Privacy Policy

Introduction

At Hexagon ("we," "us," or "our"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services. Hexagon operates through the following entities:

• Hexagon Labs, Inc. — a company incorporated in the United States, providing the Hexagon SaaS platform for SKU-level Generative Engine Optimization (GEO).
• Hexagon Solucoes LTDA (trade name: "Hexagon IA"), CNPJ 64.953.528/0001-68 — a company incorporated in Brazil, located at Rua Pais Leme, 215, Pinheiros, São Paulo - SP, CEP 05424-150, operating WhatsApp-based conversational commerce services for merchants and consumers in Brazil.

Hexagon Labs, Inc. and Hexagon Solucoes LTDA are related entities under the same ownership and management. The applicable data controller depends on the services you use: Hexagon Labs, Inc. for the GEO SaaS platform, and Hexagon Solucoes LTDA for WhatsApp commerce services in Brazil.

By accessing or using Hexagon, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.

Information We Collect

Account Information

When you create an account, we collect:

• Name and email address
• Company name and business information
• Password (encrypted and never stored in plain text)
• Billing and payment information (processed securely through third-party payment processors)

Product Data

To provide our services, we collect and process:

• Product SKUs, names, descriptions, and specifications
• Product images and pricing information
• Inventory levels and availability data
• Product categories and metadata
• E-commerce platform integration credentials (stored encrypted)

Usage Data

We automatically collect information about how you use our platform:

• Pages viewed and features accessed
• Time spent on the platform
• Device information (browser type, operating system, IP address)
• Analytics data about visibility performance and AI citations

AI Search Data

To track your products' performance in AI search results, we collect:

• Search queries and prompts where your products appear
• AI platform responses mentioning your SKUs
• Competitor product mentions and positioning
• Visibility metrics and citation frequency

WhatsApp Commerce Data (Hexagon Solucoes LTDA)

When you interact with our WhatsApp commerce services operated by Hexagon Solucoes LTDA in Brazil, we may collect:

• WhatsApp phone number and profile name
• Delivery addresses provided during checkout
• Order history, product selections, and transaction details
• Payment information: for card payments, card data is tokenized and securely stored through PCI-DSS compliant third-party vault services — we never store raw card numbers; for PIX payments, we process transaction identifiers only
• Conversational data exchanged through WhatsApp for order processing and customer support
• CPF (tax identification number) when required for payment processing or invoicing

How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our GEO services
• Track your products' visibility across AI platforms (ChatGPT, Perplexity, Claude, Gemini, etc.)
• Generate AI-optimized content for your products
• Analyze and improve your SKUs' performance in AI search results
• Process WhatsApp commerce orders, payments (PIX and card), shipping, and delivery
• Facilitate communication between merchants and consumers through WhatsApp
• Send you service notifications, order updates, shipping tracking, and marketing communications (with your consent)
• Process billing and payments
• Detect, prevent, and address technical issues or fraudulent activity
• Comply with legal obligations, including Brazilian consumer protection and tax regulations
• Develop new features and improve our platform

Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

Service Providers

We share data with trusted third-party service providers who assist us in operating our platform, including:

• Cloud hosting providers (for data storage and processing)
• Payment processors (for SaaS billing and WhatsApp commerce transaction processing, including PIX and card payments in Brazil)
• PCI-DSS compliant card tokenization and vault services (for secure handling of payment card data)
• Analytics services (for usage insights)
• AI/ML service providers (for content generation and optimization)
• WhatsApp Business API providers (for message delivery and commerce flows)

Legal Requirements

We may disclose your information if required by law or in response to valid legal requests from government authorities.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

Data Security

We implement industry-standard security measures to protect your information:

• End-to-end encryption for data in transit (TLS/SSL)
• Encryption at rest for sensitive data
• Regular security audits and vulnerability assessments
• Access controls and authentication requirements
• Secure data centers with physical security measures

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Data Retention

We retain your information for as long as necessary to:

• Provide our services and maintain your account
• Comply with legal obligations (tax, accounting, etc.)
• Resolve disputes and enforce our agreements

When you delete your account, we will delete or anonymize your personal information within 90 days, except where we are required to retain it by law.

Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Portability: Request a copy of your data in a machine-readable format
• Objection: Object to our processing of your information
• Restriction: Request that we restrict processing of your information
• Opt-out: Unsubscribe from marketing communications

To exercise these rights, please contact us at [email protected]. We will respond to your request within 30 days.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to:

• Maintain your session and keep you logged in
• Remember your preferences
• Analyze platform usage and performance
• Deliver personalized content

You can control cookies through your browser settings, but disabling cookies may limit your ability to use certain features of our platform.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. When we transfer your data internationally, we ensure appropriate safeguards are in place to protect your information in accordance with applicable data protection laws.

Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately and we will delete it.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Additional Rights for EU, California, and Brazilian Residents

For EU Residents (GDPR)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

• Right to lodge a complaint with a supervisory authority
• Right to withdraw consent at any time
• Right to data portability in a structured, commonly used format

For California Residents (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect, use, and disclose
• Right to request deletion of your personal information
• Right to opt-out of the sale of your personal information (we do not sell personal information)
• Right to non-discrimination for exercising your CCPA rights

For Brazilian Residents (LGPD)

If you are located in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD — Law No. 13,709/2018). For WhatsApp commerce services, Hexagon Solucoes LTDA (CNPJ: 64.953.528/0001-68) is the data controller. Your rights include:

• Confirmation of the existence of processing of your personal data
• Access to your personal data
• Correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion of unnecessary or excessive data
• Data portability to another service or product provider
• Deletion of personal data processed with your consent
• Information about public and private entities with which we share your data
• Information about the possibility of denying consent and the consequences thereof
• Revocation of consent

We process your personal data based on the following legal bases under the LGPD: consent, performance of a contract, legitimate interest, compliance with legal obligations, and fraud prevention.

To exercise any of these rights, contact us at [email protected].