Privacy Policy

Hextor Space runs hextorspace.com (this website), the dashboard at dash.hextorspace.com, the sites our customers publish at hextor.space addresses or on their own domains, and the apps we host at hextor.app, such as checkout links at pay.hextor.app.

For your account and this website, we decide how your data is used: we're the data controller. For the data a business keeps in its own site, such as its customers' orders, bookings and messages, that business is the controller and we process the data for it, on its instructions. If you're a customer of a business that uses Hextor, please contact the business first; we'll help it answer you.

• Your account. When you sign in with Google we receive your name, email address and profile photo. We also keep the invite code you joined with, your site's address and the settings you choose.
• What you put in your site. Pages, text, images and files you upload, your products and prices, and the orders, bookings, messages and customer details your site collects.
• Payments. When you pay us, for example to claim a name for your site, Stripe handles the payment. We receive the result and the amount, never your full card number. If you take payments with Hextor Pay, Stripe collects the business and identity details it needs to verify you.
• Messages. What you send us by email, such as a waitlist request, a question or a request about your data.
• Technical data. Like any website, our servers receive your IP address, your browser and device type, and the pages you ask for. Cloudflare, which hosts our services, uses this to deliver pages and protect them from attacks.
• Visits to sites built with Hextor. Hextor Analytics counts page views, where visitors came from, their country, device type and form submissions on our customers' sites. It uses no cookies: it tells visits apart with a code made from the IP address and browser that changes every day and can't be turned back into either, and it doesn't keep the IP address.
• AI features. When you, or a visitor to a site, use an AI feature such as the site builder or a site's chat, what you type and the content needed to answer are sent to Anthropic, which runs the AI model, to produce the reply.

• To provide the service you signed up for: to sign you in, host and publish your site, handle orders and payments, and send service emails such as receipts and important notices. Basis: our contract with you.
• To keep it safe and working: to prevent fraud and abuse, fix problems and measure how the service performs. Basis: our legitimate interest in a secure, reliable service.
• To improve our products, using usage information that doesn't single you out. Basis: our legitimate interest.
• To tell you about Hextor, such as when a product you joined the waitlist for opens. Basis: your consent, which you can withdraw at any time.
• To meet our legal obligations, such as keeping accounting records and answering lawful requests from authorities. Basis: legal obligation.

We don't sell personal data, and we don't use the data in your site to advertise to your customers.

We use these service providers, who process data for us under contract and only as we instruct:

• Cloudflare: hosting, content delivery, file storage, email sending and visit counts
• PlanetScale: our database, in Singapore
• Google: signing in
• Stripe: payments and, for Hextor Pay, verifying businesses
• Anthropic: the AI models behind our AI features

Apps you add to your site, such as Google Analytics, the Meta Pixel or LINE, receive data under their own terms once you turn them on.

We may also share data when the law requires it, to protect people's safety or our rights, or if our business is merged or sold, in which case this policy keeps applying to your data.

Our providers run servers in other countries, including Singapore and the United States, and Cloudflare serves pages from data centres near each visitor. When data leaves Thailand, we rely on the safeguards the PDPA allows, such as our providers' contractual commitments to protect it.

We keep your account data while your account is open. When you close it, we delete your account and your site's content, apart from what the law requires us to keep, such as accounting records, which we keep for at least 5 years.

Hextor Analytics' visit counts are kept for 3 months. Server logs are kept for a short time, for security.

Under the PDPA you can ask us to:

• give you access to, or a copy of, your personal data
• send it to you or to another service in a common format
• correct it if it's wrong or incomplete
• delete it, or make it anonymous
• stop or limit using it
• object to how we use it

You can also withdraw a consent you gave at any time; it doesn't affect what we did before. Email hello@hextorspace.com and we'll answer within 30 days. If you believe we've broken the law, you can complain to Thailand's Personal Data Protection Committee.

Data travels encrypted (HTTPS) and is kept with providers that encrypt it at rest. Only the people who need it to run the service can reach it. No system is perfectly secure; if a breach puts your data at risk, we'll report it to the authorities within 72 hours and tell you without delay, as the PDPA requires.

This website uses only the cookies it needs to work. Cookie preferences lists them and lets you choose whether we may use optional ones.

Hextor is made for businesses. It isn't meant for children, and we don't knowingly collect data from anyone under 20 without a parent's or guardian's consent.

We'll post any change here with a new date. If a change matters to you, we'll tell you by email or in the dashboard before it takes effect.

Questions, requests and complaints about your data: hello@hextorspace.com.