Privacy Policy

Last updated: October 2026

SXAccess is a Zero Trust network designed to help organizations connect users, devices and resources securely. Network connections are protected using encrypted tunnels, while SXAccess processes only the information needed to operate, manage and secure the service.

This Privacy Policy explains what information we may collect, how we use it, how long we may keep it, and the choices and rights available to you.

Who We Are

SXAccess (“SXAccess”, “we”, “us”) is a company with its registered office at Marina Plaza, Dubai, UAE.

If you have questions about privacy or would like to make a request concerning your personal data, you can contact us at support@sxaccess.com. General support enquiries can be sent to support@sxaccess.com.

What This Policy Covers

This policy applies to the SXAccess website, management console, client applications, APIs and related services.

It does not apply to the systems, applications or infrastructure that customers choose to connect through SXAccess. Those systems remain under the control of their respective owners and may be subject to their own privacy policies and terms.

In some cases, SXAccess may process personal data on behalf of an organization using our service. Where this applies, the organization may act as the controller of that data and SXAccess may act as its processor.

What SXAccess Can See

SXAccess is designed so that network traffic between authorized devices and resources is protected by encrypted connections. The platform does not need to inspect the contents of that traffic in order to coordinate connectivity or apply access rules.

To operate the network, however, SXAccess may process technical information about the connection. This may include device identifiers, public keys, network endpoints, connection status, timestamps and the result of access-rule decisions. The country and city a device connects from are looked up from its public address and shown on the device's page, where location-based device requirements can use them.

The Discovery Service, which helps two devices find a path to each other, only forwards negotiation messages sealed to the receiving device's key and cannot read them.

In situations where a direct connection cannot be established, relay infrastructure may be used to support connectivity. Traffic passing through a relay remains protected by the encrypted connection between the participating endpoints.

What We Collect

When you use SXAccess, we may collect information associated with your account, such as your name, business email address, organization and role. We may also process configuration information created within the platform, including members, service accounts, groups, devices, enrollment keys, resources, access rules, device requirements, routes and DNS settings.

We may collect technical and operational information that helps us run and secure the service. This can include device information, connection metadata, application versions, operating systems, diagnostic information and activity logs related to administrative or access events.

If you contact us for support, we may keep the information you provide and our correspondence with you. We may also receive subscription, transaction and payment-status information from payment providers used to manage billing.

Our website and applications may collect limited usage information to help us understand how the service is being used and to improve its performance and usability.

How We Use Information

We use the information we process to provide and operate SXAccess, authenticate users and devices, coordinate network connections, apply access rules, maintain security and reliability, provide customer support and manage subscriptions.

We may also use information to troubleshoot technical issues, prevent misuse, improve the service and meet our legal or contractual obligations.

We do not sell personal data.

Legal Basis for Processing

Where privacy laws such as the GDPR require us to identify a legal basis for processing personal data, we may rely on the performance of a contract, our legitimate interests in operating and protecting the service, compliance with legal obligations, or your consent where consent is required.

The legal basis that applies will depend on the type of information and the purpose for which it is processed.

Who We Share Information With

We may use third-party service providers to help operate SXAccess, including infrastructure, communications, support and payment services. These providers may process information where necessary to provide their services to us.

We may also disclose information when required to comply with applicable law, respond to a valid legal request, protect the service or its users, or as part of a merger, acquisition or other business transaction.

Where Information Is Processed

SXAccess and its service providers may process information in countries other than the country where you are located. Where applicable law requires additional safeguards for international transfers of personal data, we take appropriate measures to support those transfers.

How Long We Keep Information

We keep information for as long as reasonably necessary to provide and secure the service, support our customers, meet contractual requirements and comply with applicable law.

The exact retention period may vary depending on the type of information, the customer's service configuration and any legal or operational requirements that apply.

How We Protect Information

We use technical and organizational measures intended to protect the information processed through SXAccess. These measures may include encryption, authentication, access controls, logging, monitoring and other security practices appropriate to the service.

No online service can guarantee absolute security, but we work to reduce the risk of unauthorized access, misuse, loss or disclosure of information.

Your Rights

Depending on where you live, you may have rights concerning your personal data. These may include the right to request access to your information, correct inaccurate information, request deletion, restrict or object to certain processing, or request a copy of your data.

If you would like to exercise a privacy right, contact us at support@sxaccess.com.

If the information is processed by SXAccess on behalf of one of our customers, that customer may be responsible for responding to your request.

Account and Data Deletion

This section explains how to request deletion of your SXAccess account access and the data associated with it, for both the SXAccess mobile app and the management console.

How to request deletion

You can register an SXAccess account yourself, sign in with Google SSO, or join an organization by invitation. Access to an organization and its network is managed by that organization's administrators. To remove access or request deletion:

1. Organization administrators can deprovision a user or device at any time from the SXAccess management console. That immediately revokes the user's or device's access to organization resources.
2. Individual users who want their SXAccess account access and associated data removed, or who no longer have access to their organization's console, can email support@sxaccess.com with the subject Account Deletion Request, their organization name and their account email. We confirm the request and process it directly, or coordinate with your organization administrator, since organization accounts are owned by the customer organization.

What is deleted

Upon a verified deletion request, we delete or anonymize:

• Account and profile information: name, business email, organization and role
• Device enrollment records associated with the requester: device identifiers and application version
• Connection metadata and diagnostic and activity logs tied to the requester, where not required for the retention purposes below

What may be retained, and for how long

As described under How Long We Keep Information, we keep information for as long as reasonably necessary to provide and secure the service, support our customers, meet contractual requirements and comply with applicable law. Some records may therefore be retained for a limited period after a deletion request, even after the account and device data above are deleted: for example security and audit logs, or data your organization is contractually required to retain. Retention periods vary by data type and by the requesting organization's service configuration. Contact support@sxaccess.com for the specifics that apply to your account.

Cookies

SXAccess may use cookies and similar technologies that are necessary to provide authentication, session security and other essential website or application functions.

We may also use optional analytics technologies to help understand how our services are used, subject to applicable privacy requirements.

Children

SXAccess is intended for organizations and business users and is not designed as a service for children.

Changes to This Policy

We may update this Privacy Policy from time to time as our services, business practices or legal requirements change. When we make changes, we will publish the updated version and revise the date shown at the top of this page.

Contact

SXAccess, Marina Plaza, Dubai, UAE.

For privacy matters and for general support, contact support@sxaccess.com.