Privacy Policy
Last updated 25 Oct 2026
This policy explains how HYNX LTD, a company registered in England and Wales (company number 10514108) with its registered office at 128 City Road, London, United Kingdom, EC1V 2NX ("webknx", "we", "us") handles personal data. It covers visits to https://webknx.com, use of the customer dashboard and calls to our APIs. It follows the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025.
Who we are and how to contact us
For the data described in this policy, HYNX LTD is the controller. We are not required to appoint a Data Protection Officer and have not done so. For any privacy question, request or complaint, email [email protected].
Personal data in your API requests is different. For example, a customer may encode a person's name or email address in a QR code. Our business customer is the controller of that data, and we process it on their behalf as a processor under our Terms of Service. If your data was sent to us by one of our customers, contact that customer first. We will help them respond.
What we collect and where it comes from
| Data | Examples | Source |
|---|---|---|
| Account | Name, email address, password (stored only as a hash), email verification status, and when you accepted our Terms of Service and which version | You, when you register |
| Workspace and team | Workspace name, membership and roles. Invitations: the invitee's email address and the name of the person who invited them | You, or a teammate who invites you |
| API keys | Key name, public app key, role, referrer restrictions, expiry, last-used time. Secrets are stored only as non-reversible verifiers | You |
| Usage | Request ID, API and operation, API key and workspace, HTTP status, latency, credits charged, timestamp | Generated when you call the APIs |
| Billing | Plan, subscription status, credit purchases, credit ledger, invoices (amounts, tax, payment status), and Stripe's customer and transaction IDs | You, and our payment provider Stripe |
| Security and audit | Audit log of privileged actions (acting user, IP address, request ID), session data, failed login attempts | Generated when you use the dashboard |
| Marketplace traffic | Request IDs and the metadata RapidAPI or ClankerBay documents. We do not receive your marketplace account details | RapidAPI or ClankerBay |
| Correspondence | Whatever you send us when you contact us | You |
We never receive or store card details. Stripe collects payment card and billing details directly.
We do not keep the content of API requests. For example, the text or URL you encode in a QR code is processed in memory to produce the response. It is not written to our database or logs. Our usage records contain only the metadata above.
We do not collect special category data, and we do not knowingly collect data about children.
Do you have to give us this data? You must provide your name, email address and password to create an account. Payment details must go to Stripe to buy a plan or credits. Without them we cannot provide the Service. Everything else is optional or generated as you use the Service.
Why we use it and our lawful basis
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Creating and running your account and workspaces. Authenticating API requests, enforcing permissions and rate limits | Contract: necessary to provide the Service you signed up for. For team members whose employer holds the contract, our legitimate interest in providing the workspace their organisation uses |
| Metering usage, charging credits, processing payments and issuing invoices | Contract |
| Keeping invoices, payment records and the credit ledger | Legal obligation (UK tax and company law) |
| Recording which version of our Terms you accepted and when | Legitimate interests: being able to show the agreement we have with you |
| Security, fraud and abuse prevention, audit logging, incident response | Legitimate interests: protecting the Service, our customers and their credits from misuse |
| Service emails: verification, password resets, invitations, billing and security notices, changes to our terms | Contract, or legitimate interests for invitees |
| Improving the Service using aggregated usage | Legitimate interests: understanding which APIs and features are used |
| Responding to complaints, legal claims and regulators | Legal obligation, or legitimate interests in defending our rights |
We do not sell personal data or use it for advertising. We do not use it, or the content of API requests, to train models.
Some decisions are automated: rejecting a request because its key is revoked, its rate limit is exceeded or its credits have run out. These enforce the rules of the Service you have chosen and have no legal or similarly significant effect on you. We do not profile individuals.
Emails we send
We send service messages that you need in order to use the Service: account verification, password resets, workspace invitations, receipts, payment failures, security notices, and changes to our terms or sub-processors. You cannot opt out of these while you have an account.
We do not currently send marketing emails. If we start, we will follow PECR.
- Company addresses. Every message will identify us and include a working unsubscribe link, and we will honour opt-outs.
- Individual subscribers (sole traders and some partnerships). We will email only with your consent, or about our own similar services if you were given a chance to opt out when you signed up.
You can object to direct marketing at any time, free of charge.
Cookies and similar technologies
We use only technologies that the law allows without consent. We set no analytics, advertising or tracking cookies.
| Name | Type | Purpose | Duration |
|---|---|---|---|
Session cookie (*_session) |
Strictly necessary | Keeps you logged in and holds your session securely | Expires after 2 hours of inactivity |
XSRF-TOKEN |
Strictly necessary | Protects forms against cross-site request forgery | Same as the session |
remember_web_* |
Strictly necessary, persistent | Set only if you tick "Remember me" when logging in, to keep you logged in on that device | Until you log out, up to about 400 days (the browser maximum) |
flux.appearance (browser local storage) |
Appearance | Remembers your light/dark/system theme choice | Until you change it or clear site data |
All cookies are Secure, HttpOnly where possible, and sent only over HTTPS.
Theme setting. If you don't choose a theme, we follow your device's setting. To object to us storing a theme choice, choose System under Settings → Appearance, which deletes the stored value, or clear this site's data in your browser.
Fonts and assets. All fonts, scripts and stylesheets are served from our own servers. Your browser makes no requests to third-party font or script providers.
Who we share it with
We share personal data only with the providers below, which process it for us under contract, or where the law requires it.
| Recipient | What for | Location |
|---|---|---|
| OVHcloud (OVH Hosting Inc.) | Hosting: servers, databases, storage and backups where the Service runs | Canada |
| Hetzner Online GmbH | Email delivery for account and service emails | European Union (Germany) |
| Stripe | Payment processing, subscriptions, invoices and refunds | United Kingdom, with transfers to the United States |
We also share data in these cases:
- RapidAPI and ClankerBay. For traffic you send through them, we exchange request and usage metadata needed for attribution and reconciliation. They act as independent controllers under their own privacy policies.
- Professional advisers, the police, regulators and courts. Where needed to comply with the law, enforce our terms or protect rights and safety.
- A buyer or successor of our business, under this policy.
Other members of your workspace can see workspace data according to their role, such as team members, API keys, usage, the audit log and invoices.
International transfers
- Canada (OVHcloud). The Service is hosted in Canada. The UK has adequacy regulations for Canada covering organisations subject to its federal private-sector privacy law (PIPEDA), so these transfers need no further safeguards.
- European Economic Area (Hetzner). Our email provider processes data in Germany. UK adequacy regulations cover the EEA.
- United States (Stripe). Stripe may transfer payment data to the United States. Those transfers rely on the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge") where Stripe is certified. Otherwise they rely on the ICO's International Data Transfer Addendum to the EU Standard Contractual Clauses.
You can ask us for a copy of the relevant safeguards at [email protected].
How long we keep it
| Data | Retention |
|---|---|
| Account data | While your account exists. When you delete your account, we delete your profile, except the records below that we must keep |
| Workspace, team and API key data | While the workspace exists |
| Pending invitations | Until accepted or expired (72 hours), then deleted |
| Sessions | Until you log out or the session expires |
| Usage records | While the workspace exists, and for up to 6 years where needed to support invoices or resolve billing disputes |
| Invoices, payments and credit ledger | 6 years from the end of the financial year they relate to, as UK tax law requires, even after the workspace is closed. Ledger entries are never edited |
| Audit logs | While the workspace exists, and as long as needed for a security investigation |
| Correspondence and complaints | Up to 2 years after the matter is closed |
| Backups | Rolling, deleted after 14 days |
Security
- All traffic is encrypted with TLS, and HSTS is enabled.
- API secrets and invitation tokens are stored only as non-reversible verifiers and are never logged.
- The database and cache run on a private network that is not reachable from the internet.
- Superadmin access requires multi-factor authentication, and privileged actions are audit logged.
- Payment webhooks are signature-verified.
- Backups are kept for 14 days and restore-tested every month.
No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will report it to the ICO within 72 hours of becoming aware of it. If the risk is high, we will also tell you without undue delay.
Your rights
Under the UK GDPR you have the right to:
- access a copy of your personal data;
- rectification of inaccurate or incomplete data;
- erasure of your data, where there is no reason for us to keep it;
- restriction of how we use your data, in certain circumstances;
- data portability: receiving the data you gave us in a machine-readable format, where we process it under contract or consent.
Your right to object. You can object at any time to processing that relies on our legitimate interests, explaining why. We will stop unless we have compelling legitimate grounds that override your interests, or we need the data for legal claims. You have an absolute right to object to direct marketing.
You can do a lot of this yourself in the dashboard: update your profile, revoke API keys, remove team members and delete your account. For anything else, email [email protected]. We may need to confirm your identity. We will respond within one month, or within three months for complex requests, in which case we will tell you why. We search for your data in a reasonable and proportionate way. There is normally no charge.
Some data, such as invoices, we must keep even if you ask us to delete it. If so, we will tell you.
Complaints
If you are unhappy with how we have handled your personal data, email [email protected] with the subject "Data protection complaint". We will acknowledge your complaint within 30 days and respond without undue delay, telling you what we have done and the outcome.
You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority:
- online at ico.org.uk/make-a-complaint;
- by phone on 0303 123 1113;
- by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
If you live or work in the European Economic Area, you may also complain to your local data protection authority.
Children
The Service is for businesses and is not intended for, or likely to be used by, anyone under 18. We do not knowingly collect children's data. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We will post any update here with a new "last updated" date. We will email account holders about material changes, including new sub-processors, before they take effect.