Legal

Privacy Policy

Last updated: 9 July 2026

This policy explains what Haxo Pty Ltd, the operator of the hosted POCX service at pocx.dev, collects and why. The short version: we collect the minimum an access-control product needs — identities, signatures and access events — we never sell data, and we run no advertising trackers. If you self-host POCX, nothing described here reaches us at all.

1. Who we are

The hosted POCX service is provided by Haxo Pty Ltd, an Australian company (“Haxo”, “we”). For anything privacy-related, contact pocx@haxo.com.au.

2. Two kinds of people, two roles

POCX handles data about two groups, and our role differs for each:

Operators (you, the workspace owner and your team): we decide how this data is handled — we are the data controller.
Viewers / evaluators (the people your demos are shared with): we process their data on your instructions, as your processor. You are responsible for having a lawful basis to invite them.

3. What we collect

Operator accounts — name, email address, workspace name, and one-time login codes (stored only as hashes; there are no passwords).
Viewer identity & signatures — invited email addresses, OTP request metadata, and for each e-signature: a SHA-256 hash of the exact terms text, timestamp, IP address and user agent, plus the PDF certificate we email to the signer. This evidence is the product — it is what makes a signature defensible.
Access events — logins, denials, revocations and (if you enable SDK event logging) page-view events from your protected app.
Billing — handled by Stripe; we never see or store card numbers.
Operational logs — short-lived server logs (IP, user agent, request path) for security and debugging.

We deliberately see nothing of your demo itself: once a viewer is through the gate, traffic goes directly to your application and does not pass through POCX.

4. How we use it

to run the gate: verify identities, record signatures, enforce sessions and plan limits;
to send transactional email (login codes, signature certificates, product notices) — never marketing without consent;
to keep the service secure (rate limiting, abuse and fraud prevention);
to bill Pro workspaces via Stripe.

We do not sell personal information, and we do not use it for advertising.

5. Cookies

POCX sets only functional cookies:

session cookies (HMAC-sealed) for operator and gate logins;
a locale cookie (pocx_locale) remembering your language choice.

There are no analytics or advertising cookies.

6. Who else touches the data

We use a small set of subprocessors to run the service:

Railway — cloud hosting (application and database);
Resend — transactional email delivery (login codes, certificates) and inbound support email;
Stripe — payments.
MonGPT — the AI support chat on our marketing pages (it processes the messages a visitor types into that chat; it is not present on hosted gates or the dashboard).

These providers may store data outside Australia (typically in the United States). We share only what each needs to do its job.

7. Retention

Signature evidence and audit events are kept for as long as the workspace exists — they are the record your protection relies on.
One-time login codes expire within minutes and are stored only as hashes.
Operational logs are kept briefly and rotated.
When a workspace is deleted, its data is removed from production systems within 30 days (backups age out on their own schedule).

8. Security

Login codes are hashed, single-use and rate-limited; sessions are HMAC-sealed and revocable; access is workspace-scoped and re-checked on every mutation. Security reports go to pocx@haxo.com.au — see the security policy in our GitHub repository.

9. Your rights

We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where the GDPR or similar laws apply to you, you have the corresponding rights under those laws. You can ask us to access, correct, export or delete personal information by emailing pocx@haxo.com.au. If you are a viewer on someone else’s demo, we may refer your request to the workspace owner, since the signature record exists on their instructions.