Privacy Policy

1. Our role

For your account data, identity data, payment data and console usage records we are the controller.

For the content you deliver to your end users through IXCDN and the access logs it generates, you are the controller and we process it as your processor under your configuration and the Terms of Service.

2. Information we collect

• Account data: email, password (hash only), organization name, phone number, two-factor secret (encrypted) and recovery codes (hash only).
• Identity and invoicing data: legal name, ID type and number, company name, registration number, legal representative, business address, invoice title, tax number, bank and account number. ID numbers are stored encrypted and never shown in clear in the console.
• Payment data: top-ups and subscriptions are handled on Stripe-hosted pages; we never see full card numbers. We keep the card brand, last four digits, expiry, transaction numbers, amounts and status.
• Service configuration: domains, origins, cache and security policies, certificates (private keys encrypted), DNS records, site files and storage settings.
• Access logs: for requests through the edge network, the client IP, time, domain, path, status code, User-Agent, bytes, cache status, WAF verdict and node.
• Console usage: sign-in time and IP, operation audit log, session identifiers and client error reports (never passwords or secrets).
• Node affiliate data: entity type and name, contact person, phone, address, facility and network details, GPU details, evidence files, settlement currency, and node hardware, network and load metrics.

3. How we use it

• Providing the service: resolving and forwarding requests, caching, issuing certificates, distributing configuration.
• Billing: metering usage, generating bills and ledger entries, processing top-ups and refunds, compliant invoicing.
• Security and anti-abuse: mitigating attacks, WAF and rate limiting, detecting account takeover, auditing operations.
• Compliance review: identity verification, business verification, node affiliate acceptance.
• Support and communication: tickets, service notices, maintenance and change announcements, billing reminders.
• Service improvement: aggregate performance, hit-ratio and error statistics, never individual profiling or advertising.

We do not sell personal information and do not use it for marketing unrelated to the purposes above.

4. Cookies and local storage

The website and console mainly use browser local storage for sign-in sessions and interface preferences, and only strictly necessary cookies. See the Cookie Notice for the full list and how to manage them.

5. Sharing and disclosure

• Payment processor: Stripe (payments, saved cards and the hosted billing portal).
• Edge node partners: they only perform technical processing of the content you configured for delivery and of access logs; they never receive your account, identity or payment data, and must pass entity and resource acceptance and sign a data processing agreement.
• Infrastructure providers: cloud and data-centre resources hosting the control plane and logs.
• Legal requirements: disclosure to the extent required by law, regulators or courts.
• Business transfers: in a merger, acquisition or asset transfer, under equivalent protection.

6. International transfers

IXCDN edge nodes are located worldwide. Your end users' requests are served at the nearest node, and access logs may be processed briefly there before being aggregated at the control plane. Account, identity and payment data is stored where the control plane is hosted. Where data crosses borders we rely on contractual safeguards and encryption.

7. Retention

• Account and configuration: for the life of the account; 30 days after deletion for recovery, then erased.
• Access logs: for the "log retention" days shown in the plan capability matrix, then purged automatically.
• Audit and security logs: at least 12 months.
• Financial and invoice records: for the statutory period.
• Identity data: deleted within 30 days after account deletion with no open matters, unless the law requires otherwise.

8. Security

TLS everywhere; ID numbers, certificate private keys, payment and storage secrets encrypted with a key-encryption key (KEK); console requests signed with per-session dynamic keys; two-factor authentication; least-privilege internal access with audit logging; vulnerabilities handled under the Security Disclosure Policy.

No system is perfectly secure. If a security incident may affect your rights, we will notify you promptly as required by law.

9. Your rights

In the console you can view and correct your profile, export bills and ledger entries, disable two-factor authentication, cancel plans or request account deletion. You can also exercise access, rectification, erasure, restriction and withdrawal-of-consent rights via support@ixcdn.com; we respond within 15 business days. Withdrawal does not affect processing before it.

10. Minors

IXCDN is intended for businesses and adults. We do not knowingly collect personal information from children under 16 and will delete it if discovered.

11. Changes to this policy

We may update this policy. Material changes are announced 30 days ahead in the console or by email, and the version and effective date at the top are updated.

12. Contact

Privacy questions: support@ixcdn.com (subject "Privacy"). Operator: Wulian Network (WlStack), licence B1-20250064.