PRIVACY PROTOCOL

LAST UPDATED: 2026-06-17

00. WHO WE ARE

Crossfyre is operated by Clickswave Labs Private Limited, a company incorporated in India and based in Vadodara, Gujarat. In this policy "we", "us", and "Crossfyre" refer to Clickswave Labs Private Limited, which acts as the Data Fiduciary for the personal data described below.

This policy explains what we collect, why, who we share it with, and the rights you hold under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). For any privacy question or request, contact our Grievance Officer at [email protected].

01. DATA WE COLLECT

We operate with a minimal footprint philosophy and collect only what is needed to run the platform and bill for it:

  • Account data: name, email, and authentication credentials (hashed and salted).
  • Billing data: subscription plan, payment status, and the partial transaction records returned to us by our payment processor. We never store your full card details.
  • Operational data: audit logs of scanning activity, node and extension configuration, and basic request logs (IP, timestamp, user agent) kept for security and debugging.
  • Target and reconnaissance data you generate through the platform.

02. WHY WE USE IT

We process your data to create and secure your account, deliver the service you signed up for, process payments and renewals, maintain audit trails, prevent abuse, and meet our legal obligations. We process this data on the basis of your consent and of the contract between you and us. Where we rely on consent, you may withdraw it at any time (see section 05).

We do NOT sell or rent your personal data. Your reconnaissance and target data stays your own and is never used to train external models or shared for advertising.

03. WHO WE SHARE IT WITH

We share data only with processors who help us run the service, and only to the extent each one needs:

  • Razorpay, for payment processing and subscription billing.
  • Cloudflare, for hosting, content delivery, and object storage.
  • Amazon Web Services, for compute and infrastructure.
  • Our transactional email provider, for account and billing notifications.

Each processor handles your data under its own terms and applicable law. We may also disclose data where required by a valid legal order, or to protect the rights and safety of our users and our network.

04. HOW LONG WE KEEP IT

We retain account and billing data for as long as your account is active, and afterwards only as long as needed to meet tax, accounting, and legal requirements under Indian law. Audit and operational logs are kept for a limited period for security and then deleted or anonymised. When data is no longer needed for any of these purposes, we erase it.

05. YOUR RIGHTS

Under the DPDP Act you have the right to access a summary of your personal data, to ask us to correct or complete it, to request its erasure, to withdraw consent, and to nominate another person to exercise your rights in the event of death or incapacity. You may also raise a grievance with us.

To exercise any of these, email [email protected] from the address on your account. We will respond within the timelines set by law. Withdrawing consent does not affect processing already carried out, and some data may be retained where the law requires it.

06. OPERATIONAL SECURITY

Data in transit is encrypted via TLS 1.3. Data at rest is protected using AES-256 encryption. We use ephemeral instances where possible to minimise data persistence. No method of transmission or storage is perfectly secure, so the confidentiality of your target data also depends on your own practices. You are responsible for keeping your API keys and access tokens secret.

07. COOKIES AND TRACKING

We use a single session cookie for authentication. We do not run third party tracking pixels or advertising cookies, and we respect the Do Not Track (DNT) signal.

08. CHILDREN

Crossfyre is not intended for anyone under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will remove it.

09. GRIEVANCE OFFICER

In line with the DPDP Act and the Information Technology Rules, you can reach our Grievance Officer for any privacy concern or complaint:

  • Officer: Dikshant Chandel, Founder
  • Entity: Clickswave Labs Private Limited
  • Location: Vadodara, Gujarat, India
  • Email: [email protected]

10. CHANGES

We may update this policy as the service or the law evolves. Material changes will be reflected by the "Last updated" date above, and significant changes affecting your rights will be notified to your account email.