Privacy Policy

Hexaloop is an IT services company based at 309, Bansiwala Tower, Agrasen Square, Indore, Madhya Pradesh 452001, India. This policy applies to this website, hexaloop.com. We decide why and how the personal data described below is used, which makes us the data fiduciary under India's Digital Personal Data Protection Act, 2023 and the controller under the GDPR.

You can reach us about anything in this policy at work@hexaloop.com.

We collect only what you type into our forms, plus a small amount of technical data needed to run and protect them.

• Contact form: your name, email address, phone number (optional) and message.
• Hire form: your name, email address, phone number, company (optional), the service you want, target platform, team size, technologies, project description, budget range, timeline and any additional notes.
• Technical data: your IP address and basic browser information. They reach our hosting provider and the security services described below whenever you load a page or submit a form.
• Site usage data: the pages you view, how you reached the site, your device and browser type and your approximate location, collected by Google Analytics (see Cookies below). It is never combined with what you type into a form.
• Emails you send us directly: whatever the message and its headers contain.

Please do not put sensitive information (health, financial account or government ID details) in a form. We do not need it to answer an enquiry.

• To reply to your enquiry and, if you ask for one, prepare a proposal or quote.
• To discuss and, if you go ahead, deliver a project for you.
• To stop spam and abuse of our forms (rate limiting and a security check).
• To see which pages are visited and how people find us, so we can improve the site.
• To meet legal, tax and accounting obligations.

Under the DPDP Act we rely on your consent, which you give by submitting a form after reading this policy, and which you can withdraw at any time. Under the GDPR our basis is taking steps at your request before a contract, and our legitimate interest in answering enquiries, keeping our forms free of abuse and understanding how the site is used. You can opt out of site analytics at any time, as described under Cookies. We do not sell your data and we do not use it for automated decision-making.

We use Google Analytics to count visits and see which pages are read. It sets cookies in your browser (named _ga and _ga_ followed by an identifier, valid for up to two years) that tell returning visitors apart. We have switched off Google's advertising features (Google signals and ad personalisation) and we do not use advertising cookies. Analytics is not loaded on our admin pages.

To opt out, block these cookies in your browser settings or install Google's Analytics opt-out browser add-on. Visitors are not given a login cookie. The security check on our forms is provided by Cloudflare Turnstile, which may read or store small pieces of data in your browser to tell people from bots. Our hosting provider also keeps ordinary server logs.

We share data only with the service providers that help us run the site, and only for that purpose:

• Cloudflare (Turnstile security check): receives your IP address and browser signals when the check runs.
• Google (Analytics): receives your IP address, device and browser details and the pages you view, and turns them into usage reports for us. No form data goes to Google.
• Our email provider: delivers each form submission to our inbox, so its servers handle the contents of your message.
• Vercel (hosting): serves the website and keeps standard request logs that include IP addresses.
• Upstash (rate limiting): stores a short-lived counter tied to your IP address so one visitor cannot flood the forms. Counters expire within 24 hours.
• Cloudinary (image delivery): serves the images used on blog posts, so your browser connects to its servers and your IP address is visible to it. No form data goes to Cloudinary.

We may also disclose data when the law requires it, to protect our rights, or to a successor if the business changes hands. Each provider is bound by its own privacy terms.

Some of these providers run servers outside India and outside the European Economic Area, so your data may be processed in other countries. We choose providers that publish data-protection commitments and we send them no more than the service needs.

• Enquiry emails: up to 24 months after our last contact with you, then deleted.
• If a project follows: for as long as the project runs and as long as the law requires us to keep contract and tax records afterwards.
• Rate-limit counters: automatically removed within 24 hours.
• Site usage data: kept in Google Analytics for the period set in our account, at most 14 months.
• Hosting logs: kept by the hosting provider for its standard log period.

You may ask us to tell you what data we hold about you, correct it, delete it, or stop using it, and you may withdraw consent at any time. Under the GDPR you may also ask to restrict or object to its use, ask for a portable copy, and complain to your data-protection authority. Under the DPDP Act you may nominate another person to exercise these rights for you.

Email work@hexaloop.com from the address you used. We answer within 30 days. Withdrawing consent does not affect what we did with your data before you withdrew it.

The site is served over HTTPS, form submissions pass a security check and rate limits, and access to the mailbox that receives them is restricted to our team. No system is perfectly secure, so if we ever learn of a breach that affects you we will tell you and the relevant authority as the law requires.

This website is for businesses and adults. We do not knowingly collect data from anyone under 18. If you think a child has sent us data, email work@hexaloop.com and we will delete it.

When we change this policy we update the date at the top of the page. If a change affects how we use data you already gave us, we will ask for your consent again where the law requires it.

For a complaint about how we handle your data, write to the Grievance Officer, Hexaloop, 309, Bansiwala Tower, Agrasen Square, Indore, Madhya Pradesh 452001, India, or email work@hexaloop.com. We acknowledge every complaint and reply within 30 days. If you are not satisfied you may approach the Data Protection Board of India, or your local supervisory authority if you are in the European Economic Area.

For other questions, use the contact page.