Privacy Policy

This Privacy Policy describes what personal data GUIMIN ZHOU ("we", "us", "Huginara") collects, why we collect it, who else processes it, how long we keep it, and the rights you may exercise over it. It also marks the boundary between data we control and data Paddle controls. The controller for service data is GUIMIN ZHOU; the controller for payment data is Paddle (see §1).

The "Service" means the website at huginara.com and the desktop applications we publish — Heimdall (paid) and the free tools Bifrost and Signet. The applications run on your own machine. The marketing website is static; the Heimdall purchase portal uses passwordless email sessions for buying, viewing keys, and preparing offline activation responses.

Summary

• The Heimdall portal uses passwordless email sign-in. We store no passwords; one-time login tokens are hashed and short-lived.
• The desktop applications contain no analytics or telemetry and never transmit captured traffic, certificates, rules, or settings to us. Heimdall sends a licence key and random installation UUID only when you activate directly online; the file flow lets an air-gapped installation use another machine instead.
• When you buy Heimdall, Paddle takes the payment as Merchant of Record. We never receive the full card number, CVV, or BIN.
• We do not use advertising trackers or cross-site analytics, and we do not sell or rent personal data.
• Questions and data requests go to support@huginara.com.

1. Independent data controllers

Because Huginara sells through Paddle as Merchant of Record, two parties process personal data about a purchase, each as an independent data controller. Neither acts as the other's processor in respect of that data.

• Huginara controls service data. A small set: website request logs, any correspondence you send us, and the order metadata Paddle returns after a sale — your email address, an order reference, the product purchased, and the billing country used for tax. Detailed in §2.
• Paddle controls payment data. This includes the full card number, CVV, BIN, fraud-risk score, and the billing address used to calculate tax. Paddle's processing is governed by Paddle's privacy policy. We do not receive this data.

Practical consequence: requests about service data come to us; requests about payment data go to Paddle. If a request reaches the wrong party, we will redirect it and confirm.

2. Categories of personal data we collect

• Website log data. When you visit huginara.com, our CDN / edge provider receives your IP address, user agent, referrer, and the paths requested, together with timestamps and security events such as rate-limit triggers. We use aggregate counts (requests, country, referrer) to understand how the site is used.
• Correspondence. If you email us, we hold your message and address until the matter is resolved and for a reasonable period afterwards as a record.
• Order metadata received from Paddle. After a purchase, Paddle returns your email address, an order or transaction reference, the product, and the billing country for tax records. This is the only payment-adjacent data we hold, and we use it to deliver and support your licence.
• Portal account and authentication data. We process the email you enter, hashed one-time-login and session tokens, session expiry, request IP for abuse prevention, and the Paddle customer / transaction identifiers needed to show the correct licence key. Licence keys are generated when needed and are not stored in our database.
• Activation metadata. When Heimdall is activated, we process the licence key, its derived key ID, a random installation UUID, and activation / last-seen timestamps. The UUID is generated by the app and is not a hardware fingerprint. We do not receive captured traffic, certificates, rewrite rules, or files.
• Cookies and local storage. The purchase portal uses a strictly necessary HttpOnly session cookie; the marketing site stores your light/dark theme preference locally. No advertising cookies or cross-site trackers are used.

After a Heimdall installation receives a valid signed activation response, it verifies that response locally and does not make background licence calls. Direct online activation sends the key and installation UUID over TLS; offline activation sends the same request through the file you choose to upload from a connected machine.

3. Purposes and lawful bases

Under the GDPR and UK GDPR we rely on the following lawful bases:

• Performance of a contract (Art. 6(1)(b)) — to deliver and support a Heimdall licence you have purchased.
• Legitimate interests (Art. 6(1)(f)) — to serve and secure the website, prevent abuse, and understand aggregate usage. We collect only what is proportionate.
• Legal obligation (Art. 6(1)(c)) — to keep the records tax and accounting law require; the tax side is handled by Paddle as Merchant of Record.

The standards on this page are designed to meet or exceed the GDPR, UK GDPR, and CCPA.

4. Recipients of personal data

We do not sell or rent personal data. To operate the Service we rely on a limited set of third parties, identified by their legal role.

Independent data controller — holds a direct relationship with you under its own policy:

• Paddle.com Market Ltd — Merchant of Record; processes payment and tax data. See Paddle's privacy policy.

Sub-processors — process service data on our instructions only:

• CDN and edge-security provider — content delivery, DNS, and DDoS / bot mitigation for the website. Receives request metadata such as IP address and headers.
• Transactional email — sends one-time Huginara portal sign-in links and support replies. Licence keys are never included in email.

We disclose data to public authorities only where legally required, or where necessary to protect the rights, safety, and property of Huginara, our users, or others.

5. International data transfers

Our providers may operate in jurisdictions including the United States and the European Economic Area. Where personal data is transferred out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable). A copy of the applicable clauses is available on request to support@huginara.com.

6. Retention periods

• Website logs: retained for up to 90 days for security and diagnostics, then deleted.
• Correspondence: retained while a matter is open and for a reasonable record period afterwards.
• Order metadata: retained as long as tax and accounting law require (up to 7 years in some jurisdictions). Paddle retains the underlying tax records under its own policy.
• Portal authentication: one-time links expire after 15 minutes; portal sessions expire automatically and can be revoked by signing out.
• Licence and activation metadata: retained while needed to deliver the lifetime licence, prevent unauthorised activation, and handle refunds or chargebacks.

7. Your rights

Depending on where you reside, you may have the rights to access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your supervisory authority (for example the UK ICO, the Irish DPC, or the data-protection authority of your country).

To exercise any of these, write to support@huginara.com. We respond within 30 days and may ask you to verify your identity first. For payment data held by Paddle — the full card number, billing address, and fraud-risk data — direct the request to Paddle via its privacy policy; if it reaches us, we forward it and confirm.

8. California residents (CCPA / CPRA)

California residents have the right to know the categories of personal information we collect and why (§2 and §3), to access and delete it, to correct it, and not to face discrimination for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA and CPRA, and we do not use it for cross-context behavioural advertising. Requests go to support@huginara.com.

9. Children

The Service is not directed to children under 13 (or under 16 where local law requires it), and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact support@huginara.com and we will delete it.

10. Security

The websites and activation API are served over TLS. Portal sessions use HttpOnly, Secure, SameSite cookies; one-time login and session tokens are stored as hashes. We hold very little personal data, and we never handle raw card data — that is administered by Paddle under its PCI-DSS regime, so our systems are out of PCI scope. No system is perfectly secure; if we become aware of an incident that materially affects your data, we will notify you and the relevant authorities as required by law.

11. The desktop applications

Heimdall, Bifrost, and Signet run their product functions on your own machine. They contain no analytics or telemetry. Heimdall is a network-inspection tool: the traffic it captures, the certificates it handles, and the files it writes stay on your computer and are never transmitted to us. A new Heimdall installation obtains a signed response either directly from the activation API or through the offline file flow; afterwards it verifies the response locally without background calls. We therefore hold no usage or captured-traffic data, but we do hold the random installation UUID and licence metadata described in §2.

12. Changes to this Privacy Policy

We may update this Policy. The "Last updated" date above reflects the current version. For changes that materially affect your rights, we will note them here and, where we hold a way to reach you about an order, by email. Continued use of the Service after a change takes effect constitutes acceptance.

13. Contact

Privacy questions and data-subject requests go to support@huginara.com — marking the subject "Privacy" helps with routing. The controller for service data is GUIMIN ZHOU; the independent controller for payment data is Paddle (see §1).