Legal & Compliance

Hijack is the business that operates hijack.gg and provides the intelligence and investigation platform described in this policy (the "Services"). In this Privacy Policy, "Hijack," "we," "us," and "our" refer to that operator. This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information when you use the Services. It should be read together with our Terms of Service.

This policy is a binding description of Hijack's privacy practices. It does not provide legal advice to users and does not replace the compliance obligations that apply to a user's own investigations or processing activities.

Operator, Controller, and Legal Contact

Hijack is the operator of the Services and the controller of personal information used for account administration, billing records received from payment providers, platform security, service analytics, and support. Send privacy requests, legal notices, copyright notices, and regulatory correspondence to admin@hijack.gg. Include your full name, the email associated with your account, the nature of the request, and enough detail for us to identify the relevant records.

Who This Applies To

This policy applies to visitors, registered users, and organizations that use the Services. When you use the Services for an organization, you represent that you are authorized to act for that organization and that the organization has provided all notices and obtained all permissions required for the data it submits.

Information We Collect

How We Use Information

We use information to:

• Provide, operate, and improve the Services
• Authenticate users, enforce session and access rules, and prevent fraud and abuse
• Apply technical limits (such as per-account usage caps on certain integrations) and protect the integrity of the Services
• Communicate about the Services, security notices, and policy updates
• Comply with law, respond to lawful requests, and enforce our Terms

Third-Party Services and Onward Transfers

To deliver enrichments and integrations, we may transmit the information required for each request to third-party data or infrastructure providers when you use those parts of the product. Those providers process data under their own terms and privacy notices. We do not control their practices; we select providers to deliver functionality you request.

We also use subprocessors for hosting, analytics, security, payments (including providers such as Qyzar), email, and captcha or bot-detection services where enabled.

Legal Bases (EEA / UK users)

Where we act as a controller under the GDPR or UK GDPR, we may rely on: (1) performance of a contract with you, (2) legitimate interests (such as securing the Services and understanding aggregate usage), provided those interests are not overridden by your rights, (3) consent where required, and (4) legal obligation.

Retention

We retain information while your account is active and for the additional period required to provide the Services, secure the platform, resolve disputes, enforce agreements, and meet legal obligations. Retention periods differ by data category. After the applicable period, we delete the information or convert it to aggregated or minimized data that no longer identifies a user.

Security

We use appropriate technical and organizational measures designed to protect information against unauthorized access, loss, or misuse. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

Sharing

We do not sell your personal information. We may share information: with service providers bound by confidentiality; to comply with law or protect rights; in connection with a merger or asset sale (with notice where required); or with your direction or consent.

Law Enforcement and Legal Requests

We may disclose information if we believe in good faith that disclosure is necessary to comply with applicable law, regulation, legal process, or governmental request; to enforce our policies or contracts; to detect or prevent fraud, security, or technical issues; or to protect the rights, property, or safety of Hijack, our users, or others. Unless prohibited by law, we may attempt to notify you of such requests where feasible.

Government and law-enforcement partners: see our Law Enforcement & Government page for high-level process and contact information.

Controller, Processor, and Organization Accounts

Hijack acts as controller, or as a "business" under applicable U.S. state privacy laws, for account, billing, security, analytics, and support data. When a signed organization agreement states that Hijack processes specified data solely on the organization's documented instructions, Hijack acts as processor or service provider for that data and the organization remains responsible for responding to requests concerning its processing.

International Transfers

We may process and store information in countries other than where you live. Where required, we use appropriate safeguards (such as standard contractual clauses) for transfers from the EEA, UK, or Switzerland.

Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal information, to object to certain processing, to lodge a complaint with a supervisory authority, and to receive a portable copy where applicable.

To exercise rights, contact us at the email below. We will verify your identity to the extent required to protect the account and comply with law. For data Hijack processes solely on an organization's instructions, the organization is responsible for the request and Hijack will direct the requester to that organization.

United States State Privacy (California and others)

Depending on your U.S. state of residence, you may have rights to access, correct, delete, or opt out of certain processing of personal information, and to appeal our decisions regarding your requests. We do not sell personal information or share it for cross-context behavioral advertising as those terms are commonly defined in state privacy laws. We do not knowingly process sensitive personal information for purposes restricted by those laws without appropriate notices and, where required, consent.

California residents (CCPA/CPRA): In the past twelve months, we may have collected identifiers (such as name, email, account ID), commercial information (subscriptions), internet or network activity (such as device or connection information), and professional or employment-related information if you provide it. Sources include you, your device, our service providers, and integrations you enable. Purposes include providing the Services, security, analytics, and legal compliance. We retain categories only as long as reasonably needed for those purposes.

To submit a privacy request, contact admin@hijack.gg. We will verify your request as required by law. You may designate an authorized agent with written permission (and we may require proof of identity). We will not discriminate against you for exercising privacy rights.

Children

The Services are not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have collected such information, contact us and we will take appropriate steps to delete it.

Automated Processing

We use automated systems to help secure accounts (for example, risk scoring, rate limiting, and bot challenges). We do not use solely automated decision-making that produces legal or similarly significant effects solely on the basis of profiling without human review where such review is required by law.

Do Not Track and Global Privacy Control

Some browsers transmit "Do Not Track" signals. There is no consistent industry standard for how to respond. We look to evolving guidance on Global Privacy Control and similar mechanisms where legally required. For choices about cookies, see our Cookies Policy.

Breach Notification

If we become aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of personal data under our control, we will investigate and, where required by law, notify affected individuals and regulators in accordance with applicable timelines.

Cookies and Similar Technologies

We use cookies and similar technologies for authentication, preferences, security, and analytics. For details, see our Cookies Policy.

Changes to This Policy

We may update this Privacy Policy. We will update the "Last updated" date and provide additional notice before a material change takes effect when law requires notice. A change does not reduce rights that already accrued under mandatory law.

Acceptance of Terms

These Terms of Service ("Terms") are a binding agreement between you and Hijack, the business that operates hijack.ggand provides the intelligence platform and related services (collectively, the "Services"). By creating an account, purchasing access, or using the Services, you accept these Terms. If you do not accept them, you must not access or use the Services.

You also agree to our Privacy Policy and our Cookies Policy. Together with the policies listed below, these documents form the complete standard agreement between you and Hijack.

Additional policies: Acceptable Use, Billing & Refunds, DMCA / Copyright, and Law Enforcement & Government.

Contracting Party and Formal Notices

Hijack is the contracting legal entity and service provider under these Terms. No integration provider, data source, payment processor, or other vendor is a party to this agreement. Formal notices to Hijack must be sent to admin@hijack.gg with "Legal Notice" in the subject line. A notice is received when it reaches that mailbox. Hijack sends contractual notices to the email address registered to your account, and you must keep that address current.

Eligibility and Account

To use the Services, you must:

• Be at least 18 years old (or the age of majority in your jurisdiction)
• Have authority to enter into these Terms
• Provide accurate registration information and keep it current
• Safeguard your credentials and devices
• Notify us promptly of suspected unauthorized access
• Use the Services only in compliance with applicable law

You are responsible for activity under your account. We may suspend or terminate accounts that violate these Terms or threaten the security or integrity of the Services.

Sessions. For security, completing a new sign-in may end other active sessions tied to your account. Only use the Services from environments you control.

Service Description

The Services may include tools for professional investigation workflows, data enrichment, and related automation. Features, integrations, and availability may change. We do not guarantee uninterrupted, error-free, or complete results.

Output may depend on third-party data providers and public or licensed sources. We do not warrant the accuracy, completeness, or timeliness of any result. You are responsible for validating information and for how you use it.

Subscriptions, Billing, and Fair Use

Access to certain features requires an active subscription or entitlement when the product identifies that requirement. Fees, renewal terms, and payment methods are presented before purchase and in your account. The initial paid subscription charge is covered by the 30-day guarantee in the Billing & Refund Policy. Renewals and partial billing periods are non-refundable unless mandatory law requires a refund.

Payment processing. Payments are collected and processed by independent third-party payment providers (for example Qyzar). Hijack does not store your full card or bank details on our servers. Those providers' terms of service, privacy policies, and dispute processes apply to checkout and payment-method management. Hijack will identify the active payment processor during checkout and will update the Privacy Policy before using a new processor for personal information.

We may apply technical or usage limits (for example, per-account rate limits on specific integrations) to protect platform stability, comply with vendor terms, and prevent abuse. Exceeding limits may result in throttling or suspension.

Acceptable Use

You agree not to use the Services to:

• Violate applicable law or infringe others' rights
• Stalk, harass, discriminate against, or harm any person
• Obtain or use data in violation of privacy, employment, credit, or sector-specific rules that apply to you
• Circumvent security, authentication, rate limits, or billing controls
• Probe, scrape, or overload our systems without authorization
• Resell, sublicense, or redistribute access except as we expressly permit
• Use the Services in embargoed jurisdictions or for prohibited end uses where restricted by law

Serious or repeated violations may lead to immediate termination and cooperation with authorities where required.

The full Acceptable Use Policy contains additional examples, high-risk use rules, and reporting instructions.

Intellectual Property

The Services, including software, branding, and documentation, are owned by Hijack or its licensors and are protected by intellectual property laws. We grant you a limited, non-exclusive, non-transferable right to access and use the Services during your subscription, subject to these Terms.

Data, Privacy, and Your Obligations

Our collection and use of account and platform data is described in the Privacy Policy. You are solely responsible for ensuring that your use of the Services—including every feature and workflow you enable—complies with the laws and agreements that bind you, including requirements for consent, purpose limitation, and data minimization that apply to your activity.

Permitted Use and Professional Standards

The Services are intended for legitimate professional, security, fraud-prevention, and investigative purposes where you have authority to perform such work. You represent that you will not use outputs from the Services as the sole basis for decisions with legal or similarly significant effects on individuals unless you have undertaken independent verification and comply with laws applicable to you.

You are responsible for obtaining and documenting any internal approvals, client consents, or jurisdictional assessments required for your use case. We may request reasonable information to confirm eligibility or investigate suspected misuse.

Authorized Access (Website & Product UX Only)

Interactive use only. You may access and use the Services only through the normal, interactive experience we provide on hijack.ggand in our authorized in-product interfaces (the "UX") while signed in as permitted by your account. Use must reflect genuine human-directed activity through that UX—not an automated or headless substitute for it.

No unauthorized automation. Without our prior written consent, you must not operate or use bots, scripts, scrapers, crawlers, batch or scheduled jobs, Robotic Process Automation (RPA), headless browsers, extension-driven automation, or other tools that automate interaction with the Services, harvest or extract data at scale, circumvent the intended UX, or collect outputs for resale, republication, redistribution, database building, or commercial re-use outside what the UX expressly allows. You must not call undocumented or internal endpoints, reverse engineer client–server traffic to replay or bulk-export requests, mirror our product for third parties, or train competing models on our outputs without permission.

API availability. We do not currently offer a generally available, documented customer API. We may introduce a defined API program in the future; if we do, it will be subject to separate published terms and technical limitations. Until and unless we expressly authorize you in writing under such a program, there is no exception to the interactive-UX requirement above.

We may block, throttle, or terminate accounts involved in unauthorized automation or circumvention of access, authentication, or rate limits. Assistive technologies used solely to accommodate disabilities are not limited by this section.

Your Content and Feedback

Your inputs. You keep ownership of information you submit through the Services (such as text or files you enter in the product and account details). To run the platform, you grant Hijack a non-exclusive, worldwide, royalty-free license to host, transmit, and otherwise handle those inputs only as needed to provide the Services you request and to maintain security and abuse prevention. You represent that you have the rights and, where required, the lawful basis to submit that information and to grant this license.

Feedback. If you voluntarily send us ideas, suggestions, or other feedback about the Services, you grant Hijack a perpetual, irrevocable, worldwide, royalty-free license to use that feedback for any purpose—including to improve, develop, or market the Services—without obligation to pay or credit you, except where prohibited by law. This applies only to feedback you choose to give us; it does not give us ownership of your pre-existing intellectual property or change the license above for data you submit solely to use the product.

Communications and Notices

You consent to receive transactional and operational communications (security alerts, billing, policy updates) electronically at the email associated with your account. Marketing communications, where sent, will comply with applicable opt-out requirements.

Sanctions, Export, and Restricted Territories

You may not use, export, re-export, or transfer the Services or technical data except as authorized by applicable export control and sanctions laws. You represent that you are not located in, under the control of, or a national or resident of any country or region embargoed or restricted for such transactions, and that you are not on any government denied-party list.

Copyright and DMCA Notices (U.S.)

If you believe content on or accessible through the Services infringes your copyright, you may send a notice to admin@hijack.gg with the information required by 17 U.S.C. § 512(c)(3). We may remove or disable material after a complete notice and may terminate repeat infringers under the repeat-infringement policy. Counter-notices may be submitted as provided by law.

Force Majeure

We are not liable for failure or delay resulting from events beyond our reasonable control, including acts of God, war, terrorism, riots, embargoes, acts of civil or military authorities, fire, floods, accidents, strikes, pandemics, infrastructure failures, or shortages of transportation, facilities, fuel, energy, labor, or materials.

Assignment, No Waiver, Severability, Entire Agreement

You may not assign or transfer these Terms without our prior written consent. We may assign our rights and obligations in connection with a merger, acquisition, or sale of assets. Failure to enforce any provision is not a waiver. If a provision is held invalid, the remainder remains in effect.

These Terms, together with the policies linked herein, are the entire agreement between you and Hijack regarding the Services and supersede prior oral or written understandings on that subject.

Disclaimer of Warranties

THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY LAW, HIJACK DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, HIJACK WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, DATA, GOODWILL, OR BUSINESS INTERRUPTION, ARISING OUT OF OR RELATED TO YOUR USE OF THE SERVICES.

Where liability cannot be excluded, our aggregate liability arising out of these Terms or the Services in any twelve (12) month period is limited to the greater of (a) the fees you paid to Hijack for the Services during that period or (b) one hundred U.S. dollars (USD $100), except where prohibited by law.

Indemnity

You will defend, indemnify, and hold harmless Hijack and its affiliates, officers, and employees from claims, damages, and expenses (including reasonable attorneys' fees) arising from your misuse of the Services, violation of these Terms, or violation of applicable law.

Termination

We may suspend or terminate access for conduct that risks the Services or other users, or for non-payment or breach. You may stop using the Services at any time. Provisions that by nature should survive (e.g., disclaimers, limitations, indemnity) will survive termination.

Changes

We may modify these Terms. We will update the "Last updated" date and, where required or appropriate, provide additional notice. Continued use after changes take effect constitutes acceptance unless applicable law requires otherwise.

Dispute Resolution

Before starting a court proceeding, you must send a written dispute notice to admin@hijack.gg that identifies the parties, the relevant account, the facts, and the relief requested. The parties will attempt in good faith to resolve the dispute for thirty (30) days after receipt. A claim that remains unresolved after that period must be brought in the courts of Oslo, Norway, subject to the mandatory rights of consumers to use another court provided by applicable law.

Governing Law, Venue, and Agreement Priority

These Terms, the Services, and every contractual or non-contractual dispute arising from them are governed by the laws of Norway, without regard to conflict-of-law rules. Subject to mandatory consumer protections, the courts of Oslo, Norway, including Oslo District Court, have exclusive jurisdiction and venue, and each party consents to those courts. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

A separately signed enterprise agreement controls over these Terms only for provisions that the signed agreement expressly replaces. An order form controls only pricing, subscription term, included usage, and features expressly stated on that order form. These Terms control every other conflict.

This Cookies Policy explains how Hijack ("we," "us," or "our") uses cookies, local storage, and similar technologies on hijack.gg and our platform. It should be read with our Privacy Policy and Terms of Service.

What Are Cookies and Similar Technologies?

Cookies are small text files stored on your device when you visit a site. They help with security, preferences, and understanding how the service is used.

Similar technologies used by the Services include local storage and session storage in your browser to remember settings (for example, theme preferences) or to store tokens or identifiers needed for authentication flows, subject to your browser settings.

Pixels and tags may be used by analytics or security vendors we employ to measure performance or detect abuse; those partners may set their own cookies subject to their policies.

Why We Use Them

We use cookies and similar technologies for:

First-Party vs Third-Party

First-party cookies are set by Hijack when you use our domain. Third-party cookies are set by partners (for example payment, captcha, analytics, or infrastructure providers) when their content or scripts load. Third-party use is governed by their respective policies; we encourage you to review them.

Session vs Persistent

Session cookies expire when you close your browser. Persistent cookies remain for a defined period or until you delete them; maximum durations depend on the specific cookie and purpose (for example authentication session length or analytics retention window).

Your Choices

Most browsers let you block or delete cookies via settings. Blocking strictly necessary cookies may break sign-in or security flows. For advertising-related signals in jurisdictions that require it, we do not sell personal information; opt-out rights for "sale" or "sharing" under U.S. state laws are described in our Privacy Policy.

• Use your browser's help documentation to manage cookies and site data
• Consider privacy-focused browsers or extensions if you want finer control
• Clearing cookies logs you out of most services that rely on them

Updates

We may update this Cookies Policy to reflect changes in technology, law, or our practices. We will revise the "Last updated" date and will provide notice through the Services or by email before a material change takes effect when law requires notice.

This Acceptable Use Policy ("AUP") supplements our Terms of Service. Capitalized terms used but not defined here have the meaning given in the Terms. If you violate this AUP, we may suspend or terminate access, remove content, cooperate with authorities where required, and take other remedial action.

Permitted contexts

The Services are designed for lawful professional use, including authorized investigations, fraud prevention, corporate security, and—where you have proper authority—public safety and law-enforcement workflows. You must have a lawful basis for each use case and must comply with jurisdictional rules that apply to you (including privacy, employment, financial, healthcare, and telecommunications laws).

If you are a law-enforcement or government agency, you are responsible for ensuring your use aligns with agency policy, court orders, and applicable statutes. See our Law Enforcement information for overview and contact options.

Authorized access (UX only)

Access must be through our website and product user experience—interactive, human-directed use while authenticated. You may not substitute headless sessions, scripted workflows, or third-party automation platforms for that experience. Harvesting or scraping the Services or systematically capturing outputs to resell, repackage, or redistribute(including as datasets or "API-like" offerings to others) is prohibited except where we explicitly permit it in writing.

A future documented API program, if offered, will be an explicit exception governed by its own terms; until then, no programmatic or bulk access is authorized. See our Terms of Service for the full access rules.

Prohibited conduct

Without limitation, you must not use the Services to:

• Violate criminal or civil law, including laws governing surveillance, computer intrusion, stalking, harassment, discrimination, or theft of trade secrets
• Collect or use personal data without a lawful basis, proper notice where required, or beyond what your role authorizes
• Conduct credit, employment, housing, or insurance decisions regulated under statutes such as the FCRA (U.S.) or local equivalents, unless you are fully compliant with those regimes and any vendor restrictions
• Target, threaten, extort, or enable harm toward individuals, or facilitate doxxing or coordinated harassment
• Impersonate any person or entity, misrepresent affiliation, or falsify the origin of data you provide
• Circumvent access controls, rate limits, billing controls, geographic or technical restrictions, or security measures
• Probe, scan, or attack our systems; inject malware; or attempt to obtain unauthorized access to Hijack, other users, or third-party systems
• Use automated means—including bots, scripts, scrapers, headless browsers, RPA, or extension-driven automation—to operate the Services, bypass the intended UX, or collect data at scale (except genuine assistive technology for disabilities)
• Scrape, harvest, cache, or republish outputs from the Services for resale, competing products, bulk redistribution, or to provide third parties with "API-like" access to our platform without permission
• Mirror, reproduce, or substantially duplicate the Services' user experience for redistribution or to train competing systems, without permission
• Resell, sublicense, share credentials for, or pool access to the Services except as permitted under your subscription or a written agreement
• Use the Services in embargoed or prohibited jurisdictions or for end uses restricted by export-control, sanctions, or similar law

High-risk and regulated uses

Outputs may be incomplete, stale, or incorrect. You must not rely on the Services as the sole basis for decisions that have legal or similarly significant effects on individuals without independent verification and compliance with laws that govern those decisions.

If you operate in regulated sectors (e.g., banking, health, telecommunications, public sector), you remain solely responsible for sector-specific obligations, retention, audit, and data-processing agreements.

Monitoring and enforcement

We may use technical and organizational measures to detect, prevent, and respond to abuse, including reviewing account activity where reasonably necessary for security, fraud prevention, or legal compliance. We do not undertake to monitor all user activity and are not responsible for your compliance with this AUP.

Reporting abuse

To report suspected violations, contact admin@hijack.gg. Include sufficient detail (URLs, timestamps, account identifiers if known) to allow us to assess the report. We may not respond to every message but will review credible misuse reports.

Changes

We may update this AUP. The "Last updated" date identifies the current version. We will request separate consent before a change takes effect when mandatory law requires it.

Hijack provides professional investigation and intelligence tools that authorized law-enforcement, public-safety, and government agencies may use for lawful purposes—subject to our Terms of Service, Acceptable Use Policy, and Privacy Policy. This page summarizes how we work with the public sector and how to reach us; it is not a substitute for legal process or agency legal review.

Use of the Services by agencies

Agency personnel must use official channels, comply with supervision and policy, and ensure every inquiry has an adequate legal basis (warrant, subpoena, consent, open-source rules, or equivalent as your jurisdiction requires). You are responsible for configuration, auditing, and retention within your organization.

We may offer or require verification (for example agency email domain, documentation, or contracts) before activating certain plans or features for government customers.

Procurement, billing, and enterprise

For volume licensing, purchase orders, vendor onboarding, or invoicing, contact admin@hijack.gg. Our standard commercial terms apply unless you execute a separate agreement with Hijack. See also our Billing & Refund Policy.

Legal process & preservation requests

Law-enforcement and government requests, including subpoenas, court orders, search warrants, and national-security process, must be directed to admin@hijack.gg. Include agency details, contact information, the nature of the request, and enough specificity for us to locate relevant records without undue burden, consistent with applicable law.

We may seek reimbursement for reasonable costs where permitted. We may push back on overbroad, vague, or unlawful demands. For emergencies involving imminent danger of death or serious physical injury, include "EMERGENCY" in the subject line and provide factual support; we assess emergency disclosures in line with applicable law.

Transparency

Where law permits, we may publish aggregate information about governmental requests. Individual notices to users may be restricted by law or court order.

International agencies

Cross-border requests must comply with applicable treaties, MLATs, and local law. We may redirect requests that do not meet jurisdictional requirements.