Privacy Policy | xPGuard

This policy explains what personal data xPGuard collects when you use xPGuard, why, and the choices you have.

Data we collect

Account data: name, email address, company, billing country and address, password (stored only as a hash).
Order data: plans, invoices and payment status. Card or wallet details are handled by the payment provider; we do not store them.
Server data from the agent: hostnames, IP addresses, operating system and software versions, metrics, security detections, file paths and samples of malicious files, firewall and WAF logs that include visitors' IP addresses and requested URLs.
Website usage: technical logs (IP address, browser, pages visited) and the cookies described in our Cookie Policy.

Why we use it

To provide the Service: protect your servers, show your dashboard, send alerts.
To process orders, licences and renewals and to send account emails.
To improve detection: attack sources and malware samples help protect every customer (IP reputation is shared between protected servers).
To prevent fraud and abuse and to meet legal obligations.

Legal bases

Performance of our contract with you, our legitimate interest in keeping servers secure, your consent where required, and legal obligations (for example tax records).

Sharing

We do not sell personal data. We share it only with providers that help us run the Service (hosting, email, payment processing such as Cryptomus), under contracts that protect it, or when the law requires it.

Retention

Account and billing records are kept while your account is active and as long as tax law requires. Security logs are kept for limited periods you can configure; detections and samples may be kept longer to improve protection.

Security

Agents connect over TLS with signed keys; passwords are hashed; access to data is limited to people who need it.

Your rights

You can access, correct, export or delete your personal data, and object to or restrict some processing. Write to support@xpguard.org. You can also complain to your data protection authority.

Changes

We will post changes on this page and update the date below.

Last updated: 6 October 2026