Privacy Protocol

Information We Collect

We collect information that you provide directly to us and information generated automatically through your use of our services.

Account Information

When you create a Hypen workspace, we collect your email address, organization name, and billing information. We do not store raw payment card numbers — payment processing is handled by a PCI-DSS certified processor.

Usage and Telemetry Data

We log metadata about proxied requests including: timestamp, HTTP method, destination host, response status, VaR score, and agent identity. We do not log request or response body contents by default. Payload capture is opt-in and is subject to configurable redaction rules.

Technical Data

We automatically collect IP addresses, browser type, and session identifiers for Dashboard access. This data is used solely for security and abuse prevention purposes.

How We Use Your Information

• To operate, maintain, and improve the Hypen proxy and control plane services
• To compute real-time VaR scores and enforce configured thresholds
• To generate audit logs and compliance exports on your behalf
• To send transactional communications (billing, security alerts, system status)
• To detect, investigate, and prevent fraudulent or unauthorized activity
• To comply with applicable legal obligations

We do not sell your data. We do not use your agent traffic data to train machine learning models without your explicit opt-in consent.

Retention & Deletion

Audit logs are retained for a minimum of 7 years to satisfy financial compliance requirements. You may request deletion of non-audit personal data at any time by contacting hello@hypen.network.

Upon workspace termination, we will delete or anonymize all personal data within 90 days, subject to legal hold obligations.

Your Rights (GDPR / CCPA)

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Request deletion of your personal data
• Object to or restrict certain processing activities
• Data portability — receive your data in a machine-readable format
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at hello@hypen.network. We will respond within 30 days.

Cookies & Local Storage

We use essential cookies and local storage items strictly necessary for session management, dashboard authentication, and security threat mitigation. These are functional in nature and cannot be disabled without impairing platform operation.

We do not employ third-party advertising trackers, cross-site behavioral profiling tools, or any persistent identifiers used for marketing attribution. No cookie data is shared with advertising networks.

• Session authentication tokens — required for Dashboard access
• CSRF protection tokens — required for form security
• User interface preferences (e.g., timezone, display density) — functional only

Subprocessors & Global Data Transfers

We rely on trusted third-party service providers (“subprocessors”) for infrastructure hosting, database management, transactional email delivery, and payment processing. All subprocessors are contractually required to implement security measures consistent with applicable data protection laws.

• All subprocessors are vetted for compliance with SOC 2 Type II and, where applicable, ISO 27001
• Subprocessors process data strictly under executed Data Processing Agreements (DPAs)
• Data may be hosted and processed in the United States and other global regions
• Cross-border data transfers are protected via Standard Contractual Clauses (SCCs) approved by the European Commission

A current list of subprocessors is available to enterprise customers upon written request to hello@hypen.network.

B2B Enterprise Eligibility

Our services are strictly business-to-business (B2B) enterprise infrastructure solutions. Hypen is not a consumer product and our platform is not directed to, or intended for use by, private individuals for personal purposes.

By accessing or using the Hypen platform, you represent and warrant that:

• You are accessing the Services on behalf of a legal business entity, not as a private individual
• You are at least 18 years of age
• Your organization has the legal authority to enter into binding contractual obligations

Privacy Contact & Legal Entity

For privacy-related inquiries, data subject access requests, or subprocessor disclosure requests, contact our Privacy team:

• Email: hello@hypen.network
• Legal entity & Registered Address: HYPEN.NETWORK
  Pune, Maharashtra, India

Enterprise clients may request our standard Data Processing Agreement (DPA) at any time by emailing hello@hypen.network with the subject line DPA Request. We will respond within 5 business days.

We will respond to all privacy rights requests within 30 days of receipt.