Hexes Privacy Notice

Version 1.0 · Effective date: 2026-11-11

This Privacy Notice explains how Hexes Security, Inc. ("we", "us") collects, uses, shares and protects personal data when you visit hexessecurity.com and our other websites (the "Sites"), contact us, use our products and services (the "Offerings"), attend our events, or otherwise interact with us. It also explains the choices and rights you have.

Hexes Security, Inc. provides security software to businesses. Our Offerings and Sites are intended for business use by people aged 18 or over.

1. Who is responsible for your data

Hexes Security, Inc., 2261 Market Street STE 68751, San Francisco, CA 94114, USA, is the controller of the personal data described in this notice.

Customer data in our products is different. Hexes software usually runs in our customers' own environments, and our customers decide what data it processes. When we process personal data on a customer's behalf (for example, in a support bundle a customer sends us, in a hosted evaluation, or in a hosted service), we act as that customer's processor (or "service provider"), under our agreement with the customer, including the Hexes Data Processing Addendum. In a hosted evaluation, the Hexes console that we run receives and stores data from the clusters the customer connects to it, such as workload, network, process, file and event data, which can include personal data such as user names and IP addresses; we delete it when the evaluation ends, as the Hexes Customer Agreement describes. In those cases the customer's privacy notice applies, and requests about that data should go to the customer. We will help our customers respond.

Contact: [email protected], or by post to Hexes Security, Inc., Attn: Legal (Privacy), at the address above.

2. Personal data we collect

2.1 Data you give us

• Contact and inquiry data: name, work email address, company, job title, phone number, and the content of messages you send us through forms, email or chat, including what you tell us about your environment and needs.
• Evaluation requests: the details you give when you ask for an evaluation (trial), such as your name, work email, company and what you want to evaluate, and the evaluation we set up for you.
• Account and customer data: name, business contact details, username, role and organization for accounts on our customer portal and the consoles we host, and records of sign-ins and actions in them (audit logs). You sign in to these through our identity and sign-in provider, with your organization's own sign-in service or a one-time code sent to your email; we do not keep passwords for them. Billing contact and purchase details (we do not store full payment card numbers; payments are handled by our payment processors).
• Support data: information you provide in support requests, and contact details of the people raising them. Support bundles and diagnostics you choose to send may contain data from your environment; we process that data as a processor (see Section 1).
• Event and marketing data: registrations, attendance, preferences and communications choices.
• Recruiting data: information you provide when you apply for a job, such as your résumé, work history and references.
• Security reports: information you send when reporting a vulnerability to us.

2.2 Data we collect automatically

• Site usage data: our Sites set no cookies and store nothing in your browser to measure use. For each page view, we record the page, the referring site, campaign parameters in the link, the country and device type reported by our content delivery and network security provider, and which buttons or sections were used. To count visitors without identifying them, we keep only a code derived from your IP address and browser details in a way that cannot be reversed and that changes every day, so that a visit cannot be linked to one on another day; we record none of this when your browser sends a Do Not Track or Global Privacy Control signal. We also log requests (such as time, page, status, browser string, referring site and network address) to run and secure the Sites. See our Cookie Notice.
• Product usage data (call home): a short daily report that our software sends to us where it can reach us, containing a random identifier of the installation, license and customer identifiers, product and platform versions, counts (such as nodes, workloads and groups per mode, and the total number of security events in the last 24 hours, in two totals for the more serious and the less serious ones, without any detail of the events), which licensed features are on, and health indicators. The product documentation lists every field, and the console shows the last report sent. We use it internally to troubleshoot, support, secure and improve our products and to verify license entitlements. Call home is on by default and can be turned off; if it is off or cannot reach us, the software keeps working as before. Our customers also provide a usage report that the software produces when we ask or as their order states. The report is designed to exclude the names of workloads, namespaces, images, nodes and users, IP addresses, and the content of policies, events, network traffic, files, secrets and credentials, but we receive the network address that a report comes from, which can be personal data in some cases.
• Cluster names you give us: when you add a cluster in a hosted console, the console tells our portal the name you gave that cluster (not sent by call home). We show it to you and to our staff who support your account, use it to tell your clusters and registry keys apart, and keep it for as long as the cluster's registry key record.

2.3 Data from other sources

• Business partners: resellers, marketplaces and distributors that share order and contact details with us.
• Business contact sources: publicly available professional information, event organizers and data providers, to the extent permitted by law.
• Your organization: an administrator at your company may give us your contact details to set up an account or support access.

3. How we use personal data and our legal bases

Where the EU or UK General Data Protection Regulation ("GDPR") applies, we rely on the legal bases shown below.

Where we rely on legitimate interests, we have balanced those interests against your rights. You can ask us for more information about this balancing, and you can object (see Section 8).

We do not use personal data for automated decision-making that produces legal or similarly significant effects on you. We do not use customer data, or product usage data that identifies a customer, to train or fine-tune any machine-learning or generative-AI model without that customer's written consent.

4. How we share personal data

We do not sell personal data. We disclose personal data only as follows:

• Service providers that process it on our behalf, under contracts that require them to protect it and use it only to provide services to us. Today these fall into two categories: a content delivery and network security provider, which also provides identity and sign-in, and which runs the network in front of our Sites, customer portal and hosted consoles (routing, encryption, sign-in and protection against attacks); and an email service provider, which provides our business email, including messages from our contact form and support email. Our Sites, customer portal and hosted consoles are currently hosted in the United States, and we use no third-party analytics or advertising services. If we add a category of provider (for example, for payments), we will update this notice. The providers that process customer data on our customers' behalf are named in our subprocessor list at hexessecurity.com/legal/subprocessors, or provided on request.
• Partners involved in your purchase or deployment, such as resellers and marketplaces, where you buy through them or ask us to involve them.
• Your organization, where you use an account your organization administers.
• Professional advisors, such as lawyers, auditors and insurers, under confidentiality.
• Legal and safety: authorities or others where required by law or legal process, or where necessary to protect the rights, property or safety of Hexes Security, Inc., our customers or others. We review government requests carefully and disclose only what is legally required.
• Corporate transactions: in connection with a merger, acquisition, financing or sale of assets, subject to confidentiality and to this notice.
• With your consent or at your direction.

No selling or sharing for advertising. We do not sell personal data, and we do not share it for cross-context behavioral advertising. If that changes, we will update this notice first, provide a "Your Privacy Choices" opt-out link on our Sites, and honor the Global Privacy Control signal.

5. International transfers

Hexes Security, Inc. is based in the United States, and our Sites and hosted services are currently hosted in the United States. Our service providers may process personal data in the United States and other countries (for example, in the global network of our content delivery and network security provider) whose data protection laws may differ from yours. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses (with the UK Addendum or Swiss adjustments as applicable), and supplementary measures where needed. You can ask us for a copy of these safeguards.

6. How long we keep personal data

We keep personal data only as long as needed for the purposes in this notice, unless the law requires or permits longer retention. Typical periods:

7. How we protect personal data

We use administrative, technical and physical safeguards designed to protect personal data, including encryption in transit, access limited to those who need it, and logging. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your interaction with us is no longer secure, contact [email protected].

8. Your rights and choices

Everyone. You can unsubscribe from marketing emails using the link in each email or by contacting us, and manage cookies through your browser (see our Cookie Notice).

EEA, UK and Switzerland. Subject to conditions and exceptions in the law, you have the right to access, correct, delete or restrict the processing of your personal data, to object to processing based on legitimate interests (including direct marketing, where the objection is absolute), to data portability, and to withdraw consent at any time without affecting earlier processing. You may also lodge a complaint with your local data protection authority.

California and other US states. Residents of California and other US states with comprehensive privacy laws may have the right to: know what personal data we collect, use, disclose, sell or share, and receive a copy; correct inaccurate personal data; delete personal data; opt out of the sale or sharing of personal data and of targeted advertising; limit the use of sensitive personal information (we do not use sensitive personal information for purposes that require this right); and not be discriminated against for exercising these rights. If we decline your request, you can appeal by emailing [email protected] with "Privacy appeal" in the subject line within 60 days of our decision. We will respond within the time required by law (generally 45 to 60 days). If you are not satisfied with the outcome, you may contact your state Attorney General.

Notice at collection for California residents. In the last 12 months we have collected the following categories of personal information, from the sources and for the purposes described above, and disclosed them for business purposes to the recipients described in Section 4: identifiers (such as name, email, IP address); commercial information (purchases); internet or other electronic network activity (site and product usage); professional or employment-related information (job title, company, applications); geolocation data (approximate, country only); and inferences drawn from the above for B2B marketing. Whether any category is sold or shared is stated in Section 4. Our retention periods are in Section 6. We do not knowingly sell or share the personal information of consumers under 16.

How to exercise your rights. Email [email protected] with "Privacy request" in the subject line. We will verify your request using information we already hold, and respond within the time required by law. You may use an authorized agent, who must provide proof of authority. If your request concerns data we process for a customer, we will refer you to that customer.

9. Children

Our Sites and Offerings are not directed to children, and we do not knowingly collect personal data from anyone under 18 (and, under US state laws, we do not knowingly sell or share the personal data of anyone under 16). If you believe a child has given us personal data, contact us and we will delete it.

10. Third-party sites and services

Our Sites may link to, or embed content from, third-party sites and services (for example, video players or social networks), and our Offerings may connect to services that our customers configure, such as their own logging or ticketing systems. Their privacy practices are governed by their own policies. Nothing is loaded from a video provider until you press play on a video on our Sites; the video is then served in the provider's reduced-cookie mode, and the provider may process your IP address and set cookies as its own policy describes.

11. Changes to this notice

We may update this notice from time to time. The version number and effective date at the top show when it was last changed. If we make material changes, we will notify you through the Sites, the Offerings or by email before they take effect, where required by law.

12. Contact us

Questions, requests or complaints: [email protected] · Hexes Security, Inc., Attn: Legal (Privacy), 2261 Market Street STE 68751, San Francisco, CA 94114, USA.

EU and UK representatives: Hexes Security, Inc. has not appointed a representative in the European Union or the United Kingdom. Individuals there can contact us directly at [email protected].

All legal documents