Privacy

1. The short version

This site measures visits with Google Analytics. If you request a brief or book a call, we get what you type. If your company uses Hexmark, we hold your sign-in email and the customer data your company connects, which is a customer ID and a ZIP code, never a name. We do not sell personal information.

Hexmark Labs, Inc. (“Hexmark”, “we”) runs hexmark.io and app.hexmark.io. Questions and requests go to hexmark@hexmark.io.

2. Visiting hexmark.io

We use Google Analytics, loaded through Google Tag Manager, on hexmark.io and on the free-trial signup page at app.hexmark.io. It counts page views and a few events: requesting a brief, booking a call, using the seat calculator, reading a comparison page, which button you used to reach the brief, demo, pricing or signup pages, and, on the brief form and the signup page, starting the form and a failed attempt (which field and what kind of failure, never what you typed). On the signup page it also counts a sent signup request. Google Analytics sets cookies and receives the page you are on, your browser and device, and an approximate location. Once you sign in, the product runs no analytics script. Vercel, which hosts the site, also counts page views without cookies.

A few steps after the signup page happen where no analytics script runs, so our server reports them to Google Analytics itself: your account being created, a checkout started, cancelled or left to expire, a brief whose answers show an expansion underway, and later what happened to the subscription: the trial starting, the first payment and its amount, a failed payment, and a trial or subscription being cancelled or ending. Each is sent with the Google Analytics identifiers your browser already had, so it is counted against the visit that started it. It carries the line of work and seat count you chose and an account number we generate, never your email, name, company or card details. If Google Analytics set no identifier, because you are in the European Economic Area, the United Kingdom or Switzerland, or because you blocked it, nothing is sent.

The first time you arrive, your browser stores the page you landed on, the site that sent you, any campaign tags in the link, and the time. The landing page and campaign tags go to Google Analytics with the events above, so we know which page did the work. The referring site and the time stay in your browser.

We advertise on Google Search. If you arrive by clicking one of those ads, the link carries a click ID from Google, and Google Ads sets a cookie, here and on the signup page, so it can tell us whether the click led to a brief, a booked call or a signup. Your browser keeps the click ID for 90 days, and if you request a brief or start a free trial it is stored with your request or your account. We use it to report back to Google Ads which clicks became customers, and for nothing else. We do not build advertising audiences from visitors to this site, and we do not show you our ads elsewhere because you came here.

If you visit from the European Economic Area, the United Kingdom or Switzerland, Google Analytics and Google Ads run without setting cookies.

You can block or delete cookies and site storage in your browser, or install Google’s Analytics opt-out add-on. The site works without them.

3. Requesting a free brief

When you request a brief we collect your email address, your company name if you give one, the address or market and line of business you choose, and your answers about locations and planned openings. To tell people from bots, Cloudflare Turnstile checks your browser. The brief record keeps only a one-way hash of your IP address, used to limit abuse. It also keeps the Google Analytics identifiers for your visit, if Google Analytics has set them, so that what happens with the brief later can be counted against the visit that asked for it.

We use your email to send the brief and to follow up about it. We may also send you occasional Hexmark updates. Every one has an unsubscribe link, and unsubscribing does not affect the brief.

Addresses you type are looked up with the US Census Bureau geocoder and with Photon, an open geocoder run by Komoot. Those lookups carry the text you typed and come from our servers, so neither service sees your IP address.

4. Booking a call

Bookings are handled by Cal.com, embedded on the booking page. The name, email and anything else you enter go to Cal.com and to us, and Cal.com’s own privacy policy covers how it handles them.

5. Using the Hexmark product

Your account. We hold your email address, your role and company, and when you last signed in. Signing in works by a one-time link we email you; the link expires after 15 minutes and we store it only in hashed form. A session cookie keeps you signed in for up to 24 hours.

Your company’s data. Your company decides what to connect, and we process it on your company’s behalf, as the terms describe. Hexmark reads a customer ID and a ZIP code or coordinates, and optionally a city, a state, which of your locations a customer belongs to, and numbers such as spend or visits. It has no field for a name, a street address, an email, a phone number or a date of birth. The security page covers this in detail. Your own business locations are geocoded with the US Census Bureau geocoder.

Payment. Subscriptions are paid through Stripe. Card details go to Stripe and never reach us; we keep the Stripe customer and subscription IDs and the status of your subscription.

Maps. The map in the app loads its base map from OpenFreeMap, which receives your IP address when your browser requests map tiles.

6. Who processes it for us

We use these services to run Hexmark, and they process data only for us:

• Google Cloud: hosting, database and logs for the product, in the United States
• Vercel: hosting and cookieless page counts for this site
• Google Analytics and Google Tag Manager: site analytics
• Google Ads: measuring which of our search ads led to a brief or a call
• Cloudflare Turnstile: bot checks on the brief form
• Cal.com: call booking
• Resend: sign-in links, briefs and other email
• Stripe: payments
• US Census Bureau and Komoot Photon: turning typed addresses into coordinates
• OpenFreeMap: map tiles in the product

We do not sell personal information, and we do not share it for targeted advertising.

7. How long we keep it

Brief requests are kept until you ask us to delete them. When we delete one, we keep a one-way code derived from your email address so that the free brief stays one per address; it cannot be turned back into your email.

Account details are kept while you have an account and deleted when your company’s admin removes you. Your company’s data is deleted after a subscription ends, on the schedule in the terms. Server logs, which record IP addresses and can include an email address when a sign-in email fails to send, are kept for about 30 days. Records we must keep for tax and accounting are kept as long as the law requires.

8. Your choices and requests

Email hexmark@hexmark.io to see what we hold about you, correct it, or have it deleted, and we will reply within 30 days. You can unsubscribe from updates at any time from the link in any email.

If you are a customer of a business that uses Hexmark, that business controls your record, and we will pass your request to them. As the section on the product explains, that record is an ID and a ZIP code, not your name.

9. Security

Data is encrypted in transit and stored with Google Cloud, which encrypts it at rest. Access within Hexmark is limited to the people who run the service. If a breach affects your information, we will tell you without undue delay.

10. Children

Hexmark is a business product and is not directed to children. We do not knowingly collect information from anyone under 16.

11. Changes

When we change this page, the date at the top changes. If a change is material, we will also email the admins of companies that use Hexmark before it takes effect.