Privacy Policy

HexaSpex is operated by an individual based in Switzerland, serving users worldwide. The operator is the controller of the personal data described in this policy. Contact details are shown above when configured, and via the Terms of Use.

This policy applies to anyone who uses HexaSpex, wherever they are located. HexaSpex treats the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR), and the UK GDPR as its baseline standard — GDPR and UK GDPR can apply to a non-EU/UK operator that offers services to people located in the EU/UK, which HexaSpex does.

Account details from Google Sign-In (name, email, profile picture); the research artifacts you create (chats, dashboards, watchlists/portfolios, saved screens and reports, valuation theses, Investor Profile preferences, feedback); credit and billing records (HexaCredit ledger, subscription history, tax records for the country your payment was made from); and public share payloads you choose to create. We use this data to operate the product (run your requests, save your work, meter AI usage, process payments), to secure accounts, to comply with tax/accounting obligations, and — only with respect to product feedback — to improve HexaSpex.

Holdings you enter (tickers, share counts, cost bases) can reveal financial preferences or circumstances; treat what you enter accordingly, and avoid entering anything more sensitive than necessary.

We process account and product data to perform our contract with you (providing the service you signed up for), on the basis of legitimate interests (security, fraud prevention, service improvement, exercising or defending legal claims), to comply with legal obligations (tax, accounting, responding to lawful requests), and — for payment processing and any optional communications — as necessary to perform the subscription or purchase you requested.

HexaSpex uses a small number of first-party cookies and localStorage keys — necessary for the app to function, not for tracking or advertising. The hexaspex_session cookie holds your signed-in session. localStorage holds an anonymous profile id (used before you sign in), dashboard layout, interface preferences, and recent command-palette items. Stock Report session results may use sessionStorage for up to six hours. Clearing site data removes these browser copies, but not data already saved to the server. HexaSpex does not load any analytics, advertising, or tracking script — see Cookies below.

HexaSpex stores Google account claims, chats and folders, dashboards, watchlists/portfolios, saved screens and reports, manual valuation theses, investor profiles, feedback, credits and their ledger, generated-report caches, transcript summaries, subscription and purchase records, tax evidence, Terms/Privacy acceptance records, and public shares on our servers.

Google sign-in creates an authenticated session. Before sign-in, a signed first-party browser cookie binds selected temporary records to that browser; it is not an account credential, and clearing it removes the browser's continuity. Do not put confidential material into chat attachments or free-text fields. Attachments are sent for the current AI turn but their raw contents are not stored in chat history.

Subscription and credit-purchase transactions are handled through Stripe Managed Payments, where Stripe/Link may act as Merchant of Record for the transaction. HexaSpex never receives or stores your card credentials. Stripe shares with us the confirmation, status, and amount of a payment, and — for tax-jurisdiction purposes — the country associated with the payment. See Stripe's own privacy policy for how it processes payment-side data and fulfills the responsibilities it officially assumes. HexaSpex separately processes account, entitlement, research, and service-delivery data.

Tickers and research requests may be sent to Financial Modeling Prep through our configured direct or RapidAPI transport, and to SEC EDGAR. AI prompts may send public market context together with relevant chat text, attachment excerpts, or investor-profile text to DeepSeek. Google verifies sign-in tokens. Stripe/Link handles Managed Payments transactions. Resend delivers transactional emails (e.g. watchlist report notifications) when you opt in. Neon hosts our Postgres database, Railway hosts the backend services, and Vercel hosts the web application. Each provider processes data under its own terms and privacy policy.

Because HexaSpex serves users worldwide with infrastructure and providers located in multiple countries, your data may be processed outside your own country, including outside the EEA/UK. Where EU/UK data is transferred to a country without an adequacy decision, we rely on the providers' own appropriate safeguards (such as Standard Contractual Clauses) for that transfer.

We keep your product data for as long as your account is active. Billing, tax, and Terms/Privacy-acceptance records are kept for the period required by applicable accounting and tax law even after an account is deleted. Individual chats, watchlists, saved theses, and reports can be deleted directly from their product flows at any time.

Depending on where you live, you may have the right to access, correct, delete, or export your data, to object to or restrict certain processing, and to withdraw consent where processing relies on it. Use Export my data and Delete my account on your Account page for the self-service versions of these rights; deletion removes everything with no continuing legal/accounting retention need. For anything the self-service tools don't cover, or to object, restrict, or correct data, contact us using the details above — we handle these requests personally since HexaSpex is operated by one person. If you are in the EEA/UK/Switzerland, you also have the right to lodge a complaint with your local data protection authority.

Stock Report and valuation-thesis share links are public to anyone who has the link. Crawlers are asked not to index them, but the link itself is the access key. Shares currently have no automatic expiry or self-service revoke control — delete the underlying report/narrative to remove a share.

HexaSpex does not use analytics, advertising, or tracking cookies of any kind. The cookies and localStorage keys it does use are strictly necessary for sign-in, session security, and remembering your own preferences (see "Local browser storage" above) — we do not show a cookie-consent banner because there is nothing optional to consent to. If that ever changes, this policy and a consent control will be updated first.

HexaSpex is not directed at children and we do not knowingly collect data from anyone under 18. Creating a paid subscription or making a purchase requires confirming you are at least 18.

We use industry-standard measures — encrypted transport, signed session cookies, server-side authorization checks, and restricted administrative access — to protect your data. No system is completely secure; contact us if you believe your account has been compromised.