Privacy notice

Who we are

EHX Labs operates the EHX product at ehxlabs.xyz(Ecosystem Health & Security IndeX). For privacy requests contact [email protected] or use Feedback.

What we process

• Account data — email, display name, password hash (if you sign up with email), Auth0 identity when you use social login, linked browser principals, subscription and billing metadata.
• Product usage — chat messages, generated exports, templates/modules you request, quota meters, and support tickets you submit.
• Checkout — plan selection, chain/asset, quoted amounts, deposit addresses, transaction hashes you report, and session status. We do not store private keys.
• Technical data — IP address and user-agent on sign-in and sensitive actions (retention limits apply — see operator runbook), API logs, and first-party analytics events when you consent to analytics cookies.

Why we process it

• Contract — provide accounts, checkout, entitlements, chat, generate, and support.
• Legitimate interests — secure the service (abuse prevention, Cloudflare Turnstile on chat/generate), debug incidents, improve product quality.
• Consent — first-party visit/funnel analytics (POST /api/v1/events). You can refuse analytics in the cookie banner; essential cookies still run so the site works.
• Legal obligation — records we must keep for tax, fraud, or compliance where applicable.

Cookies & local storage

See our Cookie policy for a table of cookies and storage keys. Essential items include session tokens (ehx_session), browser principal (ehx_principal), and theme preference (ehx-theme).

Third parties

• Auth0 — optional social / enterprise login (Auth0 privacy).
• Resend — transactional email (verification, recovery, receipts).
• Cloudflare Turnstile — bot protection on chat and generate when enabled.
• Public blockchains & RPC providers — when you pay via crypto checkout we verify on-chain transfers using public network data.

We do not sell personal data. We do not use third-party advertising trackers.

Retention

We keep account and product data while your account is active and as needed for billing and support. IP addresses linked to principals are subject to retention sweeps (see operator GDPR runbook). Analytics events are kept for aggregate reporting; properties exclude free-text PII.

Your rights (EEA / UK GDPR)

Depending on your location you may have the right to:

• Access — download a JSON export at Account → GDPR export (GET /api/v1/account/gdpr-export.json) when signed in.
• Rectify inaccurate account data in account settings.
• Erase — contact us; some records may be retained where required by law.
• Restrict or object — e.g. refuse analytics cookies via the banner.
• Portability — via the GDPR export.
• Complain to your local supervisory authority.

International transfers

Sub-processors may process data in the United States or other countries. We use providers with appropriate safeguards where required.

Children

EHX is not directed at children under 16. We do not knowingly collect their data.

Changes

We update this notice when practices change. Material changes will be reflected in the “Last updated” date above.