Privacy and cookies

Datarex s. r. o. processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll. on personal data protection. This document describes which data the rexguard service processes, why, and for how long.

1. Controller

Datarex s. r. o., Trieda SNP 1534/22, 974 01 Banská Bystrica, Slovakia, Company ID 53058968, registered in the Commercial Register of the District Court Banská Bystrica, section Sro, file 38756/S.

Contact for data protection matters: info@rexguard.app.

2. When we are the controller and when the processor

• We process customers' data (account, billing, support) and the data of visitors of rexguard.app and the portal as the controller.
• We process the data of visitors of our customers' sites passing through the rexguard service as a processor on the customer's behalf, under the Data Processing Agreement; the customer is the controller.
• We also use some of that data to protect all the sites we protect (article 4); for that processing, we set the purpose. [to confirm: Datarex's role in this processing]

3. What data we process

Account: name, email address, country, language, a hash of the password (we don't keep the password itself), the Google account's identifier when signing in with Google, the public parts of passkeys. Verification codes are kept only as a hash and are valid for 15 minutes.

Sign-ins: for active sign-ins, the IP address and browser.

Consents: which document and version the customer accepted, when, and from which IP address.

Billing: billing contacts (name or company name, address, company ID, tax ID, VAT ID and the result of its check in the VIES system), orders and invoices. Customers enter card details directly with Stripe; we keep only the card's brand, last four digits and expiry.

Support: requests (tickets), messages and attachments.

Reports of illegal content: the reporter's name and email address (which may be left out for child sexual abuse material), the addresses and the description.

Enterprise enquiries: name, company, email address, phone, number of sites and the message; we send them by email and don't store them.

Traffic of sites protected by rexguard (including rexguard.app): for each request the time, the visitor's IP address and port, the country and network (ASN) derived from it, the parameters of the encrypted connection and their fingerprint (JA4), the domain name, the path and query, the browser (user agent), the referring page (referer), the sizes and status of the response, and the protection's decision. We don't keep request bodies, cookies or other headers. We don't protect the portal (console.rexguard.app) with rexguard; its web server records requests with IP addresses. [to confirm: how long the portal's web server and the application keep their records]

4. Purposes and legal bases

• Performance of the contract: creating and running the account, providing the service, support, payments.
• Legal obligation: accounting and taxes, handling reports of illegal content (Regulation (EU) 2022/2065, the Digital Services Act), complaints.
• Legitimate interest: the security of the service and networks, preventing misuse, alerts to administrators. To protect all sites we also use the traffic data of all sites: addresses attacking any site are blocked on all sites until 24 hours after their last attack; the bot model learns from pseudonymized data (article 5), and normal traffic is established to detect unusual traffic.

We don't use the data for marketing or for profiling with legal effects, and we don't sell it.

5. How long we keep data

• Account: while it exists. When the account is deleted, we erase personal data except orders and invoices (10 years under the accounting act), refund requests, consents given with an order, and support requests.
• Sign-ins: 2 hours after the last activity; with "remember me", up to 400 days.
• Traffic with IP addresses: 14 days (the nodes' and the console's records).
• Pseudonymized traffic data: 1 year. The IP address is replaced in it by a keyed hash whose key changes every month and is destroyed 3 days after the month ends; what remains is the network (/24 for IPv4, /48 for IPv6), country, ASN, the connection's fingerprint (JA4), the browser, the domain name, the path, the names of query parameters without their values, and the referring page's domain.
• Aggregate statistics without IP addresses: 1 year.
• Attackers' addresses shared between sites: 24 hours after their last attack.

6. Recipients

• Stripe – card payment processing.
• Google – only when the customer signs in with a Google account.
• Slack – internal alerts for the service's administrators; they may contain a customer's email address and, for an Enterprise enquiry, the enquirer's name, email address and part of the message.
• The European Commission (VIES) – checking VAT numbers.
• Let's Encrypt – issuing certificates; the domain names in certificates are written to public logs (Certificate Transparency), so protected sites' domain names are publicly known.
• Public authorities, where the law requires it.

Datarex operates the service's servers in Slovakia. With Stripe, Google and Slack, data may be transferred outside the European Economic Area. [to confirm: the legal basis of the transfer]

7. Cookies

We use no analytics or marketing cookies and no tracking scripts; visitor statistics come from the server's records.

rexguard.app: content pages set no cookies, except rexguard_pass after a browser check (rexguard.app is protected by rexguard). Pages with a form (contact, reporting illegal content) set strictly necessary cookies to protect the form: rexguard-session and XSRF-TOKEN (2 hours).

The portal (console.rexguard.app): strictly necessary cookies rexguard-session (sign-in, 2 hours), XSRF-TOKEN (form protection, 2 hours), remember_web_… (only with "remember me", 400 days) and rexguard_locale (the chosen language, 400 days).

Customers' sites: after a successful browser check (challenge) we set the cookie rexguard_pass (24 hours) so the check isn't repeated; it falls under the Data Processing Agreement.

8. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability (you download a copy of your account's data in the portal) and to object to processing based on legitimate interest. If you are a visitor of our customer's site, contact its operator; we help them.

You can file a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk.

9. Automated decisions

The protection decides on each request automatically (lets it through, stops it, or asks the browser for a check). This is not a decision with legal effects; the customer decides on exceptions in their portal. People decide on blocking sites and accounts.

10. Security

We encrypt communication (TLS), keep certificate keys encrypted, limit access to data to the service's administrators, and delete traffic data automatically when its retention ends.

11. Changes

We may update this document; we'll tell you about significant changes at least 30 days in advance by email or a notice on rexguard.app.