Last updated 20 October 2026

Privacy policy

This explains what personal information Hexwork collects, why, who it's shared with and the choices you have. It covers people who use Hexwork to build sites (customers) and people who visit or contact those sites (visitors).

Who we are

Hexwork is run by the business that runs Hexwork. For your account and Hexwork itself, we are the data controller.

For the sites our customers build, the customer is the controller of their visitors' information and we process it on their behalf, as their hosting provider.

What we collect from customers

Account details: your name, email address, a scrambled (hashed) password, and your Google account ID if you sign in with Google.
What you build: your messages to the builder, the files and images you upload, your sites' pages, brand details and settings.
Billing: your plan, credits and payment history. Card details are taken and stored by Stripe, never by us.
Security records: sign-in attempts, the IP address and browser used, and a log of important account changes.
Support: questions you ask our help assistant or send us by email.

What sites collect from their visitors

Visit counts: the page, the referring site, the device type and an anonymous visitor code. We don't store visitors' IP addresses for this, and it uses no cookies.
Form messages and bookings: whatever the visitor types into a site's forms or booking calendar, plus the IP address it was sent from (kept to stop spam).
Third-party tools: customers can connect tools like Google Analytics, a Meta Pixel or a chat widget. Tools that set tracking cookies load only after the visitor accepts cookies, and those companies' own privacy policies apply.

Why we use it, and our lawful basis

To provide the service you signed up for (contract): building and hosting your sites, taking payments, sending account and billing emails.
To keep Hexwork safe (legitimate interests): stopping fake sign-ups, spam, fraud and abuse, and scanning published sites for phishing and malware.
To improve Hexwork (legitimate interests): understanding which features are used and fixing problems.
Tips and offers by email (legitimate interests, for our own customers): you can stop these with the link in any of them or in your account settings.
To meet legal duties (legal obligation): keeping payment records for tax.

Who we share it with

We never sell personal information. We share it only with companies that help us run Hexwork, under contracts that limit what they can do with it:

Our hosting provider, whose servers in the UK store your account and sites.
AI model providers, which process your messages and site content to write and change your site. They don't use it to train their models.
Stripe, for card payments, subscriptions and customers' own shop payments (Stripe Connect).
Google, if you choose to sign in with Google.
Our domain registrar partner, when you buy a domain. Domain rules require the owner's contact details to be held by the registry.
Twilio, if you use text alerts or text reminders.
Amazon Web Services, which sends email campaigns and sign-up confirmation emails for sites that use Email campaigns.
Stock photo libraries, which receive search words only, never personal information.

Some of these companies are based outside the UK. Where information leaves the UK, it's protected by the UK's adequacy rules or the standard contract clauses approved by the ICO. We may also share information if the law requires it.

How long we keep it

Your account and sites: until you delete them. When you delete your account, your sites and files are deleted and your account details are wiped straight away.
Payment records: six years, as UK tax law requires, with no name attached once your account is deleted.
Build progress logs: 14 days. Help assistant chats: 30 days. Sign-in attempts: 7 days.
Visitors' form messages and bookings: until the site owner deletes them, or the site is deleted.
Mailing lists: until the site owner removes someone, or the site is deleted. People who unsubscribe stay on file as unsubscribed so they're never emailed again. Sign-ups that are never confirmed are deleted after 30 days.
Backups: overwritten on a rolling basis, so deleted information disappears from them over time.

The Hexwork beta

If you apply to test Hexwork, we collect what you put on the form: your name, email address, town and country, the tools you use now, your two written answers, how much time you could give, and your Reddit username if you add one. The form also notes how the two answers were typed (how often pasting was tried, how many keys were pressed and how long each answer took), never the keys themselves. We keep the IP address the application came from, to stop abuse.

We use this to choose testers (legitimate interests). A short automated check, run by an AI model provider, scores each application and says how likely the answers are to be AI-written. High scores get a seat straight away and the rest wait for a person or go on the waitlist, and we can move anyone between them. If you'd like a person to look at your application again, email us.

Testers' feedback and any screenshots go to the Hexwork team. A short copy (your first name, the kind of feedback and its text, never your email address) is posted in a private, staff-only channel on our Discord server.

How long we keep it: applications that aren't accepted are deleted after 90 days, and ones that are never confirmed after 7 days. Testers' applications are kept with their account. Feedback is kept while it helps us improve Hexwork, and goes when you delete your account.

Cookies

Hexwork uses only the cookies it needs to work: one to keep you signed in, one that lets you see your own site previews, and one that remembers who referred you (30 days). We don't use advertising or tracking cookies. Sites built with Hexwork show a cookie notice when they use any non-essential cookies.

Your rights

You can ask to see, correct, delete or move your information, and you can object to how we use it. Download all your data at any time from your account page, and delete your account from there too. For anything else, email us and we'll reply within a month.

If you're a visitor to a site built with Hexwork, contact that site's owner first, since they control your information. We'll help them answer you.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office.

Changes

If we change this policy in a way that matters, we'll email you before it takes effect.