This policy explains how ShichifukuTekx FZE, of Office C1-1F-SF10837, Ajman Free Zone C1 Building, Ajman, United Arab Emirates ("we"), handles personal data on our website and in the hosted version of Hivelock (the "Service"). If you run Hivelock on your own server, we do not receive your data, and your company's own policy applies.
1. Our two roles
- We decide how the data is used for website visitors, account holders, billing and security records. Here we are the controller under the GDPR and similar laws.
- Our customers decide for what they put into a workspace: messages, files, run data, and data from connected services. Here the customer is the controller or data fiduciary, and we are its processor under our Data Processing Agreement. If your employer or a business put your data into Hivelock, please contact them first.
2. What we collect
| Source | Data |
|---|---|
| Website | The site sets no cookies and has no analytics. Pages ask GitHub for the public star count, so GitHub receives your address when they load. Our web host may keep standard logs, such as address and pages requested: kept for up to 30 days. If you email us, we keep your message and address. |
| Account | Name, email address, password in hashed form, two-step verification data, and workspace memberships and roles. |
| Sign-in and security | Session records with address and browser details, and audit log records of actions with ids, time and client address. |
| Billing | Our payment provider handles cards, and we never see card details. It also collects your billing address and any tax ID at checkout, to work out tax and issue invoices, and it holds them. We keep the plan, status, dates, payment provider ids, and a record of the billing emails we send. Your email address is passed to the provider at checkout. |
| Single sign-on | If your company uses it: your name and confirmed address from its identity provider. |
| Usage | Counts of people, agents, runs, tokens and storage, and measurements such as time and status for each model and tool call. These hold no prompts or results. |
| Support | What you send us: None chosen. |
3. Why we use it
| Purpose | GDPR basis |
|---|---|
| Provide the Service and accounts | Contract |
| Take payment and keep records | Contract, legal obligation |
| Keep the Service secure, limit abuse, keep an audit record | Legitimate interests |
| Send service messages, such as confirmations and resets | Contract |
| Answer questions and early access requests | Legitimate interests |
In the United Arab Emirates, we follow the applicable data protection law.
We do not sell personal data. We do not use it for advertising. We do not train AI models on it.
4. AI and outside services
Customers choose their own AI model providers and connected services, under their own accounts. When an agent runs, what it reads is sent to the provider the customer chose. That may include personal data. Those providers act under the customer's agreement with them, not ours.
5. Who receives data
We use service providers to run the Service. See Subprocessors. We may also share data if the law requires it, to protect people or the Service, or as part of a sale or merger of our business, with notice.
6. International transfers
Our hosting region is the United Arab Emirates. If data moves out of the EEA, UK or United Arab Emirates, we will use the safeguards the law requires, such as standard contractual clauses.
7. How long we keep it
| Data | Period |
|---|---|
| Account data | While the account exists. Deleting an account is not self-service yet, so contact us. |
| Workspace data | Until a customer deletes it. After a workspace is deleted, we keep it for 30 days, then erase it. |
| Finished runs | A customer setting, 90 days by default. |
| Chat conversations | Until the workspace is erased. There is no automatic limit. |
| Audit records | Kept after a workspace is erased, because they cannot be changed. They hold ids, actions and client addresses, not content. |
| Backups | up to 30 days |
| Billing records | As tax and accounting law requires: at least 5 years, or longer where the law requires. |
8. Cookies
The Service uses only the cookies it needs: a session cookie to keep you signed in, and a short-lived cookie that protects single sign-on. We do not use advertising cookies. The public website sets none.
9. Security
We encrypt credentials, run data and chats, keep workspaces apart in the database, and require two-step sign-in. Our security overview explains this in detail, including what is not covered. No system is fully secure, and there has been no independent security review or penetration test yet.
10. Your rights
Depending on where you live, you may have the right to:
- access your data, and get a copy,
- correct it, or have it erased,
- limit or object to some uses, and move your data to another service (GDPR),
- withdraw consent, where we rely on it, and
- complain to a regulator: your local data protection authority.
How to use them. Signed-in users can export their own data under Settings, Your data. For anything else, email sales@shichifukutekx.ae. We reply within 30 days. For complaints, contact ShichifukuTekx FZE at sales@shichifukutekx.ae.
11. Children
The Service is for business use, and not for anyone under 18. We do not knowingly collect children's data.
12. Changes
We will post changes here, and tell account holders about important ones.
13. Contact
ShichifukuTekx FZE, Office C1-1F-SF10837, Ajman Free Zone C1 Building, Ajman, United Arab Emirates. Email: sales@shichifukutekx.ae.