Privacy Policy

1. Who is responsible for your data

Controller

AI Services LLC (trade name OpenWAF)

Address

99 Wall Street #2351, New York, NY 10005, USA

Phone

+1 646 980 6880

E-mail

[email protected]

Website

openwaf.dev

We have not appointed a data protection officer (DPO). For any privacy question, write to [email protected].

2. Applicable regulations

We process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) and Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE).

3. Our two roles

• Controller. We decide how and why personal data are processed for this website, early-access requests, customer accounts, support, and abuse and security reports. This policy describes that processing.
• Processor. When a customer places its websites behind OpenWAF, we process the traffic of those websites and the e-mail addresses the customer authorises in the access gate on the customer’s behalf and following its instructions. The customer is the controller of that data and the processing is governed by our Data Processing Agreement. If you visit a website protected by OpenWAF, the privacy policy of that website applies.

4. Data we process

4.1. Visits to this website

This website sets no cookies and uses no analytics (see the Cookie Policy). When you visit it, our servers and our WAF record request data: IP address, user agent, requested URL and time.

• Purpose: protecting the website and the service against attacks and abuse, and operating them.
• Legal basis: our legitimate interest in the security of our systems (art. 6(1)(f) GDPR).
• Retention: WAF security events are kept for 30 days. Other server logs are kept for a short period, as long as needed for security and operation.

4.2. E-mails you send us

When you write to us (for example, to request early access, ask for support, or report abuse or a vulnerability), we process your e-mail address, your name if you give it, and the content of your message.

• Purpose: answering and handling your request.
• Legal basis: taking steps at your request before entering into a contract, or performing the contract (art. 6(1)(b) GDPR); for abuse and security reports, our legitimate interest in keeping the service safe (art. 6(1)(f) GDPR).
• Retention: until the matter is resolved, and afterwards as long as needed to deal with possible legal claims.

4.3. Customer accounts

For each account we process the name, e-mail address, organisation and role of its members, hashes of their API tokens (never the tokens themselves) and the audit log of configuration changes, which records who made each change, when and the reason given.

• Purpose: providing the service, securing access and keeping a record of changes.
• Legal basis: performance of the contract (art. 6(1)(b) GDPR); for the audit log, also our legitimate interest in the security and traceability of the service (art. 6(1)(f) GDPR).
• Retention: for the life of the account; then deleted, except audit log entries and other data we must or may keep to meet legal obligations or deal with legal claims.

4.4. Automatic e-mails

We send automatic e-mails from [email protected]. In particular, the access gate sends one-time codes to the e-mail addresses that a customer has authorised to enter a protected area of its website. We send those e-mails on behalf of the customer, as its processor (see section 3).

5. Who we share data with

We use these providers. No other third parties receive personal data from us.

Our e-mail runs on our own mail server. We do not sell or share personal data, we do not show advertising and we do not use personal data to train artificial-intelligence models. We will only disclose data to authorities when the law requires it.

6. International transfers

AI Services LLC is a company established in the United States. Personal data are stored in the European Union (Germany). When data are transferred to the United States, including to AI Services LLC itself and to the providers listed above, the transfer relies on the EU–US Data Privacy Framework where the recipient is certified under it, or otherwise on the Standard Contractual Clauses approved by the European Commission.

7. How we protect data

• Servers, DNS and edge nodes hosted in the European Union.
• Encryption in transit (TLS).
• API tokens stored only as hashes, with mandatory expiry.
• Configuration sent to edge nodes signed with Ed25519.
• Every configuration change is versioned and recorded in an audit log with its author and reason.
• Access limited to the people who need it.
• Security events deleted after 30 days by default.

8. Your rights

You have the right to access your data, rectify it, request its erasure, object to its processing, request the restriction of its processing and request its portability, and to withdraw your consent at any time where processing relies on consent. To exercise them, write to [email protected]. We may ask you to prove your identity.

If you think we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) or with the supervisory authority of your country.

If you are a visitor of a website protected by OpenWAF, the owner of that website is the controller of your data: please contact it first. If you write to us, we will forward your request to the customer and help it answer.

9. Minors

OpenWAF is a service for businesses and is not intended for people under 18. We do not knowingly collect data from minors.

10. United States residents

We do not sell or share personal information, as those terms are defined in the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). To exercise your rights, write to [email protected].

11. Changes to this policy

We may update this policy. The date of the latest version is shown at the top of this page. If a change is significant, we will tell our customers by e-mail before it takes effect.