Privacy Policy & Data Protection Charter

01.Scope & Entity Overview

This Privacy Policy governs the processing of information by HXLABZ ("HXLabz", "we", "us", or "our") across our foundational AI systems, computational fluid dynamics (CFD) simulation engines, waitlist registry, and web platforms available at hxlabz.com and associated subdomains.

We design our systems under the principle of Zero Unnecessary Telemetry. We do not sell, broker, or monetize personal data, nor do we deploy third-party behavioural ad tracking networks. This policy provides full transparency regarding the exact data points processed, where they reside, and your statutory rights under the Digital Personal Data Protection Act, 2023 (DPDPA - India), the General Data Protection Regulation (GDPR / UK GDPR), and the California Consumer Privacy Act as amended (CCPA/CPRA).

02.Data Inventory & Categories Collected

Our application collects only strictly necessary technical and user-submitted data. The table below represents our comprehensive data inventory:

03.Waitlist & Cryptographic Token Architecture

To maintain transparency without sacrificing privacy, our waitlist implements a zero-knowledge public identification architecture:

• Public Sequence Identifiers: When you register, you receive a sequential identifier (e.g., HX-000042). This ID is publicly displayed on the roster and contains zero personally identifiable information.
• 48-Character Status Tokens: Your registration produces a 48-character cryptographically secure random token ([A-Za-z0-9]). We store only a salted SHA-256 hash of this token. The raw token is displayed to you once upon signup and never logged or stored in plain text.
• Self-Serve Erasure: Entering your 48-character token at /waitlist/status grants you instant access to inspect your verification status or trigger permanent deletion of your email and record.

04.AI & Computational Model Processing

HXLabz develops deterministic simulation architectures and integrates select foundational models (such as Google GenAI / Gemini API) strictly for technical evaluation and terminal command routing.

05.Legal Bases for Processing

Under GDPR Art. 6 and the DPDPA 2023, we rely on the following lawful bases:

• Consent (Art. 6(1)(a) GDPR / DPDPA Sec. 6): When you willingly submit your email address to join the waitlist or submit a partnership inquiry form.
• Legitimate Interests (Art. 6(1)(f) GDPR): For maintaining server security, mitigating automated bot registrations, preventing token brute-force attempts, and optimizing network delivery.
• Legal Obligation (Art. 6(1)(c) GDPR): For compliance with statutory obligations, judicial orders, and tax/accounting rules.

06.Third-Party Subprocessors & International Transfers

We engage vetted infrastructure providers to deliver our services. All providers are bound by strict Data Processing Addenda (DPAs):

07.Data Retention & Purge Schedule

We enforce deterministic data lifecycle policies. Personal data is retained only for the duration necessary to satisfy the stated purpose:

• Waitlist Records: Retained until you request self-serve erasure via your 48-character token, or until account conversion occurs.
• Inquiry Transmissions: Retained for 12 months following resolution of the institutional communication.
• IP Rate-Limit Keys: Automatically evicted from in-memory cache within 60 to 300 seconds.
• Server Access Logs: Rotated and automatically purged every 30 days.

08.User Rights & Right to Erasure

Regardless of geographic jurisdiction, we extend comprehensive privacy controls to all users:

• Right to Access & Portability: You may verify your submission status and active record metadata via /waitlist/status.
• Right to Erasure (Right to be Forgotten): You may permanently delete your email record and status token instantly via our automated self-serve deletion tool.
• Right to Withdraw Consent: You may withdraw consent for marketing or technical updates at any time by triggering erasure or contacting our privacy office.
• Right to Lodge Complaints: You have the right to lodge a complaint with your supervisory authority (e.g., the Data Protection Board of India or your local European DPA).

09.Technical & Organizational Security

We implement end-to-end transport layer encryption (TLS 1.3), constant-time token comparison (crypto.timingSafeEqual) to eliminate timing attacks, SHA-256 credential hashing, memory-isolated serverless workloads, and automated IP rate limiting to defend against enumeration attacks.

10.Children's Privacy

Our systems and engineering tools are strictly intended for individuals aged 18 and older. We do not knowingly collect or solicit personal data from children. If we discover that personal data of a minor has been collected, we will erase it immediately.