Privacy Policy

1. Data we process

• Account data, including name, email, authentication and session information, and evidence of the legal-document versions accepted during registration or invitation acceptance.
• Business workspace data, including services, schedules, knowledge, settings and staff information.
• Customer and CRM data, including names, contact details, messages, appointments and conversation history.
• Contact and privacy-request data, including the requester’s name, email, category, subject, message, request status and account reference where applicable.
• Integration data such as Telegram channel identifiers and encrypted integration credentials.
• Technical and security information processed by the application and delivery infrastructure, including IP address, request identifiers, network, routing, timing and error metadata needed to operate and protect the service.

2. Sources, purposes and basis

We receive data from account users, their organisations, customers who use a Web Chat or Telegram channel, people who submit the contact form, authentication and integration providers, and technical operation of the service. We use it to authenticate users, record required acceptance, provide workspaces and communications, process support, privacy and security requests, generate AI responses where enabled, create appointments, deliver supported integrations, prevent abuse and maintain security.

Depending on the relationship and applicable law, processing is carried out to provide the requested service and perform an agreement, follow the customer organisation’s documented instructions, protect legitimate security and operational interests, comply with legal obligations, or act on consent where consent is the appropriate basis. The customer organisation remains responsible for its own instructions and relationship with the people whose data it provides.

3. Sharing and international transfers

We use the subprocessors listed in the Subprocessor List. They receive only data needed for their role. Infrastructure and providers may process data internationally; the applicable locations depend on the configured service and provider.

4. Security, retention and backups

Access to tenant data is controlled through organisation boundaries, server-side authorisation and database row-level security. Secrets are intended to remain server-side. No security measure eliminates all risk.

Data is retained while needed to provide and secure the workspace, satisfy valid legal obligations, resolve disputes and maintain limited operational backups. The current product has not published a fixed period for every category. Deletion from active systems may not immediately remove protected backup copies; they age out under provider backup lifecycles and are not restored for ordinary product use.

5. Cookies and technical data

HexSales uses strictly necessary session, preference and Web Chat cookies described in the Cookie Policy. The tracked application does not currently enable optional analytics or advertising cookies. Technical logs are limited to operational and security metadata where practicable and are not intended to contain passwords, tokens or full private messages.

6. Your requests

Subject to the applicable relationship and law, a person may request access, correction, export, deletion, restriction or object to particular processing, withdraw consent where consent is the basis, and complain to a competent authority. Authenticated account holders can create export or deletion requests in Privacy and Data; others can use the contact form.

Requests involving customer workspace data may need to be directed to the customer organisation that controls that workspace. We authenticate the requester, review authority and scope, and may retain limited information where necessary for security, legal obligations or dispute handling. A deletion request is not an instant destructive action.

7. AI

When a business enables AI, relevant conversation content and the minimum business context needed for the reply may be sent server-side to OpenAI. HexSales avoids adding full names, email addresses, phone numbers, Telegram usernames, authentication credentials and internal identifiers to model input unless a specific function genuinely requires the data. Do not submit secrets, payment credentials or unnecessary sensitive data to prompts.

8. Changes

Material changes are published with an updated version and effective date. Where the service has a verified notification channel and applicable law requires notice, HexSales will use that channel in addition to publication.