Privacy policy
Last updated: 7 September 2026
This policy explains what personal information Youssef Elwakil, trading as Hesn — a sole trader based in Victoria, Australia ("Hesn", "we", "us") — collects when you use the service and the hesn.app website, why, and what you can do about it.
Hesn is a DNS filter. To decide whether to block a request, our resolver necessarily sees the domain names your device looks up while filtering is on. This is the core of how the product works. We keep this data for as long as it's useful to run the filter and the accountability features, and no longer. The detail is below — please read it before you sign up.
1. Information we collect
| Data | Why |
|---|---|
| Your email address | Account identity, sending your setup link, service notices, support. |
| Your accountability partner's email address | To send them the periodic activity summary and tamper alerts you signed up for. |
| Subscription & payment status | Held by Paddle (our payment processor) and shared back to us as status only. We do not receive or store your card number. |
| Device filtering configuration | A unique setup token, your chosen strictness tier, and the platform of the device, so the resolver applies the right rules. |
| DNS query data | The domains your device requests while filtering is on, with timestamps and which of your devices asked. Used to enforce the filter, to compile the statistics and accountability summaries, and to investigate wrongly-blocked sites. |
| Website & technical logs | Standard server logs (IP address, request time, user agent) for security and debugging. |
We do not run third-party advertising or analytics trackers on the website, and we do not sell personal information to anyone.
2. How we use it
- To operate the filter and the accountability layer you're paying for.
- To send you your setup link, service and security notices, and replies to your support requests.
- To send your accountability partner the summaries and alerts that are the point of the service.
- To keep the service secure and to diagnose faults.
- To meet legal, tax and accounting obligations.
Our lawful bases (where the GDPR or UK GDPR applies) are: performance of our contract with you; our legitimate interest in running and securing the service; and, for the accountability partner arrangement, your consent, which you give when you enter their address.
3. Who we share it with
We use a small number of service providers ("subprocessors") to run Hesn. They act on our instructions and only get the data they need:
| Provider | Purpose | Location |
|---|---|---|
| Paddle | Payments, billing, invoicing, tax — Merchant of Record | UK / EU / US |
| DigitalOcean | Hosts the filtering DNS resolver | Sydney, Australia |
| MongoDB Atlas | Application database (accounts, config) | Singapore |
| Render | Backend application hosting | Singapore |
| Netlify | Website hosting / CDN | Global CDN |
| Resend | Sends transactional and accountability emails | US |
We also disclose information if the law requires it, to enforce our terms, or to protect the rights and safety of people using Hesn.
4. International transfers
Hesn's infrastructure is outside Australia, including in Singapore, the United States and the EU/UK. Where we transfer personal information across borders we rely on the recipient being in a country with comparable protection or on standard contractual clauses. By using Hesn you acknowledge these transfers.
5. How long we keep it
- DNS query data: retained for up to 90 days on a rolling basis, then deleted or aggregated into non-identifying statistics.
- Account and configuration data: kept while your subscription is active and for up to 12 months after it ends, then deleted.
- Billing records: kept by us and by Paddle for as long as tax and accounting law requires (generally up to 7 years).
- Support emails: kept up to 24 months.
6. Your rights
You can ask us to give you a copy of the personal information we hold about you, correct it, or delete it, and you can withdraw consent for the accountability partner emails at any time (this ends that part of the service). To do any of these, email hello@hesn.app from your account address. We'll respond within 30 days.
If you're in Australia and unhappy with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au). If you're in the EU or UK, you can complain to your local data protection authority.
7. Security
Data is encrypted in transit (HTTPS, DNS-over-HTTPS). Access to production systems is limited and authenticated. No system is perfectly secure; if a breach affects you we'll notify you and the relevant regulator as the law requires.
8. Children
Hesn is bought by adults. Where a parent or guardian sets Hesn up on a child's device, the parent or guardian is the account holder and is responsible for that child's information within the service.
9. Changes
If we change this policy materially we'll email account holders and update the date at the top. Continued use after that means you accept the change.
10. Contact
Privacy questions or requests: hello@hesn.app.
Data controller: Youssef Elwakil (sole trader), trading as Hesn, Victoria, Australia.