Privacy Policy

What personal data GuardX collects, why, who sees it, and what rights you have under the GDPR.

1. Controller

The controller for the data described in sections 2 and 3 is the publisher identified in the Legal Notice. Contact for any privacy question: contact@guardx.fr.

2. Data about our customers

Data	Why	Legal basis
Email, username, password (stored only as a salted hash), two-factor secret	Create and secure your account	Contract
Domains, origin addresses, protection and firewall settings, change history	Provide the service	Contract
Plan, Stripe customer and subscription identifiers, payment status	Billing. Card details are entered on Stripe and never reach our servers.	Contract, legal obligation (accounting)
Sign-in records: IP address, browser user agent, time	Session security, fraud and abuse prevention	Legitimate interest
Messages you send to support@guardx.fr or contact@guardx.fr	Answer you	Contract, legitimate interest

3. Visitors to this website

The marketing website does not use analytics, advertising or tracking cookies. Our web servers keep standard access logs (IP address, requested page, time, browser user agent) for security and troubleshooting. Your theme and language choice are stored in your own browser, see the Cookie Policy.

4. Data about our customers’ visitors (processor role)

When a site is protected by GuardX, requests from its visitors pass through our proxy. To filter attacks we process the IP address, requested URL, headers, user agent, TLS and browser fingerprints, behavioural signals such as request timing, and the result of challenges. Security events are stored so that the customer can see what was blocked and why. In this case the customer is the controller and GuardX is the processor, under the Data Processing Agreement. Customers must inform their own visitors, for example in their privacy policy.

We use this data only to provide the protection service. We do not sell it and we do not use it for advertising. The country of an IP address is derived locally from a GeoIP database.

5. Retention

Account data: for as long as the account exists. When you delete your account, personal data is erased or anonymised, except what we must keep by law.
Invoicing and payment records: as long as French accounting law requires (currently ten years).
Sign-in sessions: they expire automatically after a period of inactivity or at most 30 days.
Security event logs about visitors: kept for a limited period and then deleted automatically.

6. Who receives data

Only the service providers listed on the Subprocessors page, and authorities when the law requires it. We do not sell personal data.

7. Transfers outside the EU

Where a provider processes data outside the European Economic Area, we rely on an adequacy decision or on the standard contractual clauses approved by the European Commission. The Subprocessors page states where each provider operates.

8. Your rights

You may ask for access, correction, erasure, restriction, portability, or object to processing based on legitimate interest, by writing to contact@guardx.fr. We answer within one month. If you think we did not handle your request properly you can complain to the CNIL (cnil.fr). If you are a visitor to one of our customers’ sites, please first contact that site, which is the controller of your data; we will assist them.

9. Security

Traffic is encrypted in transit, passwords are hashed, administrative access requires two-factor authentication, and private keys of certificates are only released to their owner. No system is perfectly secure; we will notify the people concerned and the CNIL of a personal data breach where the law requires it.

10. Changes

We will update this policy when our practices change and show the date of the latest version below.