Privacy Policy

Last updated: July 2026

HEXRATE LTD (company number 16665404), 38 Princess Park Manor, Royal Drive, London, United Kingdom, N11 3FL, is the data controller for Hexrate. This policy explains what we collect and why. Questions: [email protected].

What we collect from you

• Account data: your email address, a hashed password, and the IP address recorded at signup (kept for abuse prevention for as long as the account exists). We do not require your name. The email address is contractually required: without it we cannot create the account or send billing notices.
• Instagram data: publicly available profile and post information for the accounts you connect, track or look up (follower counts, posts, engagement, audience signals). We collect it through third-party data providers; we never ask for your Instagram password.
• Billing data: handled by Stripe. Your card number never touches our servers; we store your Stripe customer reference, subscription state, order history, your billing address (used for tax calculation) and a record of the consent you gave at checkout (what you agreed to and when), which we keep as evidence for payment disputes.
• Usage data: feature usage counters tied to your plan limits, and standard technical logs (IP address, browser) kept for security and debugging.

Data about people who are not Hexrate customers

The service analyses publicly available Instagram information about accounts our customers choose to track or look up, and maintains a directory of public creator profiles. This can include personal data (a public profile’s name, picture, follower statistics and public posts) of people who have no relationship with Hexrate. We process it on the basis of legitimate interest: providing analytics about publicly visible social-media activity, in the form its owners chose to make public. We do not collect private accounts’ content, and we do not enrich public data with non-public sources. If you are the owner of a public profile and want it removed from our directory, email [email protected] and we will remove it.

Why we process it

• To provide the service you subscribed to, and to send you service emails about your account and billing (performance of our contract).
• To bill you and keep legally required accounting records (legal obligation).
• To prevent abuse of trials, promo codes and usage limits, and to keep the service secure, including technical logs (legitimate interests).

We do not sell personal data, and we do not send marketing email without your consent.

Who processes it for us

Service providers acting under contract: Stripe (payments), our hosting and infrastructure providers (servers, content delivery, file storage), Instagram data providers (public profile data), an AI text provider used to generate analytics summaries from the same public data, and Google Tag Manager for the analytics described under Cookies. Some providers process data outside the UK/EEA; those transfers rely on UK-approved safeguards (the UK IDTA or the International Data Transfer Addendum to the EU Standard Contractual Clauses). Email us for a copy of the relevant safeguard.

How we protect it

All traffic to Hexrate is encrypted in transit (HTTPS/TLS). Passwords are stored only as salted hashes, never in readable form. Card details are held by Stripe, a PCI DSS Level 1 certified payment processor, and never touch our servers. Access to production data is limited to the people who need it to operate the service, and our infrastructure runs on established providers with their own security certifications.

How long we keep it

• Tracking history: for your plan’s retention window (shown on the plan page).
• Account data: until you delete your account. Deletion removes your connected data, files and analytics from the service. Public directory information about the Instagram profile itself (the publicly visible data described above) may remain, since it exists independently of your Hexrate account; email us to have it removed as well.
• Technical logs: up to 90 days.
• Billing records, order history and checkout consents: up to 6 years after the transaction, as required for UK tax and dispute-evidence purposes, even if the account is deleted.

Your rights

Under UK GDPR you can ask us for access to your data, its correction, deletion, restriction of processing, portability, or to object to processing based on legitimate interest; where processing is based on consent you can withdraw it at any time. Email [email protected] and we will respond within one month. You can also complain to the Information Commissioner’s Office (ico.org.uk).

Cookies

The dashboard uses cookies for your session and security, an affiliate-attribution cookie when you arrive through a partner link, and analytics cookies set through Google Tag Manager that help us understand signup and checkout performance. We are rolling out a cookie consent control for the analytics cookies; until then you can block them in your browser without affecting the service.

Changes

If this policy changes materially we will tell you by email before the change applies.