Privacy Policy
Last updated October 25, 2026
HexCorp.io L.L.C. (“HexCorp”, “we”) is a small software company in Franklin, Tennessee, USA. This policy explains what personal data hexcorp.io collects, why, who else touches it, and how to exercise your rights over it. It is written to be read, not skimmed past; if anything is unclear, email hello@hexcorp.io and a person will answer.
What this policy covers
This policy covers the hexcorp.io website and the emails we send from it. Our product sites (tageasy.io, adflowio.com, leafaficionado.io) have their own privacy notices. Our WordPress plugins run on your server and store their data in your database; the only time a plugin talks to hexcorp.io is the licence and update check described below.
What we collect, and why
Browsing the site
Our hosting provider keeps standard server logs (IP address, browser type, the page requested and the time) for security and troubleshooting, for a short period. The site’s fonts are hosted on hexcorp.io, so simply reading a page sends nothing to Google or any other font service.
Analytics and advertising measurement (only with your consent)
We use Google Tag Manager to load Google Analytics 4 and, where we run campaigns, advertising measurement tags such as the Meta Pixel. None of these load until you make a choice in the cookie banner, and they follow Google Consent Mode: decline, and no analytics or advertising cookies are set. If you accept, we record page views and product-level events (viewing a product, filtering the catalogue, clicking Download or Buy, signing up) so we can see which products and pages people actually use. Google’s own notice is at policies.google.com/technologies/partner-sites.
Where you came from
If you arrive via a link with campaign parameters (utm_source and friends), we keep the first set in your browser’s local storage (key hx_utm) so that, if you later buy something, we know which campaign led to it. When you open a checkout we pass that campaign information, the page you were on, and, if you accepted analytics cookies, your Google Analytics client ID to Lemon Squeezy as checkout metadata. This stays in your browser until you clear site data; it is not sent anywhere unless you check out.
Release notes and “Notify me”
When you ask for release notes or to be told when a product ships, we store your email address, which product you asked about and where the request came from. We send a confirmation email first and do not add you to anything until you click the link in it (double opt-in). Every email we send you afterwards contains an unsubscribe link; using it removes your address from the list. We do not use these addresses for anything else and never sell or rent them.
Free downloads
Free plugin downloads ask for an email address so we can send the setup guide and a link to the file. You can decline by clicking “Skip, just download” and the download starts anyway. If you give an address, we store it with the product you downloaded and send one onboarding email (the link again, install steps, what the Pro edition adds). You only receive release notes if you ticked that box.
Purchases
Pro licences are sold through Lemon Squeezy, which acts as the merchant of record: it collects your name, email, billing address and payment details, charges you, issues the invoice and handles sales tax and refunds. We never see your card number. Lemon Squeezy’s privacy policy is at lemonsqueezy.com/privacy. After a purchase Lemon Squeezy sends us the order details (your email address, the product and plan, the amount, the order number, and the campaign information described above), which we keep as a purchase record so we can support your licence, honour the money-back guarantee and keep our accounts.
Licence checks and plugin updates
A Pro plugin installed on your site periodically asks hexcorp.io for updates. That request carries the licence key, a per-site instance ID, the plugin version and your site’s URL, so we can confirm the licence is active (we check it with Lemon Squeezy) and hand back the right package. We do not keep a log of these requests beyond a short-lived rate-limit counter keyed to a hash of the requesting IP address.
Contact form and email
Messages sent through the contact form (name, email, topic, message) are emailed to us and are not stored in the website’s database; a per-IP counter prevents abuse and expires within an hour. We keep the conversation in our mailbox for as long as we need to deal with it.
Product demos
“Try the demo” buttons open WordPress Playground (playground.wordpress.net), a service run by the WordPress open-source project that runs a throwaway WordPress site inside your browser. Nothing you do in a demo reaches hexcorp.io; the WordPress project’s privacy policy applies there.
Cookies and local storage
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
| Consent choice | Cookie banner (Google Tag Manager) | Remembers whether you accepted or declined analytics and advertising cookies. | Up to 12 months |
_ga, _ga_* |
Google Analytics, only after consent | Tells returning visits apart from new ones. | Up to 2 years |
| Advertising pixels | Meta and ad platforms, only after consent | Measure whether a campaign led to a visit or purchase. | Per the platform, typically 90 days |
hx_utm (local storage) |
hexcorp.io | The first campaign parameters you arrived with, for purchase attribution. | Until you clear site data |
wordpress_*, wp-settings-* |
hexcorp.io | Only if you log in to the site’s admin area. | Session, or 14 days with “Remember me” |
Browsing hexcorp.io, downloading, subscribing and buying all work with analytics and advertising cookies declined. To change your choice, clear this site’s cookies and the banner will ask again. We do not currently act on browser “Do Not Track” or Global Privacy Control signals; the banner is the control.
Legal bases (EEA and UK visitors)
- Consent: analytics and advertising cookies, release-note and notification emails. You can withdraw it at any time, by declining in the banner or unsubscribing.
- Contract: processing purchases, delivering downloads you requested, licence validation and plugin updates.
- Legitimate interests: keeping the site secure and working (server logs, rate limits), answering your messages, keeping purchase records, and knowing which campaign led to a sale.
- Legal obligation: tax and accounting records of sales.
Who else sees your data
We do not sell personal data and we do not share it for anyone else’s advertising. These companies process data on our behalf:
- Our hosting provider (United States): runs the server that hosts hexcorp.io and its database, and keeps the server logs.
- Lemon Squeezy (United States): checkout, invoicing, tax, refunds and licence keys.
- Google (Tag Manager and Analytics) and, when campaigns run, Meta: measurement, only after you consent.
- Our email provider: delivers the confirmation, onboarding and release-note emails and holds our mailbox.
We may also disclose data when the law requires it, or to protect the rights and safety of HexCorp, our customers or others.
Where data is processed
We are based in the United States and the services above process data there. If you are in the EEA, the UK or Switzerland, your data is transferred to the US on the basis of the providers’ standard contractual clauses or their participation in the EU-US Data Privacy Framework.
How long we keep it
- Release-note and notification subscriptions: until you unsubscribe, after which the address is removed from the list. Unconfirmed signups are deleted after 30 days.
- Download leads: 24 months after the last download, unless you also subscribed.
- Purchase records: for as long as tax and accounting law requires, typically seven years.
- Contact messages: until the matter is closed, then a reasonable period in case it comes back.
- Analytics: per the retention setting in Google Analytics, which we keep at the default of 14 months for event-level data.
- Server logs: a short period set by the hosting provider.
Your rights
Wherever you live, you can ask us what personal data we hold about you, have it corrected or deleted, receive a copy in a portable format, object to a particular use, or withdraw consent you gave earlier. Email hello@hexcorp.io; we reply within 30 days and may ask you to confirm the address the request concerns. If you are in the EEA or UK and think we have handled your data unlawfully, you can also complain to your local data protection authority.
If you live in California, Virginia, Colorado or another US state with a privacy law: we do not sell personal information or share it for cross-context behavioural advertising, we do not use it for profiling with legal effects, and you have the access, correction and deletion rights described above without discrimination for exercising them.
Children
hexcorp.io is for businesses and adults. We do not knowingly collect personal data from anyone under 16; if you believe a child has given us data, email us and we will delete it.
Security
The site is served over HTTPS only. Subscriber and purchase records live in the site’s database behind the WordPress login, which is limited to HexCorp staff. Confirmation and unsubscribe links carry a random token so that only the holder of the email address can act on them. Payment details never reach our systems.
Changes to this policy
When we change something that matters, we update this page and the date below. If a change affects email you already receive from us, we tell you in that email first.
Contact
HexCorp.io L.L.C.
Franklin, Tennessee, USA
hello@hexcorp.io