// legal
Privacy Policy
Last updated: October 2026
HackEx is operated by MIST CREATIONS LIMITED. MIST CREATIONS LIMITED is the data controller for the personal data described in this policy.
What we collect
Account data: name, email, password hash, 2FA secrets. Target data: the domains, repositories and servers you connect. Scan & incident data: findings, evidence, audit logs, response actions. Connection credentials: SSH keys, tokens, login credentials, stored encrypted at rest and never rendered back to any page.
What the agent sends
The on-server agent reports metadata only: port lists, process names, package versions, usernames, file hashes, event summaries. It never uploads log files, file contents or shell history. Evidence bundles (pcap, forensics snapshots) stay on your server unless you explicitly export them.
AI processing
Finding details and conversation content are sent to OpenAI to generate explanations, answers and voice sessions. We send the minimum needed for the answer, never your credentials. Voice calls stream directly between your browser and OpenAI using short-lived session tokens.
What we never do
We don't sell your data. We don't scan infrastructure you haven't connected. We don't share target details, scan results or credentials with other customers or third parties beyond the processors above.
Retention & deletion
Anonymous scans expire automatically. Workspace data is retained while the account is active and deleted on request. Email [email protected] for export or deletion.
Security
Encrypted transport everywhere, least-privilege database roles, encrypted credential storage, hashed agent tokens, audit logging on every action. Found a hole in our own house? That's what Responsible Disclosure is for. Tell us first.