Privacy Policy

1. Introduction

Hexomation Inc. (“Hexomation”, “we”, “us”, or “our”) operates the BAaaS.io platform and hexomation.com (the “Services”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information. By using our Services, you agree to this policy.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email, company name, job title, and password.
• Billing Information: Payment details processed securely via Paddle. We do not store raw card data.
• Communication Data: Messages and support tickets you send us.
• Configuration Data: BACnet device configurations, site settings, and automation schedules.

2.2 Automatically Collected Information

• Usage Data: Pages visited, features used, session duration, and interaction logs.
• Device & Network Data: IP address, browser type, OS, and referring URLs.
• IoT Telemetry: BACnet device telemetry, present values, trend data, and alarm events from your Gateway.
• Cookies: Essential cookies for authentication and optional analytics cookies.

3. How We Use Your Information

• Provide, operate, and maintain the BAaaS.io platform.
• Process transactions and manage your subscription.
• Send transactional emails (confirmation, password reset, invoices).
• Respond to support requests and troubleshoot issues.
• Monitor platform health, performance, and security.
• Improve our Services through aggregated, anonymised analytics.
• Comply with applicable legal obligations.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4. Data Sharing & Third-Party Services

• Microsoft Azure: Cloud infrastructure (IoT Hub, AKS, Cosmos DB, Azure OpenAI).
• Paddle: Payment processing and subscription management.
• Azure Communication Services: Transactional email delivery.
• InfluxDB Cloud: Time-series telemetry storage.

All processors are bound by data processing agreements and applicable privacy laws.

5. Data Retention

• Account Data: Retained for the subscription duration plus 90 days after closure.
• IoT Telemetry & Trend Data: Per your subscription plan retention tier.
• Audit Logs: 12 months.
• Billing Records: 7 years as required by financial regulations.

6. Data Security

• TLS 1.2+ encryption for all data in transit.
• AES-256 encryption for data at rest in Azure Cosmos DB and Blob Storage.
• X.509 certificate-based mutual authentication for IoT Gateway connections.
• Role-based access control (RBAC) with multi-factor authentication support.
• Regular security audits and vulnerability assessments.

7. Cookies

• Essential Cookies: Required for authentication and core functionality. Cannot be disabled.
• Analytics Cookies: Optional — understand how visitors use our site. Opt out via our cookie banner.

8. Your Rights

• Access a copy of your personal data.
• Rectify inaccurate or incomplete data.
• Erase your personal data (right to be forgotten).
• Port your data in a structured, machine-readable format.
• Object to processing for direct marketing.
• Withdraw consent at any time where processing is consent-based.

Contact privacy@hexomation.com to exercise any right. We respond within 30 days.

9. International Data Transfers

Your data may be processed in Microsoft Azure data centres outside your country, including the US and EU. We apply Standard Contractual Clauses or equivalent safeguards for cross-border transfers.

10. Children’s Privacy

Our Services are for business users aged 18+. We do not knowingly collect data from individuals under 18. Contact privacy@hexomation.com if you believe we have done so inadvertently.

11. Changes to This Policy

We may update this policy periodically. Material changes will be notified by email or in-platform notice at least 14 days before taking effect. Continued use constitutes acceptance of the updated policy.

12. Contact Us

Hexomation Inc.
Email: privacy@hexomation.com
Website: hexomation.com/contact