1. Who we are

StraxisWall is a permission checkpoint service for AI agents. We are operated as an independent software product. When we say "we", "us" or "StraxisWall" in this policy, we mean the team behind this product. When we say "you" we mean the developer or company using our service.

For questions about this policy, contact us at: customer.care@straxiswall.com

2. What data we collect

We collect only what is necessary to provide the service.

Account data: When you register, we store your email address, company name, and a hashed version of your password. We never store your plain text password.

API usage data: Every time your AI agent calls our /check endpoint, we log the following:

• Timestamp of the request
• Your agent ID (the value you send in x-agent-id)
• The action name your agent sent
• The destination field if you included one
• Whether the action was allowed or blocked
• The reason it was blocked if applicable

What we do NOT collect: We never read, store or process the prompts sent to your AI models, the responses returned from your AI models, your OpenAI keys, Stripe keys, or any other third party credentials. StraxisWall is not a proxy — your AI model traffic never passes through our servers.

3. How we use your data

We use your data solely to provide the StraxisWall service:

• To authenticate you when you log in
• To enforce the rules you have written for your workflows
• To display your activity logs on your dashboard
• To generate compliance exports when you request them
• To send password reset emails when you request them

We do not sell your data. We do not share your data with third parties for advertising purposes. We do not use your data to train AI models.

4. Data storage and security

Your data is stored in a PostgreSQL database hosted on Neon.tech, located in Singapore. We use the following security measures:

• All passwords are hashed using bcrypt before storage
• Sessions are stored server-side — not in browser cookies or local storage
• All connections to our database use TLS encryption
• API keys are randomly generated and never predictable
• Each customer's data is fully isolated — you cannot access another customer's logs or rules

5. Data retention

We retain your activity logs for as long as your account is active. When you delete your account, your logs, rules, API keys and account data are permanently deleted within 30 days.

If you require longer retention for compliance purposes — for example under the EU AI Act which recommends 6 months minimum — we recommend exporting your logs regularly using our Excel or JSON export feature.

6. Third party services

We use the following third party services to operate StraxisWall:

• Neon.tech — database hosting. Your data is stored on their servers.
• Resend — email delivery for password reset emails only.
• Railway — server hosting for the StraxisWall application.

We do not use Google Analytics, Facebook Pixel, or any advertising tracking on this platform.

7. Your rights

You have the right to:

• Access all data we hold about you — email us and we will send it within 7 days
• Export your activity logs at any time using the export feature on your dashboard
• Delete your account and all associated data — contact us at customer.care@straxiswall.com
• Correct any inaccurate account information via the Settings page

8. Cookies

We use one session cookie to keep you logged in. This cookie is HTTP-only (cannot be read by JavaScript), marked SameSite Strict (cannot be sent on cross-site requests), and expires after 24 hours of inactivity. We do not use any advertising cookies or third party tracking cookies.

9. Changes to this policy

If we make significant changes to this policy, we will notify you by email. The date at the top of this page shows when it was last updated.

10. Contact

For any privacy related questions or requests, email us at customer.care@straxiswall.com. We aim to respond within 48 hours.