Privacy Policy

Xhorizyn is the data controller for the information described in this Policy. If your organization uses the Service, your organization's Account Admin controls the workspace, and we act as a data processor with respect to Customer Data your organization connects — log sources, security events, and Incidents. We act as a data controller with respect to account, billing, and usage information we collect to operate and secure the Service itself.

• To provide the Service: ingest your connected log sources and run detection, hunting, triage, and reporting against them.
• To operate the AI features: our AI models run on infrastructure we operate ourselves, not on a third-party AI vendor's platform.
• To manage your account and workspace: authentication, session management, member/role administration, and communications about your account.
• To bill you: process subscription payments through our payment processor.
• To secure the Service: detect and prevent fraud, abuse, and unauthorized access, including rate-limiting and login-lockout protections.
• To improve the Service: understand aggregate usage patterns, in de-identified or aggregated form wherever practical.
• To comply with legal obligations and enforce our Terms of Service.

If you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases: performance of a contract (to provide the Service you signed up for), our legitimate interests (to secure and improve the Service), your consent (where we ask for it specifically), and compliance with a legal obligation.

We do not sell your personal information. We share information only:

• with a limited set of infrastructure and service providers who process data on our behalf under contract (for example, our payment processor for billing) — we do not route AI processing through a third-party AI vendor;
• within your own workspace, where information such as your name and role is visible to other Members and your Account Admin as part of normal workspace administration;
• if required by law, regulation, legal process, or a valid governmental request; or
• in connection with a merger, acquisition, or sale of assets, subject to this Policy continuing to apply to previously collected data.

We retain account and billing information for as long as your account is active, and for a limited period afterward as needed for legal, tax, or dispute-resolution purposes. Refresh tokens and login sessions expire on a rolling basis (currently within seven days of inactivity). You control the retention of your own Customer Data — connected log sources, Incidents, and findings — subject to the retention window included in your plan, and can delete it at any time through the Service where supported; residual copies may persist briefly in backups before they are purged on our normal backup rotation.

We use industry-standard safeguards, including encrypted transport, hashed password storage, signed access tokens, per-account login-lockout protection against brute-force attempts, and access controls that scope every request to your own tenant. Our infrastructure is operated by us directly rather than outsourced wholesale to a third-party cloud platform, and we run regular backups with periodic restore testing. No system is completely secure, and we cannot guarantee absolute security.

Depending on where you live, you may have the right to access, correct, delete, or export a copy of your personal information, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. Many of these actions are available directly in the Service (for example, updating your profile, or reviewing and revoking your own active sessions in Settings). For anything else, contact us at darshit@xhorizyn.com. If your data is held as Customer Data within an organization's workspace, we may direct your request to that organization's Account Admin, who controls that data.

We may process and store information in a country other than the one where you are located. Where required, we use appropriate safeguards (such as standard contractual clauses) for transfers of personal data out of the EEA, UK, or Switzerland.

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

We use strictly necessary cookies to keep you signed in and to remember basic preferences (such as light/dark theme). We do not use third-party advertising trackers on the Service.

If we become aware of a security incident that compromises your personal information in a way that requires notice under applicable law, we will notify affected customers without undue delay and take reasonable steps to investigate and remediate the incident.

We may update this Policy from time to time. If we make a material change, we will provide notice (for example, by email or an in-product notice) before the change takes effect.

Questions about this Policy, or requests regarding your personal information, can be sent to darshit@xhorizyn.com.