HEXA (“HEXA”, “we”, “us”) operates the HEXA OS web application (hexawebos.com). This Privacy Policy explains what information we collect, why we collect it, and how we protect it.
1. Information We Collect
- Account data: name, email address (@hexawebos.com or your own), password (hashed), designation, company name & address, profile photo.
- Usage data: features used, workspace activity, referral coins, timestamps.
- Content: emails, documents, spreadsheets, notes, tasks, meetings, files you create in HEXA.
- External mailboxes: if you connect Gmail / Yahoo / Outlook / custom IMAP, we store the email address + an encrypted (Fernet) copy of the app password on our servers.
- Cookies & local storage: session tokens, theme preference, offline queue, referral code.
2. How We Use Your Data
- Provide, operate and improve HEXA OS features (mail, chat, docs, meetings, etc.).
- Authenticate you and secure your account.
- Route email through your connected external accounts (real SMTP/IMAP).
- Send transactional notifications (welcome, referrals, security alerts).
- Detect abuse, fraud and violations of our Terms.
- Comply with legal obligations under the Indian IT Act 2000, GDPR, CCPA and other applicable laws.
3. Data We DO NOT Share
- We do NOT sell your personal data to advertisers or third parties.
- Your document / email content is NEVER used to train third-party AI models.
- AI features run via Emergent LLM providers (Anthropic Claude, OpenAI, Google Gemini) under a Data Processing Agreement that prohibits training on your data.
4. Security
- All traffic over HTTPS/TLS 1.3.
- Passwords hashed with bcrypt (never stored in plain text).
- External-mail app passwords encrypted at rest with Fernet symmetric encryption.
- Isolated per-workspace MongoDB collections; RBAC enforced on every API request.
- Regular dependency updates and vulnerability scans.
5. Your Rights
You may access, correct, export or delete your data at any time from
My Profile in the app or by writing to
privacy@hexawebos.com. We respond to all verified requests within 30 days.
6. Data Retention
We retain account data for as long as your account is active plus 90 days after deletion (for backup recovery). Uploaded files and mail are deleted from our systems within 30 days of account closure. Backups are purged on a rolling 90-day cycle.
7. Children
HEXA OS is not intended for users under 13. If we learn we've collected data from a child under 13, we delete it immediately.
8. Changes to this Policy
We will notify all users by in-app banner and email at least 14 days before any material change to this policy.