Privacy Policy

This policy explains how personal data is processed on guardx.to, in the GuardX panel and when GuardX protects its customers’ websites. The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Samuel Dierich, trading as GuardX
c/o IP-Management #8262
Ludwig-Erhard-Strasse 18
20459 Hamburg
Germany
E-mail: [email protected]
Telephone: +49 1522 3245373

("we", "us"). We have not appointed a data protection officer because we are not legally required to do so. Questions about your data and requests to exercise your rights can be sent to [email protected].

When GuardX protects a customer’s website, the customer decides why and how its visitors’ data is processed and is the controller for that data; we act as its processor (section 8).

When you open guardx.to, your browser sends the technical data that is needed to deliver the page. Our web server records in its access and error logs: your IP address, the date and time, the requested address (including any values it contains, such as an entry in one of our free tools), the status code, the user agent of your browser and the referring page.

We use these logs to deliver the website, to find and fix errors and to detect and defend against misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of guardx.to. The logs are rotated daily and deleted after 14 days at the latest.

The public pages of guardx.to set no cookies of their own; for a security cookie that Cloudflare may set, see section 3. They store nothing in your browser apart from the technical entries described in section 10. We do not use analytics, advertising or tracking technologies.

As long as guardx.to is delivered through Cloudflare, every connection to guardx.to, including the panel and our API, is received by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, and forwarded to our server. Cloudflare processes the connection data described in section 2 and the content of the requests and responses it forwards, including what you enter in our forms and in the panel, on our behalf as a processor (Art. 28 GDPR) in order to deliver the website and protect it against attacks. Cloudflare operates data centres worldwide, so this data may also be processed outside the EU, including in the USA.

Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework; the certification can be checked at dataprivacyframework.gov. Transfers to the USA are therefore based on the adequacy decision of the European Commission of 10 July 2023 (Art. 45 GDPR). For processing in other countries outside the EU/EEA without an adequacy decision, and in case the certification lapses, Cloudflare’s data processing addendum provides for the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). The addendum is published at cloudflare.com/cloudflare-customer-dpa; you can also request a copy of these safeguards from us at [email protected]. The legal basis for using Cloudflare is Art. 6(1)(f) GDPR; our legitimate interest is the fast and secure delivery of guardx.to.

On pages that show an e-mail address, Cloudflare may add a small script that protects the address against automated harvesting; it does not track you. If Cloudflare has to check whether a connection comes from a browser, it may set a strictly necessary security cookie for that purpose.

This applies only to guardx.to itself. Traffic to the websites of GuardX customers does not pass through Cloudflare; it is handled on GuardX’s own servers in the EU (section 8).

The sign-up form uses the GuardX captcha, our own service at captcha.guardx.to. It is operated by us on GuardX’s own servers in the EU and does not involve Cloudflare. To tell people from automated scripts, it evaluates technical characteristics of your browser and connection, including your IP address and user agent, and how you interact with the check while you complete the form. The result is a short-lived token that is valid only for the form you submit.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting accounts and forms against automated abuse. Reading the browser characteristics this requires is strictly necessary for the form you have asked to use (§ 25(2) No. 2 TDDDG). Requests to captcha.guardx.to are logged like all requests through the GuardX network, with the retention described in section 8.

When you create an account and use the panel, we process:

• your name and e-mail address, and your password, which we store only as a cryptographic hash;
• an optional company name, telephone number and profile picture, and the display preferences you set in the panel;
• the secret and the recovery codes for two-factor authentication (TOTP), if you enable it; the recovery codes are stored only as hashes;
• your active sessions, each with the user agent of the browser and the IP address, so that you can review and end them;
• API tokens you create, stored only as a hash, together with their name, permissions, IP allow list and the time and IP address of their last use;
• the domains you add, their DNS records and protection settings, and the captcha site keys you create;
• support tickets and their messages;
• the billing details you enter: name, address, VAT ID and country.

We process this data to provide the panel and the contracted services (Art. 6(1)(b) GDPR) and, for invoices and tax records, to meet our legal obligations (Art. 6(1)(c) GDPR). Session data and failed sign-in attempts are also processed to protect your account against takeover (Art. 6(1)(f) GDPR); failed attempts are counted per IP address and e-mail address in memory and discarded after one hour at the latest. The details marked as required in the sign-up form are needed to create an account; without them we cannot provide the panel. Everything else is optional or arises from your use of the services.

A session ends when you sign out and after seven days at the latest; expired sessions are deleted. You can delete your account in the panel at any time. This removes your account data, domains, DNS zones, sessions, API tokens, captcha site keys, billing details and support tickets.

Where we are legally required to keep records, we keep them only for that purpose and for the statutory period: invoices and other accounting vouchers for eight years (§ 147(3) AO, § 14b(1) UStG) and commercial and business letters for six years (§ 147(3) AO). The period starts at the end of the calendar year in which the record was created.

We send the e-mails that belong to your account, such as address verification, password resets and notifications about your account and services, through an external e-mail delivery (SMTP relay) service provider that processes the data on our behalf (Art. 28 GDPR). It receives your e-mail address and the content of the message. The legal basis is Art. 6(1)(b) GDPR.

If you write to us, for example at [email protected], we process your e-mail address, your message and any data you include in order to answer you. The legal basis is Art. 6(1)(b) GDPR where your message relates to a contract or a request for one, and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering enquiries. We delete the correspondence once it has been dealt with, unless a statutory retention period applies (section 5).

The free tools at guardx.to/tools can be used without an account. The calculators run entirely in your browser; nothing you enter is sent to us. For the IP lookup, the DNS lookup, the HTTP header checker and the SSL checker, your browser sends your input to our server:

• The IP lookup looks up your IP address, or the address you enter, in a database stored on our own server (GeoLite2 data created by MaxMind). No third party is asked.
• The DNS lookup sends the name you enter to public DNS resolvers. The query comes from our server, so the resolvers see our server, not your IP address.
• The HTTP header checker and the SSL checker connect from our server to the address you enter. That server sees our server, not your IP address.

The tools do not store your input. Because the input is part of the requested address, it appears in the web server log described in section 2 and is deleted with it after 14 days; like every request to guardx.to, it also passes through Cloudflare (section 3). To prevent abuse, we count requests per client for a short time; the counters are held in memory under a hashed key and are discarded automatically. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is providing the tools and protecting them against misuse.

When a customer protects a website or API with GuardX, the requests of its visitors are received and filtered by GuardX’s own servers in the EU before they are forwarded to the customer’s origin server. TLS termination, request inspection, caching and logging take place on our own servers in the EU; this traffic does not pass through Cloudflare. In doing so we process:

• the IP addresses of visitors;
• connection and request metadata, for example the requested address, the method, headers including the user agent, and technical parameters of the encrypted connection;
• security events, for example that a request was checked or blocked;
• content that the customer has instructed us to cache.

For this processing the customer is the controller and we are its processor (Art. 28 GDPR). We process the data only on the customer’s instructions: to deliver, cache and protect its website and to show it traffic and security statistics in the panel. Our data processing agreement under Art. 28(3) GDPR is part of our terms of service (section 10) and applies to every customer. The same applies when a customer embeds the GuardX captcha on its own website or app. Requests are forwarded to the origin server the customer specifies; where that server is located outside the EU/EEA, the customer is responsible for that transfer.

To protect a website, GuardX may set short-lived security cookies or browser storage entries on that website, for example to remember that a browser has passed a check. They serve only the security of the website and are not used for tracking or advertising.

The central request log is deleted after 90 days. The edge servers keep only short working logs in memory, which are rotated by size and cleared on every restart. Short-lived security state, such as request counters and temporary blocks, expires automatically. If you have visited a website protected by GuardX and want to exercise your rights, please contact the operator of that website. If you contact us instead, we forward your request to the customer concerned.

We also use the connection and request data described in section 8 as controller where this is needed to keep the GuardX network and services secure and available for all customers, for example to detect and block an attack that targets several customers or our own infrastructure, and to investigate security incidents. The data comes from the connections made to our network.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the security of our network and information systems (Recital 49 GDPR). The retention periods are those in section 8: the central request log is deleted after 90 days, edge working logs are rotated by size and cleared on restart, and short-lived security state expires automatically.

The public pages of guardx.to set no cookies of their own. guardx.to, including the panel and the sign-in, uses only the following cookies and browser storage entries, each only where the function it serves is used. All of them are strictly necessary to provide the service you have requested (§ 25(2) No. 2 TDDDG), so no consent is required:

• guardx_session (cookie): keeps you signed in to the panel. HttpOnly, Secure, SameSite=Lax; deleted when you sign out and expires after seven days at the latest.
• guardx_pv (cookie): a short-lived verification cookie used during sign-up and two-factor verification. It is sent only to our sign-in endpoints and expires after one hour.
• lang (cookie): stores your language choice if you select a language; expires after one year.
• sidebar_state (cookie): remembers whether the panel sidebar is open or collapsed; expires after seven days.
• gx-prefs (localStorage): a local copy of your panel display preferences, so that the panel opens the way you left it. It remains in your browser until you delete it.
• theme (localStorage): stores the light or dark theme if you switch it with the theme button on guardx.to or in the panel. It remains in your browser until you delete it.
• gx-chunk-reload (sessionStorage): a one-time flag that prevents a reload loop if a page fails to load after an update; deleted when you close the tab.

We do not use analytics, advertising or tracking cookies. Any further processing of data from these entries is based on Art. 6(1)(b) or (f) GDPR. For a security cookie that Cloudflare may set, see section 3; for cookies on websites protected by GuardX, see section 8.

We pass personal data only to the following categories of recipients:

• hosting, data-centre and network providers in the EU that operate the infrastructure and connectivity for our servers, as processors where they can access data;
• an e-mail delivery (SMTP relay) service provider (section 6);
• Cloudflare, Inc., USA, for the delivery of guardx.to (section 3);
• the origin servers specified by our customers, to which GuardX forwards their visitors’ requests (section 8);
• authorities, courts and other public bodies, where we are legally required to disclose data (Art. 6(1)(c) GDPR).

Personal data is transferred to countries outside the EU/EEA in the cases described in sections 3 (Cloudflare) and 8 (origin servers chosen by our customers). We do not sell personal data and do not share it for advertising.

You have the right to:

• access the personal data we hold about you (Art. 15 GDPR);
• have inaccurate data rectified (Art. 16 GDPR);
• have your data erased (Art. 17 GDPR);
• have the processing restricted (Art. 18 GDPR);
• receive your data in a structured, machine-readable format (Art. 20 GDPR);
• withdraw a consent at any time with effect for the future (Art. 7(3) GDPR). None of the processing described in this policy is currently based on consent.

We inform recipients of any rectification, erasure or restriction where Art. 19 GDPR requires it.

Right to object (Art. 21 GDPR): where we process your data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, write to [email protected]. Many account details can also be viewed, changed or deleted directly in the panel.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information)
Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany
datenschutz-hamburg.de

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

The filtering that protects websites is automated: a request may be checked, slowed down or blocked. Such a decision concerns a single request or connection and has no legal effect. If you believe you are being blocked by mistake, please contact the operator of the website or write to us at [email protected].

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit (TLS), access control limited to the people who need access, passwords stored only as hashes and optional two-factor authentication for accounts.

We update this policy when our services or the law change. The current version is always available on this page; the date at the top shows when it was last updated.