HexCoded legal

Privacy Policy

LAST UPDATED 3 AUGUST 2026DATA FIDUCIARY Anycast Technology Private Limited, 5th Floor, DLF Two Horizon Centre, Horizon Colony, DLF Phase 5, Sector 43, Gurugram, Haryana 122002 ("HexCoded", "we")

1Scope

This policy covers personal data we process for brands (buyers), actors (who licence their likeness under the Actor Licence), and visitors to our site.

2Data we collect

All users: name, email, Google account identifier (sign-in), device/usage/analytics and advertising-measurement data, support messages.

Brands: the product links/content/references you submit; workspace and team info; billing data is collected and processed by our payment partners, Razorpay and Dodo Payments — we receive transaction status/metadata, not full card details.

Actors (sensitive — read §3): the photos/video you upload for your AI twin; a voice recording used to create your twin's voice; a liveness capture and a selfie used for face-match; the consent acceptance record (the Actor Licence clickwrap you tick, with timestamp/IP); your chosen display name; earnings records; and, only when you reach a payout, identity/tax details required for your country (e.g. PAN in India) for payment and compliance (KYC via Didit).

3Biometric / sensitive personal data (actors)

  • To confirm a twin is really you, we process a liveness check and a face-match between your selfie and your submitted twin, using AWS Rekognition as a processor. Your voice recording is processed by ElevenLabs to create your twin's voice.
  • This is biometric/sensitive personal data. We process it only with your explicit consent, captured at onboarding via the Actor Licence clickwrap, for the specific purpose of identity verification and building/operating your twin.
  • Use limit: your face/voice data is used only to build and operate your own twin — never to train general AI models (see Terms §9).
  • Retention: your consent record is kept permanently as proof that consent existed. Your master face/voice recordings are kept only while any brand content generated with your twin remains licensed, then deleted or irreversibly anonymised.
  • You can withdraw consent (see §6); withdrawal stops future processing and new generations, but does not affect content already lawfully generated/delivered (see the Actor Licence).

4How we use data

To provide and secure the Service; verify actor identity; generate and deliver ad content; calculate and pay actor earnings; process payments (via Razorpay and Dodo Payments); provide support; comply with law (tax, grievance handling); and improve the Service — including training our models on brand inputs and generated outputs (opt out anytime via support@hexcoded.ai). Actor face/voice data is never used to train general AI models (Terms §9, Actor Licence), and we don't give your content to third parties to train their foundation models.

5Who we share it with (processors & recipients)

  • Razorpay — payment processing and billing; we receive transaction status and metadata, never full card details.
  • Dodo Payments — payment processing and billing; where Dodo processes a transaction it acts as merchant of record and handles taxes/invoicing.
  • AWS (incl. Rekognition) — hosting, storage, liveness/face-match.
  • ElevenLabs — voice cloning for actor twins (we host the generated audio; models receive signed access, never a public link).
  • Didit — actor identity/KYC verification at payout.
  • AI model vendors (e.g. video generation providers) — to render content; we send the inputs needed to generate, not your account identity beyond what's required.
  • Analytics/observability (e.g. PostHog, Sentry) — product analytics, session recording, and error monitoring.
  • Meta (Meta Platforms) — advertising measurement via the Meta Pixel and Meta Conversions API; we share ad-event data and hashed identifiers only (never your plain-text email, name, address, or payment details). See §10.
  • Auth (Clerk/Google) — sign-in.
  • RB2B — business-visitor identification on our public website pages; we receive the likely company behind a visit. See §10.
  • Legal/regulatory recipients where required.

We do not sell your personal data.

6Your rights

You may request access, correction, completion, updating, or erasure of your personal data, and may withdraw consent, by contacting our Grievance Officer (§12). We'll respond within the timeframes required by law. Actors can be located anywhere (the Service accepts actors globally); rights under your local law (e.g. GDPR where it applies) are honoured per that law.

7Retention

We keep personal data only as long as needed for the purposes above or as required by law (e.g. tax/payment records), then delete or anonymise it. Biometric verification data and twin recordings: see §3.

8Security

We use reasonable technical and organisational measures (encryption in transit, access controls, secrets management). No system is perfectly secure.

9Data location & transfers

We host primarily in the United States (AWS us-east-1) and use vendors that may process data outside India.

10Cookies, analytics & advertising

We use essential cookies and product analytics (e.g. PostHog) to run and improve the Service.

Advertising measurement (Meta). We use the Meta Pixel and Meta Conversions API to measure the performance of advertisements shown on Meta platforms (Facebook, Instagram). This helps us understand which advertisements led to sign-ups and purchases so we can improve ad relevance and reduce wasted spend. Data shared with Meta includes page views, sign-up completions, and subscription activations, and — in hashed (irreversible) form only — your email address and account identifier. We do not share your plain-text email, name, address, or payment details with Meta. You can opt out of Meta advertising tracking through your Meta account settings.

Session recording. We use PostHog to record product-usage sessions in our app for internal debugging. Sensitive input fields (e.g. passwords and payment forms) are automatically masked and never leave your browser in plain text.

Business-visitor identification. On our public pages (home, pricing and legal) we use RB2B to identify the business likely behind a visit, so we can see which companies are evaluating HexCoded. We receive company-level information such as company name and domain; we do not use it to build a profile of you personally, and it does not run inside the signed-in product. To opt out, email support@hexcoded.ai.

11Children

The Service is for users 18+. We don't knowingly collect data from minors.

12Grievance Officer (DPDPA requirement)

Jivesh Gupta · support@hexcoded.ai · Anycast Technology Private Limited, 5th Floor, DLF Two Horizon Centre, Horizon Colony, DLF Phase 5, Sector 43, Gurugram, Haryana 122002. You may contact the officer for any privacy concern or to exercise your rights.

13Changes

We may update this policy; material changes will be notified in-product or by email.