Last updated 17 October 2026
This policy explains how VTEK Solutions Ltd, trading as Firewall Migrate (“we”, “us”), handles personal data when you visit firewallmigrate.com or use Firewall Exit Suite at app.firewallmigrate.com (the “Service”).
Data controller: VTEK Solutions Ltd (trading as Firewall Migrate), a company registered in England and Wales with company number 08513688. Registered office: 103, Crown House, North Circular Road, Park Royal, London, England, NW10 7PN. We are the controller of this personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For any privacy question or request, email support@firewallmigrate.com.
1. Your firewall configurations stay in your browser
Parsing, conversion, analysis, validation and export run entirely in your browser tab. Configuration text, hostnames, IP addresses, object and rule names, and secrets are never uploaded to us, logged or stored. The app’s security policy only allows it to talk to its own server, and that server’s interface does not accept configuration content.
To license exports, the app sends only:
- a one-way fingerprint of the configuration (computed in your browser from stable facts such as the hostname and interface addresses; the facts themselves are not sent), so that the same firewall can be recognised again;
- for migrations and NSX, a one-way hash of the normalised configuration text, which we store only in a further keyed (HMAC) form tied to your account;
- rule and device counts, the size tier and the product used.
These values cannot be turned back into your configuration.
2. Personal data we process
| Data | Why we use it | Lawful basis |
|---|---|---|
| Your email address and account record (account ID, dates) | To create your account, send sign-in codes, and link your purchases, credits, unlocks and plans to you | Contract |
| Purchase and subscription records: products, credits, plan, quantities, billing periods, payment status, refunds and disputes, and your Stripe customer reference | To provide what you paid for, enforce allowances, and keep accounting records | Contract; legal obligation (tax and accounting records) |
| Billing details you give Stripe at checkout (name, billing address, VAT number, payment card) | To take payment and calculate VAT. Stripe processes card details; we never see full card numbers | Contract; legal obligation |
| Licensing data: configuration fingerprints, keyed hashes, counts and unlock history (see section 1) | To recognise the same firewall and apply the right price, tier and allowance | Contract; legitimate interests (preventing misuse of licences) |
| PCI review reminders you choose to set up: your label for the review (which may not contain hostnames, addresses or email addresses), device count, a keyed hash of the reviewed configuration and the review dates | To email you reminders of upcoming reviews | Contract |
| Security data: your IP address and network when you request or enter a sign-in code, stored only as keyed hashes in rate-limit records | To protect accounts against abuse and brute-force attempts | Legitimate interests (security) |
| Messages you send us | To answer you and provide support | Contract; legitimate interests |
| Technical logs: event type, request ID and status of server requests (no request content) | To run, secure and fix the Service | Legitimate interests |
We do not sell personal data, use it for advertising, or make decisions about you by automated means that have legal or similarly significant effects. If you do not give us an email address we cannot create an account or sell you credits or plans, but you can still use the free parts of the Service.
3. Service providers (processors)
We use these providers to run the Service. They process personal data on our behalf under data processing terms:
- Cloudflare – hosting, content delivery, network security and DNS for our websites and server; optionally Cloudflare Turnstile, a bot check that may be shown in the sign-in dialog.
- Supabase – our database and sign-in (email one-time code) service: stores your account, licensing and purchase records.
- Stripe – payments, VAT calculation, invoices and the customer portal for managing subscriptions. Stripe also acts as an independent controller for some data, for example for fraud prevention and its legal obligations; see Stripe’s privacy policy at stripe.com/privacy.
- Resend – delivery of our emails (sign-in codes and PCI review reminders).
We may also disclose personal data where the law requires it, to protect our rights, or to a successor if the business is transferred.
4. International transfers
Some of these providers process data outside the United Kingdom, including in the European Economic Area and the United States. Where they do, the transfer is protected by UK adequacy regulations (including the UK–US data bridge for certified companies) or by the UK International Data Transfer Agreement or Addendum to the EU standard contractual clauses.
5. How long we keep data
- Account data: for as long as your account is open. When you ask us to delete your account, we remove your email address and Stripe reference from our records, delete your PCI review reminders and delete your sign-in identity.
- Purchase, credit and invoice records: for six years after the end of the financial year they relate to, as UK tax law requires. After an erasure request these are kept only in a form that no longer contains your email address.
- Licensing records (fingerprints, keyed hashes and counts): for as long as the account exists, so that unlocks and allowances keep working.
- Sign-in rate-limit records: deleted after one day. Records of networks you have signed in from: expire 90 days after your last sign-in from that network.
- Server logs: kept for a short period (normally no more than 7 days) by our hosting provider.
- Emails and support messages: for as long as needed to deal with your request, and our email provider’s delivery logs for its standard retention period.
6. Cookies and local storage
We do not use advertising, analytics or tracking cookies.
- Sign-in cookies (app.firewallmigrate.com only): secure, HttpOnly session cookies that keep you signed in. They are strictly necessary and removed when you sign out or they expire.
- Local storage in your browser: your interface preferences (for example theme and table layout) and your acceptance of the in-app disclaimer. It never contains configuration data and stays on your device.
- Security cookies: Cloudflare may set strictly necessary cookies to protect the site from abusive traffic, and Cloudflare Turnstile, if shown during sign-in, uses its own technology to tell people from bots.
- Stripe: checkout and the customer portal open on Stripe’s own pages, which set Stripe’s cookies under Stripe’s policy.
This website (firewallmigrate.com) sets no cookies of its own.
7. Security
Data is encrypted in transit (HTTPS). Access to our systems is restricted, configuration content never reaches them, and the identifiers we do keep about your configurations and networks are one-way or keyed hashes.
8. Your rights
Under UK data protection law you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to its processing (including processing based on legitimate interests), and to receive it in a portable format. To exercise any of these rights, email support@firewallmigrate.com from your account’s email address. We will respond within one month. Some data, such as payment records, may have to be kept to meet legal obligations.
If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.
9. Children
The Service is intended for professional use and is not directed at children under 18.
10. Changes to this policy
We may update this policy. The date at the top shows when it was last changed, and we will tell account holders by email about significant changes.
11. Contact
VTEK Solutions Ltd (trading as Firewall Migrate), 103, Crown House, North Circular Road, Park Royal, London, England, NW10 7PN. Email support@firewallmigrate.com.