This Privacy Policy describes how Beezifi Inc. ("Beezifi," "we," "our," or "us") collects, uses, stores, and discloses information when you use the Beezifi Security service (the "Service") — an API-based security gateway and web application firewall (WAF) platform that enables tenants to evaluate inbound HTTP requests against configurable security rules and receive real-time decisions. By creating an account or using the Service, you acknowledge and agree to this Privacy Policy in full.
Account Data
When you register a tenant account, we collect your organization name, email address, and a password. Passwords are stored exclusively as bcrypt hashes and are never retained in plaintext.
API Keys
When you generate API keys within the Service, we store the SHA-256 cryptographic hash of each key along with its prefix, name, creation timestamp, and status. The full plaintext API key is shown only once at generation time and is not stored by Beezifi. We record the number of API requests made per key and the timestamp of last use.
Request Evaluation Data
When your infrastructure calls the Service API (POST /api/v1/check) to evaluate an
inbound request, we receive and log the following data you submit:
For each evaluation we additionally record: the decision (ALLOW, BLOCK, or REDIRECT), the matched rule name and ID (if any), the computed threat score, and the API key used. This constitutes your request log, which is accessible from your dashboard.
Bandwidth Usage Data
We track the bytes consumed by each API call (request and response body sizes) to maintain your prepaid bandwidth balance. We record your cumulative bytes purchased and bytes remaining.
Billing & Payment Data
We record your purchase history including: the volume of bandwidth purchased, the price per GB applied, the total amount charged, the date of purchase, and the payment status. Payment processing is handled exclusively by Stripe, Inc.; Beezifi does not store credit card numbers, card verification codes, or full payment method details. Stripe assigns a customer ID that we associate with your tenant account for billing purposes.
Security Rules & Configuration
We store the security rules you create within your tenant account, including rule names, descriptions, types, configurations (e.g., IP lists, country codes, geofence coordinates), priorities, and ghost response definitions. This data is necessary to provide the Service.
Technical & Operational Data
We collect standard server-side technical data for operational and security purposes, including timestamps of dashboard logins and API calls, browser type and version used to access the dashboard, and server error logs.
We do not sell your data. We do not use your account data, request logs, or rule configurations to train machine learning models or for any advertising or marketing profiling purposes.
The request evaluation data described in Section 1 relates to the end users of your applications — not to Beezifi's direct relationship with those individuals. You, as the tenant, are the data controller with respect to your end users' IP addresses, paths, and user agents. You are responsible for maintaining appropriate legal bases and disclosures to your own end users for processing this data through the Service. Beezifi processes this data on your behalf as a data processor for the purpose of providing the evaluation service.
All tenant data — including rules, API keys, request logs, and bandwidth balances — is maintained in logically isolated, access-controlled database instances keyed by your tenant ID. Your data is never accessible to other tenants of the Service. Internal Beezifi staff follow role-gated, audited processes for any infrastructure access.
We do not sell, rent, or trade your personal information.
Data may be shared only in the following limited circumstances:
Your account data is retained while your account is active. Request logs are retained for 90 days by default and may be purged sooner at your request. Upon account deletion:
To request early deletion, contact privacy@beezifi.com.
We implement technical safeguards including bcrypt password hashing, SHA-256 API key hashing, TLS 1.2+ encryption in transit, short-lived JSON Web Tokens for dashboard sessions, per-endpoint rate limiting, multi-tenant data isolation, and HTTP security headers. Full details are in our Security Policy.
The Service dashboard uses minimal browser storage:
Clearing your browser's local storage will sign you out of the dashboard. This does not affect your API keys or Service configuration.
Depending on your jurisdiction, you may have the right to:
To exercise these rights, contact privacy@beezifi.com. We will respond within 30 days.
The Service is intended for business use by organizations and individuals aged 18 or older. We do not knowingly collect personal information from children under 16. If you believe a child's data has been submitted, contact privacy@beezifi.com and we will promptly delete it.
We may update this Privacy Policy from time to time. Material changes will be communicated via email at least 14 days before taking effect. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
This Privacy Policy and any disputes arising out of or relating to it shall be governed by and construed in accordance with the laws of the State of Washington, United States, without regard to its conflict-of-law provisions. By using the Service, you consent to the exclusive jurisdiction of the courts located in Washington State for any matters not subject to arbitration under our Terms of Service.
For privacy-related inquiries or to exercise your rights:
Email: privacy@beezifi.com
Response target: 5 business days