Privacy Policy

Version	Date	Key Updates
1.0	01-Jan-2026	Initial Release
1.1	25-Jan-2026	Enhanced Security Infrastructure & GDPR Opt-in Alignment

1. Introduction

Welcome to Hextra. We are committed to protecting your privacy and ensuring a secure experience as you transition into micro-entrepreneurship. Our platform is built with a “Privacy by Design” approach. We aim to align our operations with global privacy standards, including the General Data Protection Regulation (GDPR) and ISO/IEC 27001 information security management frameworks.

2. Information Collection & Active Consent

To provide personalized coaching, we collect information through our proprietary intake process.

• Active Consent (Opt-in): In alignment with GDPR, we utilize a mandatory active consent (Opt-in) mechanism at the start of the intake process. Every user provides informed, explicit permission before any data is collected or processed.
• Data Minimalism: We adhere to the principle of data minimalism, collecting only the information strictly necessary for the Income Coach Agent’s functionality.
• User Context File: Collected data includes professional background, personal assets/interests, availability, and contact information.

3. How We Use Your Information

We use the information in your User Context File to facilitate the Hextra User Journey and help you become a successful micro-entrepreneur. Specific uses include:

• Income Idea Generation: Analyzing your background to suggest personalized income streams.
• Service Refinement: Helping you focus ideas into specific, marketable niches.
• Action Plan Development: Generating comprehensive business plans covering pricing, marketing strategies, legal considerations, and client interaction protocols.
• Digital Identity (DI) Creation: Utilizing your data to build a transparent digital footprint that aids in your marketing, messaging, and service showcasing.
• Internal Improvement: Enhancing our AI models and coaching algorithms to provide better recommendations.

4. Data Sharing and Disclosure

We do not sell your personal data to third parties for marketing purposes. However, we may share your information in the following circumstances:

• Workforce Centers and Corporate Partners: If you are accessing Hextra through a workforce center or a corporate transition program, we may share progress reports or high-level data with those organizations as part of our service agreement with them.
• Cloud Infrastructure: We utilize Amazon Web Services (AWS) for secure data storage and processing.

5. Data Security Standards

To protect personal information, we implement a management system aligned with ISO 27001:

• Encryption: All data is encrypted at rest (AES-256) and in transit (TLS 1.2+).
• Access Control: We enforce strict Identity and Access Management (IAM) and Multi-Factor Authentication (MFA) for all internal systems.
• Staff Readiness: All technical personnel complete mandatory security training annually to ensure a continuous culture of awareness.

6. Risk, Resilience & Rights

• Resilience: We conduct regular Risk Assessments, Disaster Recovery (DR), and Business Continuity (BCP) testing to ensure system integrity.
• Subject Rights: We fully support Data Subject Rights under GDPR. You have the right to:
  • Access, rectify, or delete your personal information.
  • Object to or restrict certain processing activities.
  • Withdraw consent at any time.

7. Contact Us

For any questions regarding this policy or to exercise your data rights, please contact:

• Hextra Support Team: support@hextra.ai
• Website: https://hextra.ai