1. Introduction
HexaFloww (operated by Hexagon Digital, "HexaFloww", "we", "our", or "us") provides a software-as-a-service (SaaS) marketing automation platform that enables business customers ("Business Customers") to run WhatsApp messaging via Meta's official WhatsApp Business Platform Cloud API, manage email marketing campaigns, handle customer conversations across Facebook Messenger and Instagram Direct in a unified inbox, segment audiences, create automated customer journeys, and utilize AI-assisted marketing tools.
This Privacy Policy explains how we collect, use, disclose, and protect Personal Data when you visit our website, use our software and services, or communicate with us (collectively, the "Service"). It applies both to data relating to our Business Customers (and their account users) and, where HexaFloww acts as a data processor / service provider, to data relating to our Business Customers' contacts and end users ("End Customers").
Please read this Policy carefully. If you do not agree with our practices, your choice is not to use our Service. By creating an account, accessing, or using HexaFloww, you acknowledge that you have read and understood this Policy.
2. Definitions
- "Business Customer" A business entity, sole proprietor, or authorized representative that registers for a HexaFloww account to run marketing and customer engagement campaigns.
- "End Customer" An individual recipient, contact, or user who receives communications sent by a Business Customer through HexaFloww, or who interacts with a Business Customer via supported channels (WhatsApp, Facebook Messenger, Instagram Direct, Email).
- "Personal Data" (or "Personal Information") Any information relating to an identified or identifiable natural person, as defined under applicable data protection laws.
- "Service" The HexaFloww marketing automation web application, APIs, dashboard, AI tools, and related infrastructure.
3. Information We Collect
3.1 Information About Business Customers
When you register for, subscribe to, or manage a HexaFloww account, we collect:
- Account setup data: Full name, business email address, phone number, company name, password hash, and job role.
- Billing data: Billing contact details, GSTIN (where applicable), billing address, and subscription tier. Payment details are processed directly by Razorpay Software Private Limited; HexaFloww does not store full credit/debit card numbers or bank credentials.
- Technical & usage logs: IP address, browser type, operating system, login timestamps, dashboard action logs, feature usage metrics, and API request logs.
3.2 Information About End Customers (a Business Customer's Contacts)
In providing the Service, HexaFloww processes End Customer data on behalf of and as instructed by the Business Customer:
- Contact information: Names, phone numbers (formatted for WhatsApp/SMS), email addresses, tags, custom contact attributes, and segment memberships uploaded or synced by the Business Customer.
- Conversation history: Inbound and outbound message text, WhatsApp template responses, Facebook Messenger threads, Instagram Direct messages, attachment metadata, timestamps, and delivery/read receipts.
- Tracking data: Email open events, link click events, device/browser user-agent strings, and IP-derived location data collected via HMAC-secured tracking pixels and links (with bot traffic filtering).
- Meta / Social Graph API data: Page access tokens, WhatsApp Business Account (WABA) IDs, Phone Number IDs, lead ad form submissions, and inbox message payloads received through official Meta Webhooks.
3.3 Content Used to Power AI Features
When a Business Customer utilizes AI Auto-Replies, AI Reply Suggestions, AI Lead Scoring, or the chat-based AI campaign assistant, we process conversation transcripts, knowledge-base documents, prompt inputs, and campaign context to generate relevant outputs.
3.4 Cookies and Similar Technologies
We use essential session cookies to maintain login authentication and security state. See Section 14 for detailed cookie information.
4. How We Use Information
We process Personal Data for the following purposes:
- Operating, maintaining, and delivering the HexaFloww messaging platform, broadcast engines, and unified inbox
- Facilitating official WhatsApp Cloud API message delivery, email dispatch via AWS SES / SMTP relays, and Meta Graph API integrations
- Providing AI-powered features (suggested replies, automated answers, lead scoring, and campaign generation)
- Processing payment transactions, managing subscription renewals, and emitting tax invoices via Razorpay
- Sending operational alerts, account notifications, security notices, and handoff alerts to Business Customer team members
- Detecting, preventing, and mitigating security incidents, fraudulent activity, spam, and policy violations
- Complying with statutory obligations under Indian tax laws, Meta Platform Policies, TRAI regulations, and applicable privacy legislation
5. Legal Basis for Processing (Where GDPR / DPDP Applies)
Where European (GDPR) or Indian (DPDP Act 2023) data protection law applies to our processing of Business Customer Personal Data, our legal bases include:
- Performance of Contract: To fulfill our contractual commitments under the Terms of Service.
- Consent: Where a Data Principal has granted explicit consent (e.g. opt-in marketing or cookie consent).
- Legitimate Interests: To protect our platform security, prevent fraud, and optimize service performance, provided such interests are not overridden by fundamental privacy rights.
- Legal Obligation: To comply with statutory requirements under Indian law (e.g., tax records, law enforcement orders).
6. Data Sharing & Sub-Processors
HexaFloww does not sell or rent Personal Data. We share data only with trusted infrastructure providers and sub-processors strictly as required to operate the Service:
Meta Platforms, Inc.
Official Meta Cloud API and Graph API integration to send/receive WhatsApp, Facebook Messenger, and Instagram Direct messages and sync lead ads.
AWS / SMTP Relay Infrastructure
Transactional and campaign email delivery infrastructure (AWS SES / configured SMTP relays).
Razorpay Software Private Limited
Payment processing, recurring subscription billing, and tax invoice generation.
AI Model Providers
Anthropic (Claude), OpenAI (GPT), Google (Gemini), and Perplexity processed via commercial API endpoints solely to execute prompt requests.
Hosting & Database Infrastructure
Secure cloud database and server hosting operating under strict confidentiality and encryption standards.
7. Meta Platform & WhatsApp-Specific Data Practices
Because HexaFloww connects to WhatsApp through Meta's official WhatsApp Business Platform Cloud API, and to Facebook and Instagram through Meta's Graph API, the following specific practices apply in compliance with Meta Platform Terms:
- Message payload data sent/received via WhatsApp Cloud API is retained by Meta for up to 30 days from status completion for delivery retransmission purposes.
- If a Business Customer disconnects or de-registers a WhatsApp Business Account, Meta permanently deletes remaining Company Content within 90 days, except where law requires retention.
- Meta does not use WhatsApp message content to serve targeted advertising; messages remain encrypted in transit between End Customers and Meta's infrastructure.
- Health information and other Prohibited Information categories under Meta's Cloud API Terms must not be transmitted through the Service. The WhatsApp Cloud API is not HIPAA-compliant.
- AI features integrated with messaging channels are scoped strictly to defined business tasks (product inquiry, lead qualification) rather than open-ended general chat.
8. AI Features & Data Processing
8.1 Commercial API Guarantees Your Data is NOT Used to Train AI Models
HexaFloww accesses all third-party AI providers exclusively through their commercial API endpoints. Under their commercial developer terms:
- Anthropic (Claude): Customer inputs/outputs submitted via commercial APIs are not used for model training by default.
- OpenAI (GPT): Data sent through API endpoints is not used to train OpenAI models.
- Google (Gemini): Prompts and responses under Google Cloud paid API terms are not utilized for base model training.
- Perplexity: Commercial API request payloads are processed exclusively for response completion under commercial terms.
8.2 Tenant Isolation & Human Review
Conversation context and knowledge-base documents are logically isolated per Business Customer account and are never shared across tenants. Business Customers remain responsible for reviewing AI-generated reply suggestions before dispatch where human-in-the-loop mode is configured.
9. International Data Transfers
HexaFloww is operated from India. Personal Data may be processed in India and in jurisdictions where our sub-processors operate (including the United States for Meta infrastructure and AI providers). Where data of individuals in the EU/UK or other regulated regions is transferred internationally, we ensure appropriate safeguards such as Standard Contractual Clauses (SCCs) are in place, and cross-border transfers comply with conditions notified under India's Digital Personal Data Protection Act 2023.
10. Data Retention
We retain Personal Data only for as long as needed to fulfill the purposes for which it was collected or to comply with statutory requirements:
- Account & Contact Data: Retained while the Business Customer account remains active. Upon account cancellation or explicit deletion request, active records are purged within 30 days.
- Analytics & Tracking Logs: Email tracking pixels and link analytics logs are retained for up to 24 months for reporting dashboard aggregation.
- Financial & Billing Records: Invoices and transaction logs are retained for 7 years as required by Indian tax and accounting regulations.
11. Data Security
We enforce administrative, technical, and physical safeguards designed to protect Personal Data:
- Encryption in transit using TLS 1.3/1.2 protocols and HMAC-SHA256 signature verification for webhook payloads and tracking URLs.
- Encrypted password storage using bcrypt hashing.
- Strict tenant logical isolation preventing cross-account data leakage.
- Role-based access controls (Admin, Manager, Editor, Viewer) for workspace team members.
- PCI-DSS Level 1 compliant payment processing managed entirely by Razorpay.
12. Your Rights
Depending on your jurisdiction, you have specific privacy rights:
12.1 Under India's Digital Personal Data Protection Act, 2023 (DPDP)
Data Principals have the right to access summary information about processing, request correction/erasure of data, withdraw consent, nominate an individual in event of death/incapacity, and file grievances with our Grievance Officer or the Data Protection Board of India.
12.2 Under GDPR (EU/UK)
Rights of access, rectification, erasure, restriction, data portability, and objection to automated processing.
12.3 Under CCPA/CPRA (California)
Right to know categories collected, request deletion, correct inaccurate data, and opt out of sale/sharing. HexaFloww does not sell personal information.
12.4 How to Exercise Rights
Business Customers can update or purge End Customer contacts directly within the dashboard. For manual requests or account-level deletion, visit our Data Deletion Page or email hi@hexagn.in.
13. Children's Privacy
The Service is designed strictly for B2B commercial use by adults aged 18 and older. We do not knowingly collect or solicit Personal Data from children under 18.
14. Cookies and Tracking
HexaFloww uses essential first-party session cookies to manage user login sessions and platform security. We do not deploy third-party cross-site advertising cookies. Campaign open/click analytics are logged via server-side pixel endpoints rather than browser tracking cookies.
15. Changes to This Policy
We may update this Privacy Policy from time to time to reflect functional updates, third-party API policy changes, or legal requirements. Material changes will be notified via email to registered administrators or through in-product notifications at least 7 days before taking effect.
16.Contact Information
Appointed pursuant to the Digital Personal Data Protection Act, 2023 and Information Technology Rules:
Hexagon Digital
Email: hi@hexagn.in
Hotline Phone: +91 9819224252 (Mon – Sat: 10:00 AM – 5:00 PM IST)
Location: Mumbai, Maharashtra, India
17. Governing Law & Jurisdiction
This Privacy Policy is governed by and construed in accordance with the laws of India. Any disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the competent courts located in Mumbai, Maharashtra, India.