Privacy Policy

This Privacy Policy explains how WAF Cybersecurity, a sole proprietorship (“WAF Cybersecurity,” “we,” “us”) collects, uses, and protects information when you use our managed WAF service at www.wafcybersecurity.com (the “Service”).

1. Information We Collect

Account information

When you create an account we collect your email address and a securely hashed version of your password. We never store your password in plain text. If you sign in with Google or Apple, we receive the verified email address those providers share with us (and nothing else we persist).

Billing information

Payments are processed by Stripe. We do not collect or store your full card number; Stripe handles card data under its own security and privacy practices. We retain billing metadata such as your subscription status, plan, and invoice records.

Website & configuration data

To provide the Service we store the domains you protect, your DNS and certificate configuration, and the firewall rules applied to each site.

Traffic & security log data

As your visitor traffic passes through the WAF, we process request metadata to filter attacks and show you traffic and blocked-event statistics. WAF logs keep the visitor’s IP address (including X-Forwarded-For), timestamp, requested path, method, country, user agent, and which rule matched. Visitor IP addresses can be personal data. Before a request is logged, we replace the query string, the request body, and common credential headers (including Authorization, Cookie, Referer, API key, CSRF token, and webhook signature headers) with a placeholder. A custom secret header with another name, or a token placed in the URL path itself, is not replaced unless you ask us to add it.

2. How We Use Information

• To provide, operate, secure, and improve the Service;
• To provision and manage your WAF, SSL certificates, and DNS;
• To bill you and process payments;
• To send service, security, and account communications, including attack-spike alerts and password resets;
• To provide support and respond to your requests; and
• To comply with legal obligations and enforce our Terms.

3. How We Share Information

We do not sell your personal information. We share information only with service providers (“subprocessors”) that help us run the Service:

• Amazon Web Services (AWS) — hosting, WAF, CloudFront, DNS, and log storage;
• Stripe — payment processing;
• Amazon SES — transactional email delivery;
• Google, Apple, and Facebook — optional sign-in with those accounts; and
• AI model providers — Amazon Bedrock (AWS), and when configured xAI, OpenAI, or Anthropic, which write the plain-language explanation shown with a rule recommendation.

For that explanation we send the rule name, hit counts, and one sample request method and path with the query string removed. We do not send visitor IP addresses, headers, or request bodies to AI model providers.

We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a business transfer.

4. Cookies & Sessions

We use only essential first-party cookies: your sign-in session, a short-lived MFA step, and short-lived cookies that remember where to send you after sign-in, an invitation, or checkout. We do not use third-party advertising or tracking cookies.

5. Data Retention

We retain account and configuration data for as long as your account is active. WAF request logs are deleted automatically 30 days after they are written. When you close your account, we delete or de-identify your data in the ordinary course, except where we must retain certain records (for example, billing records) to meet legal obligations.

6. Security

We protect your information using industry-standard measures, including encryption in transit, hashed passwords, encrypted backups, and least-exposure storage. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your Rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, or to object to certain processing (for example under the California Consumer Privacy Act or the EU/UK GDPR). To exercise any of these rights, email us at support@wafcybersecurity.com. We do not sell personal information.

8. International Users

The Service is operated in the United States, and information is processed and stored on AWS infrastructure primarily in the United States. By using the Service, you understand that your information will be processed in the United States.

9. Children

The Service is not directed to children and is intended for users 18 and older. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and, where appropriate, notify you of material changes.

11. Contact

Questions about your privacy? Email us at support@wafcybersecurity.com.