Legal
Privacy Policy
Last updated: April 2, 2026
Plain English · EU/EEA & UK · US · Israel
Ten layers of protection (defense-in-depth)
We stack many controls so one weak spot does not sink the whole ship. No cloud can promise perfect safety—attackers evolve—but this depth is how we aim for the strongest practical protection we can fairly run.
Layer 1 — Encrypted connections
Traffic between you and us is encrypted in transit (TLS).
We use TLS 1.2+ for connections to our apps and APIs. That makes casual snooping on the wire much harder. It does not replace the need for strong passwords on your side.
Layer 2 — Safe password storage
We never store passwords as plain text—only strong one-way hashes.
Passwords are processed with bcrypt (salted hashes, multiple rounds). We cannot “read” your password back from storage; we can only verify a login attempt against the hash.
Layer 3 — Customer isolation
Your workloads are separated from other customers on our platform.
We use dedicated Kubernetes namespaces and related controls so customer environments are isolated. This limits blast radius if something goes wrong in one tenant’s stack.
Layer 4 — Minimal tracking
We do not run ad trackers or cross-site analytics on the product.
No Google Analytics, Meta Pixel, or similar marketing trackers on the Service as described in our cookie list. Fewer third parties means fewer places data can leak for ads profiling.
Layer 5 — Named vendors
We publish who helps us run the Service (subprocessors).
Examples include edge/security and code-hosting partners. We list them so you know who may touch network or account-related data, and we use contracts (and where required, transfer tools) with those vendors.
Layer 6 — Tight internal access
Our team gets the least access needed to run the platform—not more.
Operational access follows least-privilege and need-to-know. Not every employee can reach production data; access is limited to what the job requires.
Layer 7 — Backups
Databases are backed up on a schedule with a fixed retention window.
Automated backups help recovery from mistakes or outages. Retention is limited in time so we are not hoarding old copies without reason.
Layer 8 — Your legal rights
Where the law applies, you can ask to see, fix, or delete your data.
EEA/UK users get GDPR-style rights; many US states grant access/delete/correct rights; Israel has its own rules. We respond through [email protected] within legal timelines when a request is valid.
Layer 9 — Cross-border rules
When data moves countries, we use approved transfer tools when required.
For transfers from the EEA/UK to places without an adequacy decision, we rely on mechanisms such as Standard Contractual Clauses (and UK addenda where relevant), plus supplementary measures when appropriate.
Layer 10 — A real contact
You can email us about privacy and security questions.
Reach [email protected] for rights requests and privacy questions. We are honest that no stack of layers removes all risk—but depth is how we push risk down in practice.
Arxentra ("we", "us") runs arxentra.com (the Site and Service). This Policy tells you what personal data we collect, why we use it, and how we try to keep it safe.
Regions we write this for: the EEA, UK, United States (including California CCPA/CPRA and other state laws where they apply), and Israel—when those laws apply to us.
If you use the Service, you agree to this Policy. If you do not agree, stop using the Service.
a. Information you provide directly
- Full name and email address
- Password (stored only as a bcrypt hash — never in plain text)
- Billing details (processed via a secure payment provider)
- Source code you upload for deployment (encrypted and isolated)
b. Technical information (automatic)
- IP address
- Browser type and operating system
- Pages visited and access timestamps
- HTTP headers
c. Usage information
- Services created and their configurations
- Platform technical logs
- Performance and resource metrics
Laws in the EU, US, and Israel ask us to name outside companies that help run the Service or see data when things work normally. The table below is that list.
| Service | Purpose | Data | Processing location | Privacy policy |
|---|---|---|---|---|
| Cloudflare Inc. | CDN, DDoS protection, DNS, security proxy | IP address, HTTP headers, network traffic | Global (EU/EEA, US, and other regions) | Link |
| GitHub (Microsoft) | Source code storage, OAuth authentication | OAuth token, GitHub username, repository access | United States | Link |
| Prometheus / Grafana (self-hosted) | Performance and resource monitoring | Technical metrics (no direct personal identifiers in typical dashboards) | Our infrastructure | — |
| CloudNativePG (CNPG) | PostgreSQL database management | Application data you store | Our servers (Kubernetes cluster) | — |
| NGINX Ingress Controller | Traffic routing, TLS termination | IP address, HTTP headers | Our infrastructure | — |
We do not use Google Analytics, Meta Pixel, Hotjar, or similar marketing analytics on the platform for cross-site tracking.
We use only strictly necessary cookies:
| Cookie | Purpose | Expiry | Third-party |
|---|---|---|---|
| session / JWT | Session and authentication | 24 hours | No |
| __cf_bm | Cloudflare bot management | 30 minutes | Cloudflare |
Where EEA/UK law requires consent for non-essential cookies, we only use essential cookies as listed above unless we notify you otherwise.
This section matches the ten layers at the top—here in checklist form. We still cannot promise zero hacks; we can show you what we actually do.
- •Passwords: bcrypt hashing (12 rounds), never stored as readable text
- •On the wire: TLS 1.2+ for app and API traffic
- •Per customer: separate Kubernetes namespaces to limit cross-customer risk
- •Backups: automatic database backups, 7-day window
- •Staff access: least privilege—only what the job needs
Your exact rights depend on where you live. Below is a simple map—not legal advice.
EEA, UK, and Switzerland
Under GDPR / UK GDPR you may have rights to access, fix, or delete data; to limit or object to some processing; to move your data; and to complain to a data protection authority.
Access
Obtain confirmation and a copy of your personal data where required
Rectification
Correct inaccurate data
Erasure
Request deletion subject to legal retention needs
Object / restrict
Object or limit processing in defined cases
Portability
Receive data in a structured, machine-readable format
Complaint
Contact your supervisory authority
United States
California residents may have rights to know, delete, correct, and limit some uses of sensitive data, and not to be punished for asking. We do not sell or share personal information for cross-context behavioral ads as California defines those terms for this Service. Other US states may grant similar rights when their laws cover us.
Israel
Israeli privacy law may give you access, correction, and deletion rights where it applies.
How to ask: [email protected]. We answer within the time the law gives us (often about 30–45 days). We may confirm who you are before we act.
| Data type | Retention |
|---|---|
| Account details | While active + 90 days after deletion request |
| Technical logs | 30 days |
| Backups | 7 days |
| Billing and tax records | As required by applicable law (often up to 7 years where tax/accounting rules apply) |
| Deployed source code | Removed when you delete the associated service |
Data may sit in or pass through Israel, the EU/UK, the US, and other places where we or our vendors run systems. When EU/UK law requires extra steps to send data to countries without an "adequacy" decision, we use tools such as Standard Contractual Clauses (SCCs) and UK addenda, plus extra measures when needed.
US providers are under US law. We sign contracts that fit our role (controller or processor) and the transfer rules that apply.
We may change this Policy. Big changes get posted here (and email when the law expects it), often with about 30 days' heads-up. If you keep using the Service after the new date, that may count as accepting the update where the law allows.
Arxentra
Email: [email protected]
Website: arxentra.com
EEA/UK: you can also talk to your local privacy regulator. US: your state Attorney General or the FTC may help with some issues. This text is not legal advice.