This policy explains what data Hexring collects, why we collect it, who else touches it, where it is stored, how long we keep it, and how to get it removed.
Hexring is a service of UFUQ ZAHL Management Consultancies L.L.C S.O.C, Dubai, United Arab Emirates, Trade License No. 1545127. We decide how the data described in this policy is used and we are responsible for it. Privacy questions go to service@hexring.ai.
Contact details you give us: your name, business name, email address, and any phone number you provide.
The website URL you ask us to assess, and the connector credentials that pair your site with our system.
Audit data generated while we deliver the service: technical findings, response headers, page content we assess, and the evidence attached to each finding.
Billing data: what you bought, when, how much, the currency, and the country of your payment method. We do not receive or store your full card number.
To provision your account, pair and assess your site, deliver the work in your plan, produce your reports, answer your support requests, take payment, meet our legal and tax obligations, and keep the service secure.
Payments are processed by Stripe. When you buy a plan, your card details go directly to Stripe and are handled under Stripe's own privacy policy. We never see or store your full card number. From Stripe we receive only what we need to run your subscription and issue your invoice: your name, business name, email address, the plan you chose, the amount, and the status of each payment.
Each connected site receives its own credentials. Secrets are not reused across clients, are not included in audit reports, and are not shared outside the people delivering your plan.
Part of our assessment is automated. Text and content from the pages we assess are sent to Anthropic's API so that findings can be analysed and written up. Anthropic processes this content on our instruction and does not use data submitted through its API to train its models. If you have confidentiality obligations that prevent your website content being processed by a third-party AI provider, tell us before we pair your site.
We do not sell your data and we do not share it for advertising. We use a small number of service providers to run Hexring, and each receives only what it needs to do its job:
Stripe: payment processing and subscription billing.
GoDaddy: hosting for hexring.ai and the connector system.
Hostinger: hosting for our assessment engine and our database of findings.
Microsoft 365: sending and receiving service email.
Anthropic: automated analysis of website content, as described above.
We also share data where the law requires it, or to establish or defend a legal claim. This list is kept current: if we add a provider that handles your data, this page is updated.
Our website and the connector system are hosted with GoDaddy, in its North America region. Our assessment engine and the database of findings run on our own server with Hostinger in India. Stripe, Microsoft and Anthropic operate internationally.
This means some of your data is processed outside the United Arab Emirates. Where that happens we rely on those providers' own security measures and contractual commitments. If your organisation requires data to stay inside the UAE, tell us before you buy a plan. We will tell you honestly whether we can meet that requirement.
We keep audit data for as long as your plan is active, and for 12 months afterwards so that historical comparisons in your reports stay meaningful. Billing and tax records are kept for as long as UAE law requires. Connector credentials are removed as soon as a site is removed.
You can ask us to delete your data at any time by emailing service@hexring.ai. Removing a site removes its connector credentials from our registry immediately. We delete the rest, apart from anything we are legally required to keep, mainly billing and tax records.
You can ask what data we hold about you, ask us to correct it, ask for a copy, or ask us to delete it. Write to service@hexring.ai and we will respond within 30 days.
Each site is paired with its own credentials, secrets are never reused between clients, and access is limited to the people delivering your plan. No system is perfectly secure. If a breach affects your data, we will tell you promptly and tell you what we know.
Hexring does not sell personal or website data. We do not share it with advertisers or data brokers.
Our website uses only the cookies it needs to function. We do not run analytics or advertising cookies on it. Stripe sets its own cookies on its checkout pages to process payments and prevent fraud.
We may update this policy. The version in force is the one published on this page, with the effective date shown above. If a change materially affects how we handle your data, we tell active clients directly.