Privacy Policy

Last updated:

2026-10-04

We take the confidentiality of your personal data seriously. This policy explains what we collect when you use our website, why we collect it, what our legal basis is, who we share it with, how long we keep it, and what rights you have - in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR where they apply to you, and with the Israeli Protection of Privacy Law, 5741-1981.

1. Scope

1.1 Who we are. The controller of the personal data described in this policy is FHE Labs Ltd., a company incorporated under the laws of the State of Israel whose registered office is at 82 Yigal Alon Street, Tel Aviv, Israel ("FHE Labs", "we", "us", "our").

1.2 What this policy covers. This policy applies to the website at fhenix.io and its subdomains (the "Website"), including our documentation pages, our product landing pages, and the demonstration applications we publish. It also covers personal data we receive when you contact us, subscribe to updates, apply for a role, or apply to build with our technology.

1.3 What this policy does not cover. It does not cover applications that are hosted outside fhenix.io. We are not the controller of the personal data such applications collect, including any identity verification or sanctions screening carried out at the product layer. It also does not cover third-party sites we link to, such as code repositories or community platforms, which are covered by their own policies.

‍

2. Definitions

"Personal data" - Any information relating to an identified or identifiable natural person.

"Processing" - Anything done with personal data - collecting, storing, using, disclosing, or deleting it.

"Controller" - The party that decides why and how personal data is processed. For the Website, that is FHE Labs.

"Processor" - A party that processes personal data on our instructions and for our purposes.

"Independent controller" - A party that receives personal data and decides its own purposes for it. Its own policy governs what it does.

"Demo" - A demonstration application published on a fhenix.io subdomain.

"Wallet address" - A public blockchain address. We treat it as personal data where it can reasonably be linked to you.

‍

3. What We Collect and How

We collect personal data in the following ways. We do not buy personal data, and we do not intentionally collect special categories of personal data as defined in GDPR Article 9 through the Website.

How we collect it	What we collect	Source
You visit the Website	IP address, approximate location derived from it, device and browser type, pages viewed, referring page, time of visit.	Automatically, via server logs and — with your consent — analytics cookies.
You contact us	Name, email address, company or project, and whatever you choose to tell us in your message.	From you.
You subscribe to updates	Email address, and the record of your subscription and any later opt-out.	From you.
You apply for a role	Name, contact details, city, CV, LinkedIn, work history, and anything else in your application.	From you, or from a recruitment platform acting for us.
You apply to build with us	Name, contact details, organization, project description, technical details you provide.	From you.
You use a Demo	Public wallet address, the network you connect to, and the transactions you sign in the Demo.	From your wallet, when you choose to connect it.
You interact with us on a public platform	Your username or handle and what you post, where you post it to us on GitHub, Discord, Telegram, or X.	From that platform, publicly.

Wallet addresses and the blockchain. When you connect a wallet to a Demo, we may process your public wallet address. Where that address can reasonably be linked to you, it is personal data and this policy applies to it. You should understand two things about blockchains before you use a Demo. First, a transaction you sign is written to a public blockchain that we do not control and cannot alter. Second, that record is permanent: we cannot delete, correct, or restrict it, nor instruct any third party to do so. If you ask us to erase your data, we will consider and respond to such requests in accordance with applicable data protection law, including any applicable rights and exceptions , but we cannot erase data that already exists on a public chain. This is a limit on your rights that follows from the technology, not from our policy, and it is one reason Demos are intended for test networks with test assets only.

‍

4. Why We Process It, Our Legal Basis, and How Long We Keep It

Purpose	Data used	Legal basis	Retention
Operating and securing the Website	Technical and log data	Legitimate interest, Art. 6(1)(f), in running a secure service	12 months, unless a longer period is required for security investigations, legal claims or applicable law
Understanding how the Website is used	Analytics data	Consent, Art. 6(1)(a) where required	Event-level data for 2 months; user-level records for 14 months after your most recent activity; or until consent is withdrawn, whichever comes first
Responding to inquiries and communications	Contact data and message content	Legitimate interest, Art. 6(1)(f), in responding to people who contact us	24 months after last contact
Sending you updates and other communications you have requested	Email address and subscription records	Consent, Art. 6(1)(a)	Until you opt out, then 1 month, subject to retention of records necessary to demonstrate compliance or honor your opt-out
Considering your job application	Application data	Pre-contractual steps, Art. 6(1)(b), while your application is live; legitimate interest, Art. 6(1)(f), in keeping a record after a decision	24 months after last contact, unless a longer period is required for a legal claim or applicable law
Assessing a request to build with us	Application data	Pre-contractual steps, Art. 6(1)(b)	24 months after our last substantive interaction, unless a longer period is required for a legal claim or other legitimate purpose
Operating and administering the Demos	Wallet address, network, transaction data	Consent, Art. 6(1)(a), given when you connect your wallet	For the duration of the session, except any on-chain record, which may be permanent and outside our control
Engaging with you on public platforms	Username or handle, and the content of what you post to us	Legitimate interest, Art. 6(1)(f), in supporting and engaging with our community	For as long as the post remains available on that platform. We keep our own records of support interactions for 24 months
Measuring our advertising and building advertising audiences	Advertising identifiers, pages viewed, referring source	Consent, Art. 6(1)(a)	Until consent is withdrawn, or the period shown for each item in the Cookie Policy, whichever is earlier
Complying with our legal and regulatory obligations	Information necessary to comply with the relevant legal or regulatory requirement	Legal obligation, Art. 6(1)(c) or, where the obligation arises under a law outside the EU or EEA, legitimate interest, Art. 6(1)(f)	As required by the applicable law
Establishing or defending legal claims	Information relevant to the claim or potential claim	Legitimate interest, Art. 6(1)(f)	Until the relevant claim or potential claim is finally resolved, and for any additional period required by applicable law
Keeping records of consent	Consent history	Legal obligation, Art. 6(1)(c), and legitimate interest	For as long as necessary to demonstrate compliance with applicable data protection law and defend against related claims

Where we rely on legitimate interest, we have assessed that interest against your rights and freedoms and concluded it does not override them. You can ask us for that assessment, and you can object to the processing - see Section 11.

4.1 No automated decision-making. We do not make decisions about you on the Website by solely automated means that produce legal or similarly significant effects for you, within the meaning of GDPR Article 22.

‍

5. Who Receives Your Personal Data

5.1 Processors. These providers process personal data on our instructions and only for our purposes. They are bound by written terms that require them to keep it secure and not to use it for anything else.

Recipient	What they do	Location	Transfer mechanism
Webflow, Inc. (hosting on Amazon Web Services)	Hosting and delivery of the Website	United States	EU–US Data Privacy Framework; EU Standard Contractual Clauses where the Framework does not apply
Google Ireland Limited, with onward transfer to Google LLC	Tag management and website analytics	Ireland and United States	EU–US Data Privacy Framework; Standard Contractual Clauses as fallback
Intuit Inc. (Mailchimp)	Mailing-list sign-up, contact management, and updates	United States	EU–US Data Privacy Framework; Standard Contractual Clauses as fallback
Usercentrics A/S (Cookiebot)	Cookie consent management and consent records	Denmark	Not applicable — recipient in the EEA

5.2 Independent controllers. Some parties decide their own purposes for data and are not our processors. Their own privacy policies govern what they do. These include the platforms where you may interact with us publicly, such as GitHub, Discord, Telegram, and X; the provider of any wallet you choose to connect to a Demo; Luma and Cloudflare, which serve the events listing embedded on the Website; and Google, in respect of the advertising audience data described in our Cookie Policy. We do not control those platforms and we do not choose their retention or security practices.

5.3 Others. We may disclose personal data to professional advisers, to an acquirer or investor in connection with a corporate transaction subject to appropriate confidentiality, and to a public authority, court, or regulator where we are legally required to do so. We will not disclose more than the request requires, and we will tell you unless we are prohibited from doing so.

5.4 What we do not do. We do not sell personal data. Where you allow marketing cookies, Google and Mailchimp receive information about your visit, as described in our Cookie Policy. We do not do this without your consent, and refusing has no effect on your use of the Website.

‍

6. How Long We Keep It

Retention periods are set out purpose by purpose in the table at Section 4. Two general rules apply on top of them. We delete or anonymize personal data once the purpose it was collected for has been met and no legal obligation requires us to keep it. Where a retention period has expired but the data is relevant to an actual or threatened legal claim, we keep it until that claim is resolved and then delete it.

‍

7. International Transfers

7.1 Where we are. We are established in Israel. If you are in the EEA or the United Kingdom, your personal data is transferred to Israel when you use the Website. Israel is the subject of a European Commission adequacy decision and of equivalent UK adequacy regulations, so that transfer does not require an additional safeguard.

7.2 Onward transfers. Some of the providers in Section 5 are established in the United States or elsewhere. Where a provider is certified under the EU–US Data Privacy Framework, we rely on that Framework, and on the UK Extension where the UK GDPR applies. Where a provider is not certified, or the Framework does not cover the transfer, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum. The mechanism for each provider is stated in the table at Section 5.

7.3 Copies. You can ask us for a copy of the safeguards we rely on for any particular transfer, by writing to the address in Section 11.

‍

8. How We Protect It

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls limiting who can see personal data to those who need it, logging, and supplier due diligence. No system is perfectly secure, and we do not claim otherwise. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority as required by applicable law. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay.

‍

9. Children

The Website is not directed at children, and you must be at least 18 to use it. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to us at the address in Section 11 and we will delete it.

‍

10. Cookies

We use cookies and similar technologies, including local storage. Our Cookie Policy at fhenix.io/legal/cookie-policy explains what we use, in which category, on what legal basis, and for how long, and how to change or withdraw your choices at any time. Nothing outside the strictly necessary category is set before you choose to allow it.

‍

11. Your Rights and How to Contact Us

Where the GDPR or UK GDPR applies to you, you have the following rights.

Right	What it means
Access	Ask what personal data we hold about you and get a copy of it.
Rectification	Have inaccurate data corrected or incomplete data completed.
Erasure	Have your data deleted where one of the grounds in Article 17 applies. See the note at Section 3 about on-chain records.
Restriction	Ask us to stop using your data while a dispute about it is resolved.
Objection	Object to processing based on legitimate interest. Where we process for direct marketing, your right to object is absolute and we will stop.
Portability	Receive data you gave us in a machine-readable format, where processing is based on consent or contract and carried out by automated means.
Withdraw consent	Withdraw consent at any time, as easily as you gave it, without affecting processing already carried out.
Complain	Lodge a complaint with a supervisory authority — see Section 12.

11.1 How to exercise them. Write to legal@fhenix.io. We will respond within one month. If your request is complex or you have made several, we may extend that by a further two months and will tell you why within the first month. We may ask you for enough information to confirm your identity, and only for that purpose. Exercising your rights is free unless a request is manifestly unfounded or excessive.

11.2 Data protection contact. FHE Labs Ltd., 82 Yigal Alon Street, Tel Aviv, Israel. legal@fhenix.io. Data protection contact: Yonathan Bartana, Adv.

‍

12. Additional Information for Specific Jurisdictions

12.1 European Economic Area. The GDPR applies to our processing of your personal data where we offer the Website to you in the EEA. You may complain to the supervisory authority in the Member State of your habitual residence, place of work, or the place of the alleged infringement.

12.2 United Kingdom. The UK GDPR and the Data Protection Act 2018 apply where we offer the Website to you in the United Kingdom. You may complain to the Information Commissioner's Office.

12.3 Israel. The Protection of Privacy Law, 5741-1981 and the regulations made under it apply to us as an Israeli company. You may contact the Privacy Protection Authority.

12.4 California. If you are a California resident, the CCPA as amended by the CPRA gives you rights to know, delete, correct, and opt out of sale or sharing. We do not sell personal information. We do share it for cross-context behavioral advertising where you have allowed marketing cookies, and you can opt out at any time using the Cookie preferences link in the footer of any page. We will not discriminate against you for exercising a right. Use the contact details in Section 11.

‍

13. Changes to This Policy

We may update this policy. Each version carries an effective date at the top, and superseded versions remain available on request. Where a change is material we will publish notice of it on the Website at least 14 days before it takes effect. If a change means we want to use your personal data for a new purpose that needs your consent, we will ask you again rather than relying on a consent you gave earlier.

‍