookie Policy for details.

9. Security

We implement industry-standard security measures including encryption in transit (TLS 1.3), encryption at rest (AES-128-CBC), row-level security on all database tables, and regular security assessments. No method of transmission over the internet is 100% secure.

10. Children

HexTyx is not directed at children under 16. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact us and we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via email or a prominent notice on our site at least 14 days before taking effect.

12. Contact

FAVZ Group
Email: legal@hextyx.com
Governing law: Wyoming, USA