This Privacy Policy describes how Beezifi Inc. ("Beezifi," "we," "our," or "us") collects, uses, stores, and discloses information when you use the Beezifi Security service (the "Service") — an API-based request decision platform that enables tenants to evaluate inbound HTTP requests against configurable security rules and receive decisions, with an optional agent that applies firewall rules on tenants' own servers. By creating an account or using the Service, you acknowledge and agree to this Privacy Policy in full.
Account Data
When you register a tenant account, we collect your organization name, email address, and a password. Passwords are stored exclusively as bcrypt hashes and are never retained in plaintext.
API Keys
When you generate API keys within the Service, we store the SHA-256 cryptographic hash of each key along with its prefix, name, creation timestamp, and status. The full plaintext API key is shown only once at generation time and is not stored by Beezifi. We record the number of API requests made per key and the timestamp of last use.
Request Evaluation Data
When your infrastructure calls the Service API (POST /api/v1/check) to evaluate an
inbound request, we receive and log the following data you submit:
For each evaluation we additionally record: the decision (ALLOW, BLOCK, or REDIRECT), the matched rule name and ID (if any), the computed threat score, and the API key used. This constitutes your request log, which is accessible from your dashboard. We also keep daily aggregate counts (per account, API key and decision, with a summed threat score) that contain no IP addresses, paths or user agents.
Usage Data
We count the decisions made under your account to maintain your prepaid request balance, and record your total requests purchased and remaining.
Firewall Agent Data
If you use the optional firewall agent, we store each server's description and URL, the API key it is linked to, and its agent secret in encrypted form (AES-256-GCM). We send the agent the IP addresses to block that result from your rules.
Billing & Payment Data
We record your purchase history including: the request pack purchased, the amount charged, the date of purchase, the payment status, and promotional or welcome credits. Card and Link payments are processed by Stripe, Inc.; Beezifi does not store card numbers, card verification codes, or full payment method details. Stripe assigns a customer ID that we associate with your tenant account. Crypto payments (USDC or B2B tokens) are processed through MooChedda; we record the invoice ID, amount, currency and blockchain transaction hash.
Security Rules & Configuration
We store the security rules you create within your tenant account, including rule names, descriptions, types, configurations (e.g., IP lists, country codes, geofence coordinates), priorities, and ghost response definitions. This data is necessary to provide the Service.
Technical & Operational Data
We collect standard server-side technical data for operational and security purposes, including timestamps of dashboard logins and API calls, browser type and version used to access the dashboard, and server error logs.
We do not sell your data. We do not use your account data, request logs, or rule configurations to train machine learning models or for any advertising or marketing profiling purposes.
The request evaluation data described in Section 1 relates to the end users of your applications — not to Beezifi's direct relationship with those individuals. You, as the tenant, are the data controller with respect to your end users' IP addresses, paths, and user agents. You are responsible for maintaining appropriate legal bases and disclosures to your own end users for processing this data through the Service. Beezifi processes this data on your behalf as a data processor for the purpose of providing the evaluation service.
All tenants share one database. Every record — including rules, API keys, request logs, firewall targets and balances — carries your tenant ID, and every query the Service makes on your behalf is filtered by the tenant ID in your authenticated session, never by an identifier supplied by the browser. Your data is not accessible to other tenants of the Service. Internal Beezifi staff follow role-gated, audited processes for any infrastructure access.
We do not sell, rent, or trade your personal information.
Data may be shared only in the following limited circumstances:
Your account data is retained while your account is active. Request logs (which contain end-user IP addresses, paths and user agents) are automatically deleted after 90 days, and you can purge them sooner from the dashboard. Daily aggregate counts, which contain none of those fields, are kept for the life of the account. Short-lived rate-limit counters and sign-in state expire within minutes to hours. Upon account deletion:
To request early deletion, contact privacy@beezifi.com.
We implement technical safeguards including bcrypt password hashing, SHA-256 API key hashing, AES-256-GCM encryption of firewall agent secrets, TLS 1.2+ encryption in transit, expiring JSON Web Tokens for dashboard sessions, optional two-factor authentication, rate limiting, tenant-scoped queries, a strict Content Security Policy, and HTTP security headers. Full details are in our Security Policy.
The Service dashboard uses minimal browser storage:
Clearing your browser's local storage will sign you out of the dashboard. This does not affect your API keys or Service configuration.
Depending on your jurisdiction, you may have the right to:
To exercise these rights, contact privacy@beezifi.com. We will respond within 30 days.
The Service is intended for business use by organizations and individuals aged 18 or older. We do not knowingly collect personal information from children under 16. If you believe a child's data has been submitted, contact privacy@beezifi.com and we will promptly delete it.
We may update this Privacy Policy from time to time. Material changes will be communicated via email at least 14 days before taking effect. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
This Privacy Policy and any disputes arising out of or relating to it shall be governed by and construed in accordance with the laws of the State of Washington, United States, without regard to its conflict-of-law provisions. By using the Service, you consent to the exclusive jurisdiction of the courts located in Washington State, as described in our Terms of Service.
For privacy-related inquiries or to exercise your rights:
Email: privacy@beezifi.com
Response target: 5 business days