Privacy Policy

We collect the minimum data needed to run the Service:

• Your email address, organisation name, and a hashed password.
• Billing information processed by Razorpay or Stripe. Flux8Labs never stores card details; we retain only the transaction ID, amount, and status.
• Usage counters: events per month, dev-audit calls per month, project count, and seat count.
• Telemetry event metadata: SHA-256 payload hashes, rule IDs, severity, source, upstream URL, and timestamp.
• IP addresses of proxy traffic in an in-memory LRU cache used by the tarpit module. These are never persisted to the database.
• File paths from # ekmire-ignore suppression comments in your codebase. These are stored to track which rules are suppressed at which locations. Note that absolute file paths may contain your system username (e.g. /home/username/project/file.py).

We do not collect:

• Raw request bodies or response bodies passing through the proxy.
• Source code or file contents. For BYOK users, code is sent directly to your LLM provider; Flux8Labs does not see it.
• Developer IDE buffer contents beyond the active MCP session, which runs locally over stdio and never reaches our servers.
• Cross-site tracking cookies of any kind.

By default, payload hashes, never raw content, are shared across the ekmire user base to improve threat detection. If the same hash fires on more than five organisations in 24 hours, the related rule candidate is escalated for review.

You may opt out from project Settings on Pro and Team plans. Free tier opt-out is not available; that is the trade for the free tier.

ekmire uses the following subprocessors:

Supabase (ap-south-1, Mumbai)

Primary Postgres database, authentication, realtime events.

Render

API compute hosting for the cloud control plane.

Resend

Transactional email delivery.

Razorpay

Primary payment processor for INR billing.

Stripe

International payment fallback for USD, EUR, and GBP card payments.

Upstash

API rate limiting and proxy auth caching.

Sentry

Server-side error tracking. Stack traces and error metadata only; no user content.

For users in the EU, EEA, and UK, we process personal data on the following legal bases under GDPR Article 6:

Performance of contract (Art. 6(1)(b))

Providing the Service: account management, authentication, project API keys, billing, and transactional emails.

Legitimate interests (Art. 6(1)(f))

Security monitoring and threat intelligence: aggregating anonymised payload hashes across the user base to detect and respond to emerging attack patterns. Our legitimate interest in improving collective security is balanced against minimal data collection (hashes only, never raw content).

Legal obligation (Art. 6(1)(c))

Retaining billing and tax records as required by applicable Indian law.

Consent (Art. 6(1)(a))

Any optional processing we introduce in future (e.g. analytics) will be consent-based with a clear opt-in mechanism.

For cross-border transfers of EEA personal data to India (a country not yet covered by an EU adequacy decision), we rely on Standard Contractual Clauses where applicable or on the necessity of the transfer for contract performance.

The primary database region is ap-south-1 (Mumbai, India), chosen for compliance with the Digital Personal Data Protection Act 2023. Backups are stored in the same region.

Stripe, Razorpay, and Sentry process data in their own regions per their respective Data Processing Addenda. Resend operates from EU/US regions.

Event data is retained per the limits of your plan: 7 days on Free, 90 days on Pro, 1 year on Team. After this window events are deleted from the primary database and from backups within 30 days.

On account closure, all data is deleted within 30 days. Tax and statutory records are retained as required by Indian law and then deleted.

Under GDPR and the DPDP Act 2023 you have the right to access your data, correct inaccurate data, request erasure, receive a portable export, and object to or restrict certain processing.

Send requests to [email protected]. We respond within 30 days.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Flux8Labs will:

• Notify the Data Protection Board of India as required under the Digital Personal Data Protection Act 2023 Section 8(6), without undue delay.
• Notify affected users by email to the address on their account within 72 hours of becoming aware of the breach, where feasible, describing the nature of the breach, the categories of data affected, and the steps we are taking.
• For EU/EEA users, notify the competent supervisory authority within 72 hours under GDPR Article 33.

To report a suspected security incident or data breach, email [email protected] immediately.

See the Cookie Policy for full details. In summary: ekmire sets a single strictly necessary authentication cookie. No analytics or advertising cookies are set at launch.

In accordance with the Digital Personal Data Protection Act 2023 and the Information Technology Act 2000, the details of the Grievance Redressal Officer are provided below. If you have any concerns or grievances regarding the processing of your personal data, you may contact:

Name: Mohit Phogat
Organisation: Flux8Labs
Email: [email protected]
Address: Jaipur, Rajasthan, India

We will acknowledge your grievance within 48 hours and resolve it within 30 days of receipt. If you are not satisfied with our response, you may approach the Data Protection Board of India once it is constituted under the DPDP Act 2023.

For all privacy questions or to exercise your rights, contact [email protected].