Privacy Policy
This policy explains what information Hexa collects when you use our website, create an account, or order from us, how we use it, and the choices and rights you have.
Who we are
Hexa ("we", "us", "our"), operated by Hexa AI Agency, makes hyper-real AI video and photography of products. Hexa AI Agency is the data controller for the information described here. You can reach us any time at support@madebyhexa.co.
Information we collect
Your account
When you create an account we store your email address, your name if you give one, and a securely hashed password (we never see the password itself). Sign-in with Google shares your Google account email and name with us.
Orders and creations
For each order we store what you configured, the product link you pasted, the price paid, and the finished creation (video or image URLs) in your library. When you request a sample or use our forms, we collect the details you submit: name, email, brand, product links, and any files or notes you provide.
Payment information
Payments are processed by Stripe. Your card details go directly to Stripe and are never stored on our servers. We store a reference to your Stripe customer record, the order amount, and its payment status, so receipts and automatic refunds work.
Information collected automatically
Like most websites, we automatically receive basic technical data when you visit, such as your IP address, device and browser type, and pages viewed. Advertising pixels are loaded only if you accept them (see Cookies and tracking below).
How we use it, and on what legal basis
- To run your account and deliver your orders (contract, GDPR Art. 6(1)(b)): sign-in, rendering, your library, order emails, automatic refunds
- To respond to questions and provide support (contract and legitimate interests, Art. 6(1)(b) and (f))
- To process payments and prevent fraud and abuse (contract and legitimate interests, including rate limiting and payment verification)
- To measure our advertising (consent, Art. 6(1)(a)): only after you accept tracking, and you can decline with one click
- To meet legal obligations (Art. 6(1)(c)): tax and accounting records
Cookies and tracking
On your first visit we ask before any tracking loads. If you accept, we use the Meta (Facebook) Pixel and the TikTok Pixel to measure ad performance; these set cookies and share limited event data (such as page views and purchases) with Meta and TikTok. If you decline, none of that loads and no tracking cookie is written. Declining is remembered and just as easy as accepting.
You can change your mind any time by clearing this site's data in your browser, and you can adjust your ad preferences on Meta and TikTok.
Who we share it with
We do not sell your personal information. We share it only with the service providers that help us run the product:
- Supabase (EU, Frankfurt) account authentication and our database: your profile, orders, and library
- Stripe payment processing, receipts, tax calculation, and refunds
- Higgsfield the generation engine: receives your product link, uploaded assets, and order configuration to render your creation
- Netlify website hosting and serverless functions
- Zoho Mail sending and receiving email
- Anthropic AI drafting of render storyboards from your order configuration, when enabled
- Meta and TikTok advertising measurement, only with your consent
Where a provider processes data outside the EU/EEA, transfers rest on the EU Standard Contractual Clauses or an adequacy decision (such as the EU-US Data Privacy Framework). We may also disclose information if required by law or to protect our rights.
How long we keep it
Your account, orders, and library stay until you delete your account; deleting it removes them permanently from our database. Finished media files on the generation engine's CDN age out under its retention policy. Payment records at Stripe are kept as long as tax and accounting law requires. Support emails are kept as long as needed to help you.
Your rights
Under the GDPR you can access, correct, export, delete, restrict, or object to the processing of your personal information, and you can complain to your local supervisory authority. The two most common requests are self-serve on your account page: Download my data exports everything we store about you as one file, and Delete account removes it permanently. For anything else, email support@madebyhexa.co.
Changes to this policy
We may update this policy from time to time. When we do, we will change the "Last updated" date at the top of this page.
Governing law
This policy and our handling of your information are governed by the laws of the State of Delaware, United States, without prejudice to the data protection rights the GDPR gives EU/EEA/UK residents. The entity responsible for your information is Hexa AI Agency.
Contact
Questions about this policy or your data? Email support@madebyhexa.co.
← Back to home