Privacy Policy

01Who we are, and what this covers

Hextor Labs is the trading name of Aakarshak Chauhan, sole proprietor, registered in India under Udyam Registration Number UDYAM-UK-05-0143392 as a Micro enterprise. We design and build AI workflow automation for businesses.

This policy covers hextorlabs.com and the enquiry form on it, and it covers the personal data we handle while delivering an engagement. It does not cover any third-party website you reach by following a link from here.

02The two roles we act in

This is the most important distinction in the document, because your rights differ depending on which one applies.

As a Data Fiduciary

For people who contact us through this website, and for our own client contacts and business records, we decide why and how the data is processed. In DPDP Act terms we are the Data Fiduciary; the GDPR word for the same thing is controller. Sections 3 to 11 describe this.

As a Data Processor

Inside an engagement, the workflows we build run in your cloud accounts, under your API keys. The invoices, tickets, documents, and customer records those workflows touch belong to you. You decide what is processed and why; we act on your written instructions. In DPDP Act terms we are a Data Processor; under GDPR, a processor.

If you are an individual whose data was handled by a workflow we built for a company, that company is the fiduciary and you should approach them first. We will support them in answering you, and section 11 still reaches us.

03What this website collects

When you submit the enquiry form

The form asks for your name, phone number, and work email, and optionally your company, the workflow you are interested in, and a description of what you want built. It also records which workflow you opened the form from, so your message arrives with that context attached.

We use this only to reply to you and to scope the work. It is not added to a marketing list and there is no sales sequence — the site says one reply from a person, and that is the whole of it.

When you simply read the page

Our hosting provider keeps standard server logs — IP address, timestamp, the file requested, user agent — as every web server does. These exist for security and to keep the site running. We do not link them to you as an individual and we do not build profiles from them.

04Cookies, analytics, and advertising

Advertising and analytics cookies are on when you arrive, and one click switches them off. A notice tells you so on your first visit, and the Cookies control in the footer of every page turns them off — or back on — whenever you like. Switching them off costs you nothing: no part of this site depends on them. Your choice is remembered and applied before anything loads on your next visit.

What runs

We use the Meta pixel to see which of our advertisements on Facebook and Instagram bring in enquiries. It runs from the moment the page loads; if you switch it off, its consent is revoked before it initialises on every later visit, so it sends nothing at all. We also use Google Analytics 4 to see which pages bring in enquiries. It sets a cookie holding a pseudonymous identifier, and sends Google the page you viewed, your approximate location derived from your IP address, and your device and browser type. Google Analytics holds that at event and user level for 14 months, which section 8 explains; Meta sets its own retention for pixel data, and that one is not ours to choose.

We do not currently run Google Ads conversion tracking. If that changes, this section and the table in section 7 change with it, before the tag goes live.

Three moments are recorded as events, by Meta and by Google alike: opening the enquiry form, submitting it, and clicking through to book a call. What travels with any of them is the workflow you selected — never your name, phone number, email, company, or the text of your message. None of it is recorded once you have switched these cookies off.

These run on the two main pages of the site only. This policy, the terms, and the error page load no tracker at all, whatever your setting — reading what we collect is not itself collected.

If you switch them off

The two behave differently, and it is worth being exact about how.

For Google we implement Google Consent Mode v2. The tags still load, but in a restricted state: no cookie is written and no identifier is stored. Google continues to receive an anonymous, cookieless signal that a page was viewed, which it uses to estimate totals in aggregate. That signal cannot be tied back to you, or joined to a later visit.

For Meta there is no equivalent. Switching off revokes the pixel's consent before it starts, and it then sends nothing whatsoever — no cookie, no event, no anonymous ping.

Changing your mind

Use the Cookies control in the footer of any page, including this one. It switches these cookies off, and on again, as often as you like. Switching off takes effect immediately on a page where something is running, and on every page from the next one you open. Your choice is kept in your browser's local storage, not on our servers, which means it is per browser and per device: set it on your phone and your laptop separately. Clear this site's data and it returns to the default, with the notice shown again on your next visit. You can also block or delete cookies in your browser settings at any time, or install Google's official opt-out add-on.

Two other requests

• Formspree — only if you actually submit the enquiry form. Your form contents pass through Formspree to reach our inbox. Nothing is sent to them unless you press the button.
• Calendly — only if you choose to book a time after sending the form. The booking page opens on Calendly’s own site in a new tab, with your name and email carried across so you do not type them twice. No Calendly code runs on this page and it sets no cookie here; once you are on their site, their privacy policy governs.

The typefaces are served from this site rather than from Google Fonts, so displaying a page discloses nothing to a font CDN.

We show no third-party advertising on this site, and we do not sell what these tools collect.

05Data inside a client engagement

During an engagement we may be given access to systems containing personal data — a CRM, a support inbox, a document store. Our standing practice, which is also what the rest of the site promises:

• We build in your accounts, on your keys. The workflow's data path runs through infrastructure you own and can revoke at any moment.
• Least-privilege access controls by default — permissions are scoped to what the workflow needs in order to run, and bounded to the engagement.
• Where a model provider is involved, we configure zero-retention API endpoints where that provider offers them, and we work on commercial API tiers whose terms mean your data is never used to train models.
• We do not copy your production data onto our own machines as a matter of course. Where a sample is genuinely needed — to test an extraction rule, say — we ask first, prefer anonymised or synthetic records, and delete the sample when the work is done.
• Your data is never used to train models of ours, and it is never reused for another client.

Where you need these commitments in contractual form, we will sign a Data Processing Agreement. Ask and we will send one.

06Why we process, and on what basis

07Who else touches the data

We keep this list deliberately short. As of the effective date it is:

Inside an engagement, the model providers and cloud services involved are the ones you already use or agree to, named in the scope before the build starts. We do not introduce a sub-processor into your workflow without telling you which and why.

We do not sell personal data, and we do not share it with anyone for advertising or profiling. If we are ever compelled to disclose something by a lawful order, we will tell you unless we are legally barred from doing so.

08How long we keep things

• An enquiry that goes nowhere — deleted within 24 months, and sooner if you ask.
• Client records for a live engagement — for the engagement, and then for as long as we may need them to answer a question about work we did.
• Accounting and tax records — for the period Indian law requires, currently eight years from the end of the relevant financial year.
• Server logs — the short rolling window set by our host, measured in weeks.
• Analytics data — 14 months in Google Analytics, the longer of the two periods it offers, chosen so a season can be compared with the same season a year earlier. That limit covers event and user-level records, which are what could in principle be tied back to a single browser; the aggregated totals built from them are kept indefinitely and identify nobody.
• Anything we held as a processor — returned or destroyed when the engagement ends, on your instruction.

09How it is protected

The measures behind this are the ordinary, unglamorous ones applied consistently: encryption in transit everywhere, least-privilege access, credentials in a password manager rather than a document, multi-factor authentication on every account that supports it, and a short list of people who can reach anything at all.

Nobody can honestly promise a breach will never happen. What we will promise is that if one occurs we will notify the Data Protection Board of India and the people affected as the DPDP Act requires, and any client whose data is involved, without waiting to be asked.

10Your rights

Under the DPDP Act, where we are the Data Fiduciary, you have the right to:

• Know what we hold — a summary of your personal data being processed and what we are doing with it.
• Have it corrected, completed, updated, or erased.
• Withdraw consent you previously gave, as easily as you gave it. This does not undo processing already lawfully carried out.
• Nominate someone to exercise these rights for you if you die or become incapacitated.
• Raise a grievance with us and get an answer, before escalating to the Data Protection Board of India.

Write to the address in section 11. We answer within 30 days and we do not charge for it. We may need to confirm you are who you say you are before acting — that check exists to stop someone else exercising your rights.

11Grievance Officer

The DPDP Act requires a named person to answer data questions. That person is:

If you have raised something with us and are not satisfied with how it was handled, you may complain to the Data Protection Board of India.

12If you are in the EU or the UK

We work with clients outside India, so where the GDPR or UK GDPR applies to our processing, we honour it. In addition to the rights in section 10 you have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to complain to your national supervisory authority.

One point of difference to be candid about: the cookie posture in section 04 is built to the DPDP Act, which does not impose the prior-consent rule that the EU's ePrivacy regime applies to non-essential cookies. If you are in the EU or the UK and would rather those cookies had never run, switch them off with the footer control and tell us; we will honour an objection and can confirm in writing what was collected before you did.

Personal data may be transferred to and processed in India and, in the case of the form provider named in section 7, the United States. Where we act as your processor we will enter into a Data Processing Agreement incorporating the European Commission's Standard Contractual Clauses, and the UK Addendum where relevant. Ask and we will send it.

13Children

This is a business-to-business service. It is not directed at children and we do not knowingly collect the personal data of anyone under 18. If you believe a child's data has reached us, tell the officer in section 11 and we will delete it.

14Changes to this policy

When this changes, the effective date and version at the top change with it. If a change materially affects how we handle data we already hold about you, we will contact you directly rather than relying on you noticing a new date.

15Contact

For anything about this policy, or to exercise a right under it:

The full registered address is available on written request, and to any regulator entitled to it.