Who we are
Bastion Helix is independent software, built and run by an independent developer in Bengaluru, India. Contact: support@bastionhelix.com.
The API and MCP server
What we never keep: request logs, the addresses of the pages your agent asks for, and the pages' content. Pages are read to answer the call and are not stored afterwards.
What we keep, and why:
- Each API key, stored only as a one-way fingerprint (a SHA-256 hash), so we can recognise it without being able to read it.
- The email address of the person who bought credits, to send the key and receipts and to answer support requests.
- The credit balance on each key.
- Order numbers from our payment provider, so a purchase is never credited twice.
- For each key, the number of calls and credits used per tool per day. No addresses or content.
Services that process data for us:
- Cloudflare runs the API (Workers and its database), loads pages that need a browser (Browser Run) and converts pages to Markdown (Workers AI). It processes requests, including IP addresses, to deliver the service.
- Our card payment provider takes payments as the seller of record and receives what you enter at checkout. We receive the order number, the pack bought and your email address, never your card details. The provider is named at checkout.
- Resend sends the email containing your API key.
The websites your agent reads see a request from Agent Lens (or from Cloudflare Browser Run), not from you.
The browser extension
The Agent Lens extension reads a page only after you click its icon on that page. The page check runs in your browser and asks the site for the same page once more without your cookies, to see what a signed-out agent gets. Nothing from the check leaves your browser.
If you set up the optional live test, your Cloudflare account ID and API token are saved only in your browser's own storage on that computer and are sent only to api.cloudflare.com, only when you run a live test. The extension sends nothing to Bastion Helix and has no analytics or tracking.
How long data is kept
Keys, emails and balances are kept until you ask us to delete them. Order records are kept as long as tax law requires. To see what we hold or to have it deleted, write to support@bastionhelix.com. Deleting a key's data ends the key.
Changes
If this policy changes, the new version will be posted here with its date.