Privacy notice

This notice explains how Bright Flair handles personal information when you visit HexForm, create an account, or use the service.

1. Who we are

HexForm is operated by Bright Flair Ltd (UK company number 11710584). For account, billing, website, and support information, Bright Flair acts as the data controller. When customers use HexForm to collect information through their own forms, the customer acts as controller and HexForm processes that submission data on the customer’s behalf.

2. Information we handle

• Account information: your email address, authentication identifiers, subscription, and account settings.
• Billing information: subscription and transaction details supplied by Stripe. We do not receive your full payment-card number.
• Usage and technical information: endpoint configuration, service activity, IP address, browser information, diagnostics, and security logs.
• Support information: messages and other information you choose to provide when asking for help.
• Form submissions: information sent to endpoints created by our customers.

3. Why we use information

We use personal information to provide and secure HexForm, authenticate users, process payments, apply plan limits, store and forward submissions as configured, respond to support requests, diagnose faults, prevent abuse, comply with legal duties, and improve the service.

We never sell personal information or form-submission data, whether directly or through third-party tracking or advertising services. We do not use advertising pixels, cross-site trackers, behavioural profiling, or other invasive tracking tools.

4. Our lawful bases

We process account and service information where it is necessary to perform our contract with you. We use legitimate interests to secure, maintain, understand, and improve HexForm, provided those interests are not overridden by your rights. We process information where necessary to comply with legal obligations and rely on consent where the law specifically requires it.

5. Customer form submissions

Customers determine the fields, purpose, and lawful basis for information collected through their forms. Questions or requests about a particular form submission should normally be directed to the organisation that published that form. We process submission data according to that customer’s configuration and instructions.

6. Who receives information

We share information only where needed to operate HexForm, follow your instructions, or meet legal obligations. Recipients may include hosting and infrastructure providers, authentication providers, Stripe for billing, support and monitoring providers, professional advisers, public authorities where legally required, and forwarders or integrations configured by a customer.

7. Information handled outside the UK

All submission data retained within HexForm is hosted and processed in the United Kingdom and is protected in accordance with UK data-protection law.

Companies that use HexForm may instruct us to send submission data to an email address, webhook, integration, or other destination that stores or processes that data outside the United Kingdom. HexForm remains responsible for protecting the data while it is stored within the service and while we transmit it in accordance with the customer’s documented instructions.

The customer is responsible for selecting and lawfully using each destination, ensuring that any transfer and subsequent processing complies with applicable data-protection law, and explaining that processing in its own privacy notice. Once the data has been delivered to the customer or to a third-party destination selected by the customer, the customer and the relevant recipient are responsible for how that copy of the data is subsequently stored, used, shared, and protected outside HexForm, except to the extent that applicable law provides otherwise.

8. Retention

Submission data is kept for the period selected by the customer, unless it is deleted earlier. Account, billing, support, and security information is retained only for as long as reasonably needed for the purposes described above, including legal, accounting, fraud-prevention, and dispute-resolution requirements.

9. Security

We use technical and organisational measures designed to protect information against unauthorised access, alteration, loss, or disclosure. No online service can guarantee absolute security, so customers should avoid collecting information that is not needed.

10. Your rights

Depending on the circumstances, you may have rights to access, correct, erase, restrict, or object to the use of your personal information, and to receive certain information in a portable format. Where processing relies on consent, you may withdraw it at any time. These rights may be subject to legal limits.

We welcome questions about how information is processed and would appreciate the opportunity to address any concern or complaint directly. We will take your concerns seriously, investigate them promptly, explain our findings clearly, and put matters right where appropriate. This does not affect your right to raise a concern with the appropriate data-protection regulator.

11. Cookies and local storage

HexForm sets one cookie: a session cookie. It allows us to recognise your browser after you authenticate, so you remain securely signed in while using the service. HexForm does not set any other cookies.

HexForm stores one value in your browser’s local storage. The theme key remembers whether you prefer the system, light, or dark colour theme. It is not used to identify you or monitor your activity.

12. Changes to this notice

We may update this notice as HexForm or applicable law changes. We will publish the latest version here, update the date above, and provide additional notice where a change is material.

13. Contact

Privacy questions and rights requests can be sent to legal@brightflair.com. Please identify HexForm in your message.