Privacy Policy
Last updated: 17 October 2026
This Privacy Policy explains how Hexlane Systems Ltd, trading as Schemvia (“Schemvia”, “we”, “us” or “our”), collects, uses, stores and shares personal data when you visit our website or use the Schemvia service.
Schemvia is a UK-registered company.
Company name: Hexlane Systems Ltd
Company number: 16979924
Registered office: Corbiere Church Hill, Chilton, Didcot, England, OX11 0SH
Privacy contact: privacy@schemvia.com
For the personal data described in this Privacy Policy, Schemvia is generally the data controller.
Where a business customer submits content containing personal data for processing through Schemvia and determines the purposes for which that data is processed, Schemvia may instead act as a data processor on behalf of that customer. Those circumstances may also be governed by our Data Processing Agreement.
1. About Schemvia
Schemvia is a software-as-a-service platform for analysing the semantic compatibility and evolution of JSON Schemas.
The Service supports anonymous analysis as well as registered Free and Pro accounts, projects, schema version histories, team workspaces and API or CI access.
Because JSON Schemas can contain arbitrary text, examples and metadata, information submitted as Customer Content may occasionally include personal data. Customers and users should avoid including personal data in schemas unless it is necessary and they have an appropriate basis for doing so.
2. Personal data we collect
Account and identity information
When you create or use an account, we may process information including your name, email address, profile image, account identifier and authentication-related information.
Authentication is provided by Clerk. Clerk processes information required to provide sign-in, account, session and, where enabled, multi-factor authentication functionality.
Schemvia does not store your authentication password.
Workspace and account information
We process information relating to your use of Schemvia workspaces, including workspace names, membership, roles and permissions, account status and related timestamps.
If another user or an organisation invites you to a workspace, we may receive information such as your email address from that user or organisation.
Customer Content
When you use the authenticated Service, we may store information you submit to Schemvia, including project names, JSON Schema versions, schema-comparison inputs, analysis results and diagnostics, and associated engine or policy version information.
We treat submitted JSON Schemas as confidential Customer Content. We do not intentionally include complete schema contents in application or error logs.
Access by Schemvia personnel to Customer Content is intended to be exceptional, limited to authorised personnel where necessary for support, security or service operation, and subject to appropriate access controls and auditing.
Anonymous analysis
You may use certain Schemvia analysis functionality without creating an account.
Anonymous analysis does not create a durable project or analysis history associated with an account. We process submitted schemas and resulting analysis data for the period necessary to perform the requested analysis and for limited operational purposes.
We may also process network and request information, such as an IP address, device or browser information and other request metadata, for security, abuse prevention and rate limiting. We do not use anonymous analysis to create persistent advertising or behavioural tracking profiles.
Billing information
If you purchase a paid Schemvia plan, payment and billing are handled by Paddle, which acts as merchant of record.
Paddle handles payment methods, card information, checkout, invoicing, applicable taxes and related payment processing. Raw payment-card information does not pass through or get stored on Schemvia’s servers.
We receive limited information from Paddle that we need to administer your subscription, such as Paddle customer and subscription identifiers, product or price information, subscription status, paid-through dates and information concerning failed payments, cancellation or grace periods.
Paddle processes payment and billing information in accordance with its own privacy terms.
Communications
If you contact us, request support or communicate with us about your account, we process the information contained in those communications and the contact information associated with them.
We may use Resend to deliver transactional emails such as account, workspace, security, billing and service notifications.
Technical, audit and security information
When you access Schemvia, we may process technical information including IP address, request metadata, user agent or browser information, timestamps and security-related events.
We maintain audit records for certain account, workspace, security and billing operations. These records may include the actor, workspace, action, affected resource, time and contextual metadata.
We also use Sentry for error monitoring and service observability. We configure our systems with the intention of excluding Customer Content, schema contents, passwords, authentication secrets and similar sensitive information from error-monitoring logs.
3. How and why we use personal data
We process personal data only where we have an appropriate lawful basis.
| Purpose | Typical data | Lawful basis |
|---|---|---|
| Creating and administering user accounts | Identity, authentication and account information | Performance of a contract or steps requested before entering into a contract; legitimate interests where an account is administered on behalf of an organisational customer |
| Providing schema analysis and other Schemvia functionality | Account information, Customer Content and analysis information | Performance of a contract; legitimate interests for anonymous users requesting access to the free analysis service |
| Providing and managing workspaces and collaboration | Identity, workspace membership, permissions and activity | Performance of a contract; legitimate interests in administering organisational accounts |
| Operating anonymous analysis | Submitted schemas, results and limited technical information | Our legitimate interests in providing the Service and allowing prospective users to evaluate Schemvia |
| Processing subscriptions and billing | Account and subscription information | Performance of a contract and compliance with legal obligations |
| Preventing fraud, abuse and unauthorised access | Network, request, security and audit information | Our legitimate interests in protecting Schemvia, our users and our systems; legal obligation where applicable |
| Monitoring reliability and diagnosing errors | Technical information, error information and request metadata | Our legitimate interests in maintaining a reliable and secure service |
| Providing customer support | Account information, communications and relevant service information | Performance of a contract and our legitimate interests in supporting users |
| Sending operational or transactional messages | Email address and relevant account, security, workspace or billing information | Performance of a contract, legal obligation or our legitimate interests, depending on the message |
| Complying with law and protecting legal rights | Relevant account, transaction, audit and other information | Legal obligation and our legitimate interests in establishing, exercising or defending legal claims |
Where we rely on legitimate interests, those interests include operating and improving a secure and reliable SaaS service, preventing abuse and fraud, protecting our users and systems, providing anonymous access to the product and supporting our customers. We consider whether those interests are outweighed by your rights and interests before relying on this basis.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that took place before consent was withdrawn.
4. When information is required
Some information is required in order for us to provide the Service.
For example, we require appropriate identity and authentication information to create an authenticated account. If you purchase a paid plan, Paddle requires appropriate billing and payment information to complete that transaction.
If you do not provide information that is necessary for the requested service, we may not be able to provide that part of Schemvia to you.
5. Who we share information with
We do not disclose personal data except where necessary to provide and operate Schemvia, where you instruct us to do so, or where disclosure is permitted or required by law.
Our principal service providers include:
| Provider | Purpose |
|---|---|
| Clerk | Authentication, user identity, sessions and MFA |
| Neon | PostgreSQL database hosting |
| Render | Hosting and running the Schemvia web application and API |
| Paddle | Merchant-of-record services, checkout, subscriptions, invoicing, taxes and payments |
| Resend | Transactional email delivery |
| Sentry | Error monitoring and service observability |
These providers receive only the information reasonably required for the services they provide.
Paddle’s role differs from that of a conventional infrastructure processor. As merchant of record, Paddle independently processes certain information required to complete transactions, administer payments, issue invoices, calculate and remit taxes, and handle payment disputes. Its processing is also governed by Paddle’s own privacy notice.
We may also disclose information where reasonably necessary to comply with law, regulation, legal process or a lawful request from a competent authority; investigate fraud, abuse or security incidents; protect the rights or safety of Schemvia, our customers or others; or establish, exercise or defend legal claims.
If Schemvia is involved in a merger, acquisition, financing, reorganisation or sale of all or part of its business or assets, personal data may be disclosed to relevant advisers and transaction participants subject to appropriate confidentiality and data-protection safeguards.
6. International data transfers
Schemvia is established in the United Kingdom.
Our core application hosting on Render and our primary PostgreSQL database hosted by Neon are both located in Frankfurt, Germany.
Some of our other service providers may process personal data in the United Kingdom, European Economic Area or other countries as part of providing their services. Backup, support and remote-access locations for our hosting providers are described in our sub-processor register.
Where personal data is transferred to a country without an adequacy decision and an approved safeguard is required, the hosting providers listed in our sub-processor register rely on the EU Standard Contractual Clauses with the UK Addendum, incorporated in their data processing terms. For other transfers, we use the mechanism required by applicable data-protection law, which may include an adequacy decision or another approved safeguard.
You may contact us at privacy@schemvia.com for further information about the safeguards applicable to a particular transfer.
The United Kingdom currently benefits from an adequacy decision from the European Commission, allowing personal data covered by that decision to be transferred from the EEA to the UK without additional transfer safeguards.
7. How long we retain information
We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including legal, accounting, security and dispute-resolution requirements.
When a workspace is deleted, it enters a recovery period of 14 days. Customer Content is then permanently purged from production systems within 1 day after the recovery period ends. Backup copies expire within 7 days after production deletion.
Anonymous analysis inputs and outputs are deleted within 24 hours of submission, including operational copies.
Operational logs, including any copies, expire within 30 days.
Support records that contain personal data are retained for up to 2 years after the support matter closes, unless earlier deletion is requested or retention is legally required.
Billing and accounting information may be retained after an account or workspace is deleted where necessary to meet tax, accounting, fraud-prevention, dispute-resolution or other legal obligations.
Raw Paddle webhook events may be retained for a period necessary to provide reliable billing processing, including event deduplication, reconciliation and replay protection.
Where a specific retention period has not been stated above, we determine the appropriate period by considering the nature and sensitivity of the information, the amount of information, the purpose for which it is processed, security and fraud risks, contractual requirements and applicable legal obligations.
At the end of the applicable retention period, information is deleted or anonymised unless continued retention is required or permitted by law.
8. Security
We use technical and organisational measures designed to protect personal data and Customer Content against unauthorised access, alteration, disclosure or destruction.
These measures include encryption of data in transit and at rest, authentication and authorisation controls, tenant isolation, role-based access controls, logging and auditing of security-sensitive operations, and restrictions on access to Customer Content.
Schemvia is designed as a multi-tenant service. Data associated with a workspace is scoped to that workspace, and access is authorised independently of identifiers supplied by a client.
No internet service can guarantee absolute security. If you believe your Schemvia account or information has been compromised, please contact us promptly at privacy@schemvia.com.
9. Cookies and similar technologies
Schemvia currently does not use advertising trackers, marketing analytics platforms or session-replay tools.
Schemvia and service providers such as Clerk may use cookies or similar storage technologies that are necessary for functions such as authentication, session management, security and user preferences.
Where cookies or similar technologies are strictly necessary to provide a service you have requested, consent may not be required under applicable cookie rules.
If we introduce analytics, advertising or other non-essential cookies or similar technologies, we will provide appropriate information and, where required, obtain consent before they are used.
We will update our cookie information and this Privacy Policy where our use of these technologies materially changes.
10. Marketing communications
We do not currently use information collected through the Service for third-party behavioural advertising.
If we introduce optional marketing communications, we will provide appropriate choices and an unsubscribe mechanism and will obtain consent where consent is required by applicable law.
Operational messages concerning your account, security, billing or material changes to the Service are not marketing communications and may still be sent where necessary.
11. Automated decision-making and profiling
We do not use personal data to make solely automated decisions about individuals that produce legal effects or similarly significant effects.
Schemvia’s automated schema analysis concerns JSON Schema compatibility and software-development artefacts; it is not used to make decisions about individuals.
12. Your data-protection rights
Depending on your location, the circumstances and the lawful basis for processing, you may have the right to request access to personal data we hold about you; request correction of inaccurate or incomplete information; request deletion of personal data; request restriction of processing; receive certain personal data in a portable format; and withdraw consent where processing is based on consent.
You also have the right to object to processing based on our legitimate interests. If you object, we will stop the relevant processing unless we have compelling legitimate grounds to continue or the processing is required for the establishment, exercise or defence of legal claims.
These rights are not absolute and may be subject to exemptions under applicable law.
To exercise your rights, contact privacy@schemvia.com. We may need to verify your identity before fulfilling a request.
Where Schemvia processes personal data solely on behalf of one of our business customers, we may direct your request to that customer or assist the customer with responding to it, as appropriate.
13. Complaints
If you have concerns about our handling of personal data, please contact us first at privacy@schemvia.com so that we can investigate.
You also have the right to make a complaint to theInformation Commissioner’s Office (ICO), the UK data-protection regulator.
Information about making a complaint is available from the ICO atico.org.uk.
If the EU GDPR applies to our processing of your personal data, you may also have the right to lodge a complaint with the competent data-protection supervisory authority in the EEA.
14. Children’s privacy
Schemvia is intended as a professional software-development service and is not designed or marketed as a service for children.
We do not knowingly seek to collect personal data from children through the Service. If you believe a child has provided personal data to us in circumstances where it should not have been collected, please contact us.
15. Changes to this Privacy Policy
We may update this Privacy Policy from time to time, for example when we change the Service, introduce new service providers or processing activities, or need to reflect changes in applicable law.
We will publish the current version on our website and update the “Last updated” date above. If a change materially affects how we use personal data, we will provide additional notice where appropriate.
16. Contact us
Questions about this Privacy Policy or our handling of personal data can be sent to:
Hexlane Systems Ltd
Trading as Schemvia
Corbiere Church Hill, Chilton, Didcot, England, OX11 0SH
privacy@schemvia.com