Privacy Policy

1. Introduction

XHack ("we," "us," or "our") operates the xhack.io website, the XHack AI agent application, the XHack AI web interface, and related cybersecurity services (collectively, the "Platform"). This Privacy Policy describes what information we collect, what we deliberately do not collect, how we use and protect it, and what rights you have.

We are a cybersecurity firm. Privacy and data protection are not just legal requirements for us; they are the basis of the trust our clients place in us. This policy reflects that, including where it means saying plainly that a control has limits.

The XHack AI command-line interface (CLI) has been discontinued. References in this policy to the "Agent" mean the XHack AI agent graphical application that runs on hardware you control.

2. Who Is Responsible for Your Data

For individual accounts, marketing, website visitors, verification, and billing, XHack is the data controller. The controller is XHACK (SMC-PRIVATE) LIMITED, a company registered with the Securities and Exchange Commission of Pakistan under CUIN 0361945, which you can check on the SECP public register.

Where an organization (a "Tenant") holds a company or enterprise subscription and administers seats for its team, the Tenant is the controller of its own team and engagement data, and XHack acts as a processor for that data under the Tenant's agreement. Verification records for each individual seat holder, and any Incident Records, are processed by XHack as controller, because they exist to enforce our own access rules and legal obligations. Tenant administrators can see the account status, seat assignment, verification state, and usage metering of the seats they administer.

3. Information We Collect

3.1 Account information

When you register for an account, we collect:

• Full name
• Email address
• Username and password (hashed cryptographically, never stored in plaintext)
• Organization name and role, where applicable
• Contact details you choose to provide, such as a phone number

3.2 Identity verification data, individuals

Before full access is granted to an individual account, we collect and review:

• A government-issued identification document (such as a passport, national ID card, or driving licence), including the identifiers printed on it, and its images
• Cybersecurity certifications and professional context, for example OSCP, OSCE, OSWE, CREST, or CEH certificates, employer or security-team affiliation, bug bounty platform profiles, or comparable evidence of a legitimate security function
• The outcome of our review, and the date it was performed

Identification documents may contain data that is treated as sensitive in some jurisdictions (for example nationality or place of birth). We collect them only to confirm that you are who you say you are, we do not use them for any other purpose, and we ask for your explicit consent where the law requires it.

3.3 Business verification data, companies and tenants

Before full access is granted to a company or tenant account, we collect and review:

• A government-issued identification document for the authorized representative who registers and administers the account
• Business documentation evidencing that the organization is legitimate, which may include certificate of incorporation or registration, trade licence, tax or VAT registration, proof of registered address, and evidence of the representative's authority to act for the organization
• The outcome of our review, and the date it was performed

3.4 Verification interview recordings

Verification may include a live video interview to confirm identity and intent. Where a call is recorded, we ask for your consent before the recording starts, and we record that you gave it. If you decline, we cannot complete that verification step and access cannot be granted. Recordings are used solely to evidence the verification decision and are subject to the retention periods in Section 8.

3.5 Operational and billing data

To run, secure, and bill for the Platform, we process:

• Usage metering, request counts, token consumption, and plan entitlement usage
• Session metadata, sign-in events, session start and end timestamps, session duration, IP address, and device or client version
• Audit logs of account and security events, such as sign-ins, plan and settings changes, and usage metering. Audit logs do not contain the content of your chats, prompts, or responses
• Technical error reports needed to diagnose faults and keep the Platform reliable
• Transaction records, amount, date, currency, plan, and invoice history. Card and bank details are handled by our payment processors and are never stored on our servers. Where a free trial requires a payment method, that is handled in the same way
• For cryptocurrency payments: the wallet address and transaction hash that paid us, the asset, network, amount, and confirmation status, which we or our crypto payment processors record and may screen against sanctions and fraud lists. We never ask for or store your private keys or seed phrases
• AI API credit purchases, balances, and drawdown history, so we can meter and bill usage
• A record of when and how you accepted our Terms of Service and Refund Policy before a payment, which we keep to evidence that acceptance
• Support correspondence you send us, and our replies
• Contact form submissions, including any company name and message you provide

Cryptocurrency transactions are recorded on public blockchains. That data is public, permanent, and outside our control, so we cannot alter or erase it, and requests to delete it can only apply to the copies we hold ourselves. We keep our own payment and tax records for as long as the law requires.

3.6 Guardrail signals

While a session is running, the Platform evaluates contextual signals to assess whether the activity still matches the authorized, in-scope work the account was verified for. This evaluation is described in Section 5. It is performed in real time and is not retained as a running record. Unless an enforcement action is triggered, no record of the evaluation is kept.

3.7 Professional service engagement data

When you engage our professional services (VAPT, Red Teaming, SOC, and similar), we process what the engagement requires:

• Target system information as defined in the scope of work
• Network and infrastructure details necessary for authorized testing
• Vulnerability findings, evidence, and assessment results
• Communication records related to the engagement

Engagement data is handled under strict confidentiality, is never shared with third parties without your written consent, is never used to train AI models, and is never used for marketing in any way that identifies you, your people, or your systems. We may describe our methods and findings in anonymised form.

3.8 Platform data you add or connect

When you use the organization platform, we process the data you add or connect so that the features work:

• SOC dashboard: the logs, events, alerts, and incidents you send or connect, and the rules and settings you configure
• Vulnerability assessment: the assets you register, scan results, and findings
• AI Probe: targets, scan results, and conversation transcripts. Credentials you store for a target are encrypted
• GitGuard: the repository connection you approve. Pull request code is analysed when a scan runs and is not stored
• Cloud Investigation: the logs you upload are deleted right after the investigation completes. The investigation report is kept until you delete it
• Keys and integrations: API keys, including keys you bring yourself, and integration credentials are encrypted at rest and are not shown again
• XHack web chat: conversations in the web chat are saved so that you can return to them, until you delete them. Conversations with the Agent are not stored by us (see Section 4)

Platform data is kept separate for each organization. For data you upload or connect, you are the controller and we act as your processor, as described in Section 2.

3.9 Spam and abuse risk

We actively monitor spam and abuse risk, including a spam score, across sign-ups, payments, and account activity. To do this we use information such as your account details, payment details, network and device signals such as your IP address, and how the account is used. We use these signals to decide whether to ask you to verify your identity, whether to require a payment card to be linked before a free trial, and whether to limit access, and we change those requirements as the risk changes. Our automated systems may detect likely spam or abuse and, rarely, ask you to verify your identity even where verification was optional. We use this only to protect the Platform and its users, never for advertising. You can ask for human review of a decision (Section 5.4).

4. What We Do Not Collect or Store

To be explicit about the commitments that matter most on this Platform:

• We do not store the chats of your XHack AI agent sessions. The Agent runs on your machine, and its prompts, responses, tool invocations, tool outputs, scan results, findings, and generated files are kept there. When you use the XHackhosted model, prompts and responses pass to our systems so that a response can be generated and the guardrails can run, and we do not store them. With local models, they never leave your machine
• We do not keep a log of what you do inside the Agent. We keep audit logs of account and security events, which do not contain the content of your chats, prompts, or responses. The only record that describes what happened inside an Agent session is the Incident Record described in Section 5.3, generated when the guardrails trigger an enforcement action
• We do not use your data, prompts, outputs, or engagement findings to train AI models
• We do not sell, rent, or trade personal data, and we do not work with data brokers
• We do not build advertising profiles or track you across other websites
• We do not perform automated facial recognition or biometric matching against your identification documents or interview recordings; verification is reviewed by our team
• We do not store card numbers or bank account details on our servers
• We never ask for, and do not store, cryptocurrency private keys or seed phrases

Because we do not hold your Session Content, we cannot recover it for you, produce it in response to a request from you, or disclose it to anyone else, including in response to a legal demand. There is nothing on our side to produce.

5. Runtime Guardrails and Incident Records

5.1 What is monitored

XHack AI watches for context, not content. If a session that started as an authorized, in-scope engagement starts drifting toward something outside that scope, activity that looks like it is targeting a system with no authorization on file, or a request pattern that reads as harmful rather than defensive, the Platform can detect that pivot in real time. This is not a keyword filter, and it is not a general surveillance mechanism: it is an assessment of whether a user's activity still matches the authorized work the account was set up for.

5.2 What happens to those signals

Guardrail evaluation happens as the session runs. Where no enforcement action is triggered, the evaluation is transient and no record of it is retained. We do not build behavioural profiles from it, we do not use it for marketing or product analytics, and we do not share it with third parties. Spam and abuse risk is handled separately, as described in Section 3.9.

5.3 Incident Records

When the guardrails trigger an enforcement action, typically terminating the session and locking the account, we create an Incident Record so the decision can be justified and reviewed. An Incident Record typically contains:

• The account and, where applicable, tenant identifier
• The date, time, and session identifier
• The signals and contextual indicators that triggered the action
• The enforcement action taken, and the outcome of any subsequent review

Incident Records are used to review and, where appropriate, reverse the decision; to prevent repeat abuse; to establish, exercise, or defend legal claims; and to comply with legal obligations. They may be disclosed to law enforcement, a regulator, or an affected system owner where we consider it necessary or are legally required to do so.

5.4 Human review of automated decisions

An enforcement action, or a decision to require verification or limit access (Section 3.9), may be triggered automatically. If one affects you, you can request human review by writing to support@xhack.io. A member of our team will review the Incident Record together with any authorization evidence you provide, and you may contest the outcome.

5.5 The limits of these controls

We do not claim these controls are infallible. Detection is probabilistic: it can produce false positives that interrupt legitimate work, and it can miss genuine misuse. Verification can be socially engineered, and credentials can be stolen. What the model does is raise the cost of abuse and create evidence when it happens. We would rather say that plainly than imply a guarantee we cannot make.

6. How We Use Your Information

We use personal data for the following purposes and no others:

• Verifying your identity, professional standing, or business legitimacy before granting full access
• Assessing and preventing spam and abuse, including deciding when to ask you to verify
• Creating, administering, and securing your account
• Delivering the Platform and the professional services you have engaged
• Metering usage, processing payments, and managing subscriptions
• Detecting, investigating, and acting on misuse of the Platform
• Responding to support requests and technical enquiries
• Sending critical service notifications such as security advisories and maintenance windows
• Understanding aggregate website usage, where you have consented to analytics
• Complying with legal obligations and responding to lawful requests

We do not use your personal data for advertising or for any purpose unrelated to the services you have engaged. We do assess spam and abuse risk, as described in Section 3.9, to protect the Platform.

7. Legal Bases for Processing

We process personal data in line with the data protection law that applies, including the law of Pakistan, where we are based, and, where it applies, the GDPR and UK GDPR. Where the GDPR or UK GDPR applies, we rely on:

• Contract: account creation and administration, service delivery, metering, billing, and support
• Legal obligation: retaining financial records, responding to lawful requests, and meeting anti-abuse and sanctions obligations
• Legitimate interests: verifying users before granting full access to powerful security tooling, assessing and preventing spam and abuse, protecting accounts against unauthorised access, impersonation, and fraud, operating the runtime guardrails, creating and retaining Incident Records, securing our infrastructure, and preventing misuse. We have assessed these interests against your rights and consider them proportionate given the nature of the capability being protected
• Consent: recording a verification interview, optional communications, and non-essential cookies. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out
• Explicit consent or substantial public interest: where an identification document contains data treated as sensitive in your jurisdiction, to the extent required by local law
• Legal claims: retaining verification records and Incident Records for the establishment, exercise, or defence of legal claims

8. Data Retention

• Account data, retained while your account is active, and deleted or de-identified within 30 days of closure on request, subject to the exceptions below
• Verification records (identification documents, certifications, business documents, interview recordings, and the review outcome), encrypted at rest and retained while your account is active, so that we can protect accounts against unauthorised access, impersonation, and fraud, investigate security incidents, and establish, exercise, or defend legal claims. If you delete your account, your identification documents are deleted 30 days afterwards. We keep the review outcome and a minimal record of which documents we relied upon for longer than the documents themselves, so that we can evidence who we granted access to and why
• Guardrail signals, not retained where no enforcement action is triggered
• Spam and abuse risk signals, retained while your account is active and for as long as needed to prevent repeat abuse and to establish, exercise, or defend legal claims
• Incident Records, retained for as long as necessary to prevent repeat abuse and to establish, exercise, or defend legal claims, which will normally be longer than the life of the account
• Session Content from the Agent, not retained by us at all
• Audit logs of account and security events, retained for as long as needed for security and accountability, and as the law requires. They do not contain chats, prompts, or responses
• XHack web chat, retained until you delete the conversation or close your account
• Cloud Investigation, uploaded logs are deleted right after the investigation completes, and reports are kept until you delete them
• Other platform data (SOC events, scan results, findings, and similar), retained until you delete it or for the period you configure, and deleted within 30 days of closure on request
• Engagement data, retained for the period specified in your service agreement, then securely destroyed by cryptographic erasure or physical destruction
• Billing records, retained as required by applicable tax and financial regulation
• Support correspondence, retained for 12 months after resolution

If you would like the specific retention period that applies to your account and jurisdiction, contact us and we will tell you.

9. Sharing and Disclosure

We do not sell personal data. We share it only in these circumstances:

• Service providers: cloud infrastructure and hosting, payment processing (including card and cryptocurrency payment processors), email delivery, identity and document verification support, and analytics. Each is vetted, bound by a data processing agreement, and given only the minimum data needed
• Tenant administrators: for seats under a company or enterprise subscription, the Tenant's administrators can see seat status, verification state, and usage metering for the seats they administer
• Law enforcement and regulators: where we are legally required to disclose, or where we consider disclosure necessary in connection with an Incident Record, unlawful activity, or a threat to safety. We assess each request and disclose only what is required
• Professional advisers and corporate transactions: to our auditors and legal advisers under confidentiality, and to a successor entity in a merger, acquisition, or asset sale, subject to this policy continuing to apply

10. Cookies, Analytics, and Tracking

We use essential cookies required for secure authentication and session management. These cannot be switched off without breaking sign-in.

On our public website we also use Google Analytics to understand aggregate traffic and page performance. This is a third-party analytics service that sets its own identifiers. It is loaded only if you accept analytics. You can accept or decline analytics through our cookie banner and change your choice at any time at Cookie Settings. Declining analytics does not affect your access to the Platform.

We do not use advertising cookies, retargeting pixels, or cross-site tracking, and we do not participate in ad networks. We do not run analytics inside the Agent.

11. Data Storage and Security

As a cybersecurity firm, we hold ourselves to the standards we assess others against:

• Data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Passwords are hashed with industry-standard algorithms and never stored in plaintext
• Verification documents are stored with restricted access and are viewable only by the personnel who perform verification
• Access to production systems is limited to authorized personnel under role-based access control, with multi-factor authentication
• Infrastructure is monitored for unauthorized access and anomalous activity
• We conduct regular security assessments of our own infrastructure

No system is perfectly secure. We do not claim ours is. We design so that a compromise of our Platform does not expose your Session Content, because we never hold it.

12. Engagement Data Confidentiality

Data collected during professional service engagements, VAPT reports, vulnerability findings, network diagrams, credentials, configuration details, receives the highest level of protection. It is accessible only to the researchers assigned to your engagement, is never used to train AI models, is never shared with other clients, and is not retained beyond the contractually agreed retention period. On expiry, it is securely destroyed using cryptographic erasure or physical destruction.

13. Local Models and Bring Your Own Key (BYOK)

The Agent supports local model execution and Bring Your Own Key (BYOK) configurations. When you use the XHack hosted model instead, your prompts and its responses are transmitted to our systems so that a response can be generated and the guardrails can run, and they are not stored. With local models, processing happens entirely on your own hardware and no prompts or responses leave your machine. With BYOK, data flows directly between your machine and the third-party provider using your own API key; XHack does not intercept, log, or store it. The third-party provider's own privacy terms govern that exchange, and you are responsible for reviewing them.

14. International Data Transfers

Your data may be processed in countries other than your own, including Pakistan, where we are based, and by the service providers listed in Section 9. Where data is transferred out of the UK, EEA, or another region with transfer restrictions, we rely on an appropriate safeguard such as standard contractual clauses together with supplementary measures. We do not transfer engagement data outside the jurisdiction agreed in your service agreement without your explicit written consent.

15. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access: obtain a copy of the personal data we hold about you
• Rectification: have inaccurate or incomplete data corrected
• Erasure: have your personal data deleted, subject to the limits below
• Portability: receive your data in a structured, machine-readable format
• Restriction: ask us to restrict processing in certain circumstances
• Objection: object to processing based on legitimate interests
• Withdraw consent: withdraw consent you previously gave, including for analytics or an interview recording
• Human review: obtain human review of, and contest, an automated enforcement decision, as described in Section 5.4
• Complain: lodge a complaint with your local data protection supervisory authority

Limits on erasure. We cannot delete data we are required to keep, and we will not delete records whose whole purpose is accountability. Specifically, we may retain verification records and Incident Records after account closure where necessary to establish, exercise, or defend legal claims, to comply with a legal obligation, or to prevent a user who was removed for abuse from simply re-registering. Where we decline an erasure request on that basis, we will tell you why and restrict the data to that purpose only.

These rights may also be available to you under other data protection laws, including Pakistani law, to the extent they apply to you.

To exercise any right, contact support@xhack.io. We may need to verify your identity before acting. We respond to legitimate requests within 30 days, or tell you if we need longer.

16. Data Breach Notification

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where the law requires it, notify affected users directly with a description of what happened, what data was involved, and what steps we are taking.

17. Children's Privacy

The Platform and our services are not intended for anyone under 18. We do not knowingly collect personal information from minors, and our verification process is designed to confirm age. If we learn we have collected data from someone under 18, we will delete it promptly.

18. Responsible Use

The Platform and the Agent are intended exclusively for authorized, ethical, and lawful cybersecurity operations conducted with documented permission. Users are solely responsible for holding appropriate authorization before testing any system. XHack is not liable for misuse of the Platform or for unauthorized activity conducted with our tools. Our Terms of Service set out the full framework, including the enforcement actions described in Section 5 of this policy.

19. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, services, or applicable law. When we make material changes, we will notify you by email or through a prominent notice on the Platform at least 30 days before they take effect, unless the law requires a change sooner. The "Last Updated" date above indicates the most recent revision. Continued use after changes take effect constitutes acceptance.

20. Contact

For any question about this policy, to exercise a right, or to raise a concern about how we handle your data:

• Data controller: XHACK (SMC-PRIVATE) LIMITED (SECP CUIN 0361945)
• Email: support@xhack.io
• Website: https://xhack.io

If you are not satisfied with our response, you have the right to complain to your local data protection supervisory authority.