Privacy Policy

This policy applies to Hexaflow and to this website, hexaflow.io. It covers people who contact us through the site and people who simply browse it.

For any question about this policy, or to exercise any of the rights below, email hello@hexaflow.io.

When you submit the contact form. The form asks for your name and email address, and optionally your company, phone number, budget range, timeline, the services you are interested in, and a description of what you are trying to build. We receive exactly what you type — nothing is inferred or appended.

When you browse. We use Google Analytics 4 to understand which pages are read and how people arrive. This records an approximate location derived from your IP address, your device and browser type, the pages you visit and the site that referred you. It does not tell us who you are, and we do not attempt to link it to a named person.

Server logs. Our hosting keeps standard request logs. If an enquiry fails to send, its contents are written to those logs so the message is not lost and we can still reply to you.

We do not buy personal data, and we do not run advertising or remarketing pixels.

• To answer you. We use what you send in the contact form solely to reply and, if it goes further, to scope the work. The lawful basis is our legitimate interest in responding to an enquiry you chose to send, and taking steps at your request before entering a contract.
• To understand the site. Analytics helps us see which work people actually read. The lawful basis is consent where consent is required, and otherwise our legitimate interest in maintaining the site.
• To keep the site working and secure.Server logs and the form's spam trap exist to keep the service running. The lawful basis is legitimate interest.

We do not use your data for automated decision-making, and we will not send you marketing you did not ask for.

Analytics cookies.Google Analytics sets cookies to distinguish one visit from another. You can block them with your browser settings, an extension, or your browser's tracking protection — several browsers block them by default, and the site works exactly the same either way.

Session storage.We store a single value in your browser to remember that you have already seen the site's opening animation, so it does not replay on every page. It contains no personal data and is discarded when you close the tab.

We do not use cookies for advertising, profiling or cross-site tracking.

We share data only with the providers that run this site and its email — our hosting, email delivery and analytics providers — and each of them processes it only to provide that service to us.

We do not sell personal data, and we do not share it with anyone else except where the law requires it. A current list of the providers we use is available on request: email hello@hexaflow.io.

We operate from Oman, the United Arab Emirates, the United Kingdom and Saudi Arabia, and those providers operate internationally. Your data may therefore be processed outside the country you are in, including outside the European Economic Area, under the safeguards those providers have in place.

Enquiries are kept for as long as the conversation is live, and then for up to two years in case you come back to us. Server logs are kept for a short operational period. Analytics data is retained according to the retention setting on our Google Analytics property.

Ask us to delete your enquiry sooner and we will, unless we are required to keep it.

Depending on where you live, you may have the right to ask for a copy of the personal data we hold about you, to have it corrected or deleted, to object to or restrict how we use it, and to receive it in a portable form. Where we rely on consent, you can withdraw it at any time.

Email hello@hexaflow.io and we will respond within one month. If you are in the UK or EEA and you are not satisfied with our response, you can complain to your national data protection authority.

The site is served over HTTPS, enquiries are transmitted over encrypted connections, and access to the mailbox is restricted to people who need it. No system is perfectly secure, so please do not send confidential material through the contact form — tell us it exists and we will agree a secure route.

This site is aimed at businesses and is not directed at children. We do not knowingly collect data from anyone under 16.

If we change how we handle data, we will update this page and the date at the top of it. Material changes will be obvious rather than buried.

See also our Terms of Use.