Privacy Policy

01

Scope

This Policy covers our public website and the operation of the Platform. Where HBX processes personal data on behalf of a business customer, that customer is the controller, the data processing agreement between us governs, and this Policy applies to our role as processor only as described there.

02

Information We Collect

We collect the following categories of information:

• Account and contact data: name, business email, company, and role, provided when you request a demo, open an account, or contact us.
• Connection metadata: identifiers such as device MAC addresses, agent identities, source and destination endpoints, timestamps, and authorization decisions generated when access is requested through the Platform.
• Usage and diagnostic data: log data, IP address, browser type, and events needed to operate, secure, and improve the service.

We do not inspect, store, or process the payload or business data that travels through connections established via the Platform. The data path stays between your own systems.

03

How We Use Information

We use the information we collect to:

• authenticate and authorize access requests;
• operate, maintain, and secure the Platform;
• detect, investigate, and prevent abuse or security incidents;
• respond to inquiries and provide support;
• comply with legal obligations;
• with your consent where required, send product and service communications.

04

Legal Bases (EEA and UK)

Where the GDPR or UK GDPR applies, we process personal data on the bases of performance of a contract, our legitimate interests in operating and securing the service, compliance with legal obligations, and consent where required.

05

Sharing and Sub-processors

We do not sell personal data. We share information with service providers (sub-processors) that host and operate our infrastructure under contract, with professional advisers, and with authorities where required by law or to protect our rights. A current list of sub-processors is available on request.

06

International Transfers

We may process information in countries other than your own. Where we transfer personal data internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

07

Data Retention

We retain personal data for as long as needed to provide the service and for legitimate business or legal purposes. Connection metadata and logs are kept for a limited period for security and audit, after which they are deleted or anonymized.

08

Security

HBX is built on Zero Trust principles. Access is authenticated and authorized per connection, with no standing access and minimal attack surface. We apply encryption in transit, least-privilege controls, and continuous monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

09

Your Rights

Depending on your location, you may have the right to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us using the details below. Where we process your data on behalf of a business customer, we will refer your request to that customer.

California residents have rights under the CCPA and CPRA, including the right to know and to delete personal information. We do not sell or share personal information as those terms are defined under California law.

10

Cookies

Our website uses only essential cookies required for it to function. We do not use advertising cookies.

11

Changes to This Policy

We may update this Policy from time to time. Material changes will be indicated by updating the date above. Continued use of the website or Platform after changes take effect constitutes acceptance.

12

Contact

Questions about this Policy or our data practices can be sent to privacy@hbx-labs.com.