Privacy policy

Who we are

Hexagonfly Tech is the trade name of Toshiro Andee, sole trader (French SIRET 894 850 825 00015), who builds websites and web apps for small businesses in Mauritius and France.

Contact for any question about your data: contact@hexagonfly.tech.

Scope

This policy covers hexagonfly.tech and the websites and apps we build and host for our business clients: appointment booking, reservations, admin area and the connection of their WhatsApp Business number.

On our clients' websites, the business is the controller of its own customers' data. Hexagonfly Tech acts as a technical service provider (processor) and processes that data only to run the service, on the business's instructions.

Data we process

On hexagonfly.tech: the quote form stores nothing, it prepares a message that you send yourself through WhatsApp. Google Analytics measures traffic statistically.

Appointments and reservations: name, phone number, email address, chosen service or product, date and time, and any note left for the business.

Business admin area: login email address and role of each user.

WhatsApp Business connection: when a business connects its number through Meta's Embedded Signup, we receive its WhatsApp Business Account ID, the ID and display name of its phone number, and an access token. The token is stored encrypted and used only to send that business's messages.

How we use data

Data is used only to provide the service: record an appointment or reservation, notify the business, and send the customer service messages (confirmation, reminder, cancellation) by email or WhatsApp, from the business's own number and with Meta-approved templates.

We do not send marketing messages, do not read WhatsApp conversations, never sell or rent any data, and do not use it to train artificial intelligence models.

Service providers

Website hosting: Vercel Inc. (United States). Database: Supabase (servers in India). Files and images: Cloudflare R2. Emails: Brevo (France). WhatsApp messages: Meta Platforms (WhatsApp Business Platform). Analytics for hexagonfly.tech: Google Analytics.

These providers only receive the data needed for their service. Some are located outside the European Union and Mauritius; transfers rely on their standard contractual clauses.

Retention

Appointment and reservation data is kept while the business uses the service, then deleted no later than 3 months after its contract ends.

The WhatsApp connection (IDs and token) is erased as soon as the business disconnects its number from its admin area, or when its contract ends.

Your rights and data deletion

Under the GDPR and the Mauritius Data Protection Act 2017, you may request access to, correction or deletion of your data, or object to its processing.

To delete your data: email contact@hexagonfly.tech with the website concerned and the email address or phone number you used. We delete the data within 30 days and confirm it to you. You may also contact the business directly.

Businesses: you can disconnect your WhatsApp number at any time from your admin area, which immediately erases the access token. You can also remove the Hexagonfly Tech app's access in your Meta Business portfolio settings.

You may also lodge a complaint with a data protection authority: the CNIL in France or the Data Protection Office in Mauritius.

Security

All traffic is encrypted (HTTPS). Each business's data is isolated: a business can only see its own data. Access tokens are stored encrypted.