hektro

Legal

Privacy Policy

Last updated

Who is responsible for your data

The controller of your personal data, in the sense of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), is:

  • HIDROGENONE S.R.L.
  • Str. Ștefan cel Mare nr. 141, sat Răcăciuni, com. Răcăciuni, jud. Bacău, 607480, Romania
  • Trade register: J2026047886007 (EUID ROONRC.J2026047886007)
  • CUI 55359240
  • Email for all privacy questions and requests: support@hektro.com
  • Phone: +40 774 604 273

This policy covers the Hektro app, the website hektro.com and your Hektro account. It applies together with our Terms of Service.

What we never receive

Hektro runs on your Mac. We do not receive:

  • the contents of your terminals;
  • your prompts, your code or the output of your AI agents.

We also do not receive your AI usage. Claude Code and Codex talk to Anthropic or OpenAI directly, under your own accounts. We never see your card number either: payment data goes to Stripe.

What data we use

Account data. Your email address, your sign-in identities (the provider, the provider’s identifier for you, and the email it gives us), the date you created the account, the date your trial started, and your Stripe customer identifier.

Sign-in data. If you sign in with GitHub, we receive your email address from GitHub. If you sign in with Google, we receive your verified email address from Google. If you use an email code, we use the address you typed. We do not receive your GitHub or Google password.

Device data. For each Mac you use with Hektro: its name, the public part of the device key, and the time it was last seen. The private part of the device key never leaves your Mac.

Subscription data. Your plan, its status and the end of the current period. Payment details stay with Stripe.

Security data. Hashed session tokens and hashed sign-in code tokens. Counters we use to limit the number of requests, which are kept as keyed one-way codes (see below) and not as your plain email address. A log of events on your account (sign-ins, sign-outs of devices, account deletion and refunds), which holds the event and your account identifier. When you ask for a sign-in code, Cloudflare Turnstile processes your IP address and signals from your browser, to tell you from a bot.

Trial-claim key. For each sign-in identity that starts a trial, we keep a trial-claim key. This stops a trial from being repeated. We keep it even after you delete your account.

Keyed one-way codes. The trial-claim key, the counters that limit email requests, and the identifiers in our logs are made with HMAC-SHA256, a keyed one-way code, using a secret key that only we hold. Without that secret key, the code cannot be turned back into your email address. We can still check whether the same identity appears again.

Messages to us. If you write to support@hektro.com or call us, we process what you send us. Messages to this address are forwarded to the mailbox of the owner of HIDROGENONE S.R.L.

Usage figures. We use no analytics tools and no tracking cookies. We count how Hektro is used only from our own server records, for example the number of accounts and subscriptions.

  • Creating and running your account, signing you in, and licensing the app. Account data, sign-in data, device data, subscription data. Legal basis: performance of a contract with you (GDPR art. 6(1)(b)).
  • Starting your trial. Account data and the trial-claim key. Legal basis: performance of a contract with you (art. 6(1)(b)).
  • Taking payments and managing your subscription. Account data, subscription data, Stripe customer identifier. Legal basis: performance of a contract with you (art. 6(1)(b)).
  • Sending sign-in codes and messages about your account. Email address. Legal basis: performance of a contract with you (art. 6(1)(b)).
  • Answering your messages and handling complaints and refund requests. The data in your message and the related account data. Legal basis: performance of a contract with you (art. 6(1)(b)) where you ask about your account or a payment, and otherwise our legitimate interest in answering the people who contact us (art. 6(1)(f)).
  • Keeping accounting and tax records. Records of payments and invoices. Legal basis: legal obligation (art. 6(1)(c)).
  • Keeping the service secure and preventing abuse. Security data and the audit log of account events: stopping automated attacks, limiting the number of requests, finding and investigating misuse, and keeping encrypted backups. Legal basis: our legitimate interest in the security of the service (art. 6(1)(f)).
  • Preventing the repeated use of the free trial. The trial-claim key. Legal basis: our legitimate interest in offering one trial per person (art. 6(1)(f)). You may object to this, see “Your rights”.
  • Establishing, exercising or defending legal claims. Relevant records. Legal basis: our legitimate interest (art. 6(1)(f)).
  • Counting accounts and subscriptions. Our own server records, as totals. Legal basis: our legitimate interest in knowing how Hektro is used (art. 6(1)(f)).

We do not rely on your consent for any processing described in this policy. This is why you do not see a cookie banner.

When we rely on legitimate interest, we have weighed it against your rights and interests. You can ask us for details at support@hektro.com.

Do you have to give us your data

To create an account and use Hektro, you must give us a sign-in identity with an email address. Without it we cannot sign you in, give you a trial, or provide the service. This data is needed to enter into and perform the contract. The same is true for payment data that you give to Stripe when you subscribe.

Everything else is optional. For example, you do not have to write to us.

Who receives your data

We use the following providers. Cloudflare, Resend and our own server process data on our behalf. Stripe, GitHub and Google act for themselves for their own purposes, as their privacy policies explain.

  • Cloudflare. DNS, content delivery, Workers (our servers that run the website, sign-in and licence functions), Turnstile (a bot check on sign-in, which processes your IP address and browser signals), Hyperdrive (the connection to our database), R2 (encrypted backups), and Email Routing (forwarding messages sent to support@hektro.com).
  • Stripe. Payments, Checkout and the customer portal, and receipts. Stripe handles your card data. For some purposes, such as fraud prevention and its own legal duties, Stripe decides for itself how to use payment data, and then acts as a separate controller under its own privacy policy.
  • Resend. Sending the emails that contain your sign-in codes, and our replies to your support emails.
  • GitHub and Google. If you choose to sign in with them, they tell us your verified email address. They also learn that you signed in to Hektro. Their own privacy policies apply to what they process.
  • Support email. When you write to support@hektro.com, Cloudflare Email Routing receives your message and holds it briefly until our own mail system collects it. Our mail system is run by HIDROGENONE S.R.L. on our server in Romania, and it stores your message encrypted. We reply from our company mailbox, and our replies are sent through Resend.
  • Our own server. The database with your account data runs on a server of HIDROGENONE S.R.L. in Romania.

We may also disclose data to authorities, courts or advisers (such as our accountant) when the law requires or allows it, and to a company that takes over Hektro, with the same protection.

We do not sell your data and we do not use it for advertising.

Transfers outside the European Economic Area

Some of our providers are based in, or process data in, countries outside the European Economic Area, in particular the United States. Cloudflare serves requests from the data centre nearest to you, so your data may be handled outside the EEA when you use Hektro or the website.

When we or our providers transfer personal data outside the EEA to a country without an adequacy decision of the European Commission, the transfer must rest on a safeguard under Chapter V of the GDPR, such as the EU-US Data Privacy Framework adequacy decision for certified companies, or the Commission’s standard contractual clauses. [Transfer mechanism for each provider (Cloudflare, Stripe, Resend, GitHub, Google): to be confirmed.]

You can ask us at support@hektro.com how to get a copy of the safeguards that apply.

How long we keep your data

  • Account data, device data and subscription data: for as long as your account exists. When you delete your account, we delete the personal rows, except the records listed below.
  • Invoice and payment records: for as long as accounting and tax law require us to keep them, even after you delete your account.
  • Trial-claim key: kept after you delete your account, for as long as we need it to stop a trial from being repeated.
  • Session tokens (hashed): until the session ends or expires. A site session lasts 30 days.
  • Sign-in code tokens (hashed): email sign-in codes expire after 10 minutes and are then deleted.
  • Request counters: about 2 days.
  • Audit log of account events: it holds sign-in, device sign-out, account deletion and refund events with the account identifier. We keep it while it is needed for security and for legal claims.
  • Encrypted backups: kept only for as long as we need them to restore the service, then deleted.
  • Messages to support@hektro.com: for as long as needed to answer you and to deal with any complaint or claim.

After the periods above, we delete the data or make it anonymous. We may keep data for longer if it is needed in a legal claim.

Your rights

Under the GDPR, you have the right to:

  • access your data and get a copy (art. 15);
  • have wrong data corrected (art. 16);
  • have your data erased (art. 17). You can delete your account yourself on your account page;
  • restrict processing in some cases (art. 18);
  • receive the data you gave us in a common format and have it passed on (portability, art. 20), where we process it on the basis of a contract;
  • object to processing based on our legitimate interest (art. 21). This includes the trial-claim key and security processing. We will stop unless we show compelling legitimate grounds, or we need the data for legal claims.

To use a right, write to support@hektro.com. We answer within one month. If the request is complex, the law allows us to extend this period, and we will tell you. We may need to check who you are. It is free, unless a request is clearly unfounded or excessive.

Erasure has limits. We cannot delete records we must keep by law, and we keep the trial-claim key for the reason given above.

Complaints

If you think we are processing your data in breach of the law, please tell us first, so we can fix it. You also have the right to complain to a supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, Romania, website dataprotection.ro. You may also complain to the authority in the EU country where you live or work.

Automated decisions

We do not take decisions about you based only on automated processing that have legal effects on you or similarly significantly affect you (GDPR art. 22). We do use automatic checks to run the service, for example to limit the number of requests, to tell bots from people, and to allow one trial per person. If one of them blocks you by mistake, write to us and a person will look at it.

Cookies and similar technologies

  • Marketing pages. Our marketing pages set no cookies.
  • Account pages. When you sign in, we set one session cookie so that you stay signed in. Its name starts with __Host-, it is HttpOnly (scripts on the page cannot read it), and it lasts 30 days. It is strictly necessary for the service that you ask for. Under Romanian law that implements Article 5(3) of the ePrivacy Directive (Law 506/2004), such a cookie does not need your consent. This is why there is no cookie banner.
  • Bot check. On the sign-in page, Cloudflare Turnstile runs in your browser to tell you from a bot. It processes your IP address and browser signals. It is needed to protect sign-in.
  • Payment pages. The Stripe pages that open from our site are run by Stripe. Their own cookie rules apply there.
  • Statistics. We use no analytics tools and no tracking cookies.
  • In the app. Hektro keeps a device key and a sign-in token on your Mac. The private device key never leaves your Mac.

Children

Hektro is a professional tool for developers and is not directed at children. If you think a child has given us personal data, write to support@hektro.com and we will delete it.

Security

We protect your data with measures that include hashing session and code tokens, a device key that never leaves your Mac, rate limits, bot checks, and encrypted backups. No system is completely secure. If a personal data breach puts you at risk, we will tell you and the authority as the law requires.

Changes to this policy

When we change this policy, we change the date at the top. If a change is important, we tell you by email in advance.