Skip to content

Privacy Policy

Last updated: July 6, 2026

This website is operated by REDHEXX (company in formation) (“REDHEXX”, “we”, “us”), the data controller for the information described below. We are a security company, so data minimization isn’t just a policy — it’s the posture. We run a deliberately small, pre-launch marketing site and collect as little as possible. This policy explains exactly what we collect, why, where it lives, and the rights you have over it.

The short version

  • The only personal data we ask for is an email address, and only if you join the waitlist.
  • Analytics are cookieless and aggregate. We set no advertising or cross-site tracking cookies.
  • We never sell, rent, or share your personal information for advertising.
  • This site collects no security-assessment data; that only ever happens under a separate signed engagement.
  • Email hirat.rahi@redhexx.com any time to see or delete what we hold about you.

What we collect, and why

  • Waitlist email. If you submit the waitlist form, we store the email address you provide together with a timestamp and which form on the site it came from. We use it solely to contact you about REDHEXX early access and closely related updates.
  • Anti-spam verification. The waitlist form uses Cloudflare Turnstile to tell humans from bots. Turnstile issues a one-time token that our server verifies with Cloudflare. We do not receive a tracking profile from it.
  • Abuse-prevention counters. To rate-limit the waitlist API, we keep a counter keyed to your IP address. It expires automatically within one hour and is not linked to your email.
  • Standard request metadata. Like any website, our host (Cloudflare) processes request data such as IP address and user-agent to serve pages, secure the network, and mitigate abuse.
  • Cookieless analytics. We use Cloudflare Web Analytics, which measures aggregate page views without cookies, fingerprinting, or cross-site tracking, and does not build a profile of you.
  • Security reports (if you send one). If you contact us about a vulnerability under our safe harbor, we process the details you choose to include (and your email) only to triage and fix the issue and to coordinate disclosure with you. We treat these reports as confidential.

What we don’t do

  • No advertising, ad networks, or ad cookies.
  • No sale, rental, or “sharing” (as U.S. state privacy laws define it) of personal information.
  • No cross-site tracking, fingerprinting, or behavioral profiles.
  • No third-party marketing tools reading your data.

Legal bases (GDPR)

Where the EU/UK GDPR applies, we process your waitlist email on the basis of your consent (you can withdraw it at any time by asking us to delete your email), and we process request metadata, abuse-prevention counters, and security reports on the basis of our legitimate interest in keeping the site secure and functional.

Where your data lives, and international transfers

The site is hosted on Cloudflare Pages, and waitlist emails are stored in Cloudflare KV. Cloudflare operates a global network, so data may be processed outside the country you live in; those transfers are covered by Cloudflare’s data processing terms, which incorporate the EU Standard Contractual Clauses.

Retention

  • Waitlist emails are kept until you ask us to delete yours, or until the waitlist is retired, whichever comes first.
  • Rate-limit counters expire automatically within one hour.
  • Security reports are retained only as long as needed to remediate and confirm the fix.
  • Analytics exist only as aggregate, non-personal statistics.

Security-assessment data (a note on the future product)

This marketing site does not collect scan results, credentials, findings, or any data about your systems. When REDHEXX later performs an actual security assessment, that engagement — including how sensitive findings are encrypted, who may access them on a need-to-know basis, and how long they are retained before secure destruction — will be governed by a separate written engagement agreement and data processing addendum, not by this website policy.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict our processing of it, and to withdraw consent. We honor these requests for everyone, not just where the law requires it: email hirat.rahi@redhexx.com and we will act on your request promptly. We will never discriminate against you for exercising a privacy right.

If you are in the EU/UK, you also have the right to lodge a complaint with your local supervisory authority. If you are a California resident: we do not sell or share personal information as the CCPA/CPRA defines those terms, and because we set no tracking cookies, there is nothing for an opt-out signal such as Global Privacy Control to disable, though we honor its intent.

Children

The site is not directed at children and we do not knowingly collect personal information from anyone under 16. If you believe a child has submitted an email to the waitlist, contact us and we will delete it.

Service providers

We rely on a single infrastructure provider, Cloudflare, Inc. (hosting via Pages, storage via KV, anti-spam via Turnstile, and cookieless Web Analytics). Its processing on our behalf is governed by Cloudflare’s privacy policy and data processing addendum. We will update this section if we add providers.

Changes to this policy

As REDHEXX evolves from a waitlist into a product, this policy will grow with it. We will update the “last updated” date above for every change, and material changes will be noted on this page.

Contact

Privacy questions or requests: hirat.rahi@redhexx.com.