Hexifyer DevStudio Privacy Policy

Effective date: 31 October 2026 · Last updated: 28 September 2026 · Version: v1.1 · Operated by Hexifyer FZ-LLC · Contact: privacy@hexifyer.com

This page contains:

Privacy Policy
Cookie Notice
Sub-processors
Deleting your account

This policy explains what personal data Hexifyer DevStudio handles, why, where it is stored, how long it is kept, and what you can ask us to do with it. It covers the DevStudio web application, the AI estimator on our marketing site, and the marketing site itself.

Three things are worth reading before the rest. First, DevStudio is a service, not a tool we rent you: Hexifyer runs the projects, which makes us the controller of most of what is in here, and that changes who you send a request to. That is section 02. Second, DevStudio shares its account system and its database with Polaris, another product Hexifyer operates, and section 11 says so plainly rather than leaving you to discover it. Third, everything we say about deletion is stated with a number, and the same numbers appear in our Terms of Service and our Data Processing Agreement. If you ever find them disagreeing, the figure in this policy is the one we will honour, and we would like to know about it.

01 Who we are and how to reach us

Hexifyer FZ-LLC is the sole controller of the personal data described in this policy where we act as controller. No other Hexifyer entity is a controller of it.

Route	Use it for	Address
Privacy and data protection	Rights requests, deletion and export requests, questions about this policy, Data Processing Agreement requests, sub-processor objections.	privacy@hexifyer.com
Project and product support	Anything about your project or about using DevStudio. Support cannot action a rights request; it will pass it to the address above.	support@hexifyer.com

The privacy address is monitored by the people who can act on what you send it. It is not a support queue, and it is not your project manager.

02 Our three roles

Most privacy policies have one role. This one has three, because DevStudio does something a software tool does not: we run the work. Which role applies changes what you can ask us for and who has to answer.

1. Controller: the platform and the delivery operation. Because Hexifyer runs the agency and operates the platform, we decide the purposes for the data about the people and the process. That covers partner and agency records, client account records, and the operational reality of delivery: which partner is assigned to which project and sprint, tasks, logs, comments, meetings and meeting notes, reports, and the audit record of who did what. We are answerable to you for this data directly, and section 13 is your route.

2. Processor: personal data that belongs to your client organisation. Where a client hands us personal data about their own people, we act on that client's instructions and for no purpose of our own. In practice this is two situations: our developers are given access to a client's live production system that holds real end-user personal data, and a client uploads a file containing their own customers' or employees' data into a DevStudio task or asset folder. For that data the client organisation is the controller and Hexifyer is the processor, governed by the Data Processing Agreement incorporated into our Terms of Service. If you are one of those end users, your rights sit against the client, not against us, and we will route any request you send us to them.

3. Neither: commercial deliverables. Wireframes, UI mockups, architecture diagrams, API specifications, PRDs, source code and every other project deliverable are commercial property, and who owns them is settled by the Terms of Service, not by this policy. Privacy law governs personal data; it does not govern a database schema. We do not claim regulatory control over your deliverables and we are not going to pretend a privacy policy is the document that decides who owns your code.

The one caveat on deliverables. A deliverable can contain personal data: a PRD that names your stakeholders, a test dataset copied from production, a screenshot with a real customer's email in it. When it does, the personal data inside it falls under limb 2 above and is handled as your client organisation's data on your instructions, even though the document itself is a commercial asset. The commercial split and the privacy split are different cuts through the same file.

What that means for a request you send us

If you are a client contact, a partner, an agency admin or an estimator user, your personal data sits under limb 1 and we action your request ourselves. You do not have to go through anyone. If your request concerns personal data inside a client payload under limb 2, we cannot act on our own initiative: we will acknowledge it, tell you so, and route it to the client organisation that controls it, within the same six working days set out in section 13.

03 How DevStudio is organised

DevStudio has no workspaces. It has projects, and four kinds of participant around them. The structure matters because it decides who can see what, which is section 09.

Participant	What it is
Client	A person at the organisation buying the work. A client belongs to a client company, and a company can have more than one contact and more than one project.
Client company	The organisation itself. It is the counterparty on the Terms of Service and the controller of any client payload under section 02.
Partner	A vetted freelance developer, designer or project manager. A partner can work as a personal freelancer, or as a member of an agency, or both: a partner may belong to more than one agency and switch between those contexts and their personal one from a single account.
Agency	A supplier organisation with its own admin, whose partners can be assigned to projects under the agency's name. An agency joins by applying through the public apply-as-an-agency form, the same way an individual partner does. When a partner is assigned to a project while working under an agency, that assignment appears on the partner's dashboard inside that agency, and that agency's admin can see it.

The context a partner works in decides who sees the work. Work done under agency A is visible to agency A's admin. The same partner's work under agency B, or as a personal freelancer, is not. Section 09 states this as a rule rather than leaving it as a product behaviour you have to infer.

04 What we collect and how

One row per category. "How we get it" matters as much as what it is, because data you give us and data the product generates about you are treated differently in the sections that follow.

Category	What is in it	How we get it
Identity and credentials	Name, email address, password hash, federated sign-in identifier where you sign in with Google, Apple, Microsoft, LinkedIn or GitHub, two-factor enrolment. Held in Supabase Auth.	You give it at sign-up, or your sign-in provider hands us the profile fields you approve. Your account is a Hexifyer account that also signs you in to Polaris, Hexifyer's other product; see section 11.
Profile	Display name, job title, profile photo, language and timezone, notification preferences. Photos and logos are held in Supabase Storage.	You give it, and you can change all of it in the product except your email address: see the note below this table.
Client company record	Company name and logo, the contacts attached to it, their roles, invitations sent and received, and the projects belonging to it.	You give it during onboarding, or we create it when we open your engagement.
Partner application and profile	Professional summary, years of experience, hourly rate in USD, weekly availability in hours, portfolio URL, LinkedIn profile, GitHub profile, technical skills, portfolio projects, and your CV or resume as an uploaded document.	You give it through the public apply-as-a-partner form, and you can update it afterwards from your profile.
Agency application	The agency's name, its trade licence or registration details, its country of operation, its website and portfolio, the name and contact details of the person applying, the size of its team, and the disciplines it works in.	You give it through the public apply-as-an-agency form. We assess it the same way we assess a partner application, and nothing about it is scored or ranked automatically: see section 08.
Agency record and membership	Agency name and logo, its admin, which partners belong to it, and which projects it has been assigned.	The agency admin creates it, and partners join it or are invited to it.
Project content	Projects, sprints and milestones, tasks and subtasks, assignments, logs, meetings and meeting notes, comments, topics, custom field values, and the reports generated from all of it. Held in the primary database.	You, your project team and our staff create it in the product. It may contain personal data about you or about other people, typed by whoever wrote it.
Files, assets and deliverables	Project files and anything attached to a task, message or meeting, in the format it was uploaded in. Held in Supabase Storage.	You or the project team upload it.
Client payload	Personal data belonging to a client's own users, customers or staff: reached through production access granted to our developers, or uploaded into a task or asset folder by the client.	The client gives it to us or grants access to it. We are the processor for it: section 02, limb 2.
Calendar and meeting data	The Google or Microsoft calendar you connect: its events, their titles, times and attendee email addresses. Where the AI notetaker is used: meeting audio, its transcript, and the notes generated from it. Sprint demos and client calls are the usual case.	You connect a Google or Microsoft calendar and approve read access on that provider's consent screen, and the notetaker runs when it is turned on for a meeting.
Estimator submissions	Your email address, the project description you wrote, the budget you expect, and the estimate we returned. Section 06 is the whole story on this one.	You submit the form on our marketing site.
Derived AI data	Embeddings and vector representations of project content, generated so search and retrieval work. Assistant chat history: your conversations with the DevStudio assistant. Summaries, drafts and automated reports the AI produces from your content.	The product generates it from content you already gave us. Embedding happens at ingestion, so content is sent to our embedding provider when it is created, not only when you search.
Usage and device data	Pages viewed, features used, clicks and scrolling, anonymised session recordings of the web app (we do not send your name or your email address to our analytics provider, and text you type into input fields is masked before it leaves your browser) device and browser, IP address and the approximate location derived from it, push token and device identifiers.	Collected automatically as you use the product. See section 18 for what you can refuse.
Audit and security logs	Sign-ins, permission changes, records of who created, changed or deleted what, security events. Held in the primary database.	Generated automatically by the product.
Billing and contracts	Billing contact and address, agreed commercial terms, invoices and payment records, signed contracts.	Agreed with you during contracting. Handled outside DevStudio today: see the note below.
Support and marketing	Your correspondence with us, and if you subscribe, your marketing contact record.	You write to us, or you subscribe.

What we do not collect, stated so you do not have to assume it

No payout or bank details in the platform. DevStudio has no payments module today. Invoicing and paying partners happens outside the product, by arrangement. We do not hold IBANs, card numbers or payment-rail credentials in DevStudio. When a payments module ships it is a material change under section 22, announced 30 days in advance.
No time tracking and no monitoring. There is no timer, no screenshots, no activity or keystroke measurement, no idle detection, and nothing that reports on a partner's machine. Every hour figure in DevStudio is either an estimate entered when the task was planned or an hour manually logged by the person who did the work, and the interface labels it as one or the other so it can never be mistaken for a measurement. If automated time tracking is ever added, that is also a material change under section 22.
No identity documents and no background checks. Partner vetting uses what is in the application row above and a conversation. We do not collect passports, national IDs, criminal record checks or credit checks, and we do not run partners through a screening service.
No contacts module. DevStudio does not hold a CRM of people you have not engaged with.

Changing your email address. DevStudio does not currently let you edit your own email address in the product. To correct it, write to privacy@hexifyer.com and we will change it for you. We are telling you this rather than leaving you to find out, because correcting inaccurate personal data is your right and the route to it should not be a mystery.

Data from your Google or Microsoft account

If you sign in with Google or Microsoft, or connect a Google or Microsoft calendar, we receive data from that account only with the permission you grant on the provider's consent screen.

What we receive	Why we use it	Where it is held
Sign-in: your name, email address, profile photo and account identifier	To create your Hexifyer account and sign you in	Supabase Auth, in Frankfurt (section 11)
Calendar, only if you connect one: read access to your calendar events, with their titles, times and attendee email addresses	To show your meetings in DevStudio and, where you turn it on, to send the AI notetaker to a meeting	The DevStudio primary database, in Frankfurt (section 11)

We use this data only to provide the DevStudio features you use. We do not sell it, we do not use it for advertising, and we do not use it to train any AI or machine learning model, including generalised models.
We share it only with the sub-processors in our sub-processor list, only to provide those features, or where the law requires it. Where a feature uses AI, section 07 applies.
People at Hexifyer do not read it unless you ask us to, for example in a support request, or unless it is needed for security or required by law.
You can disconnect a calendar in DevStudio at any time, or remove Hexifyer's access in your Google or Microsoft account settings. We then stop reading it. Calendar data already synced is kept on the timings in section 12, and you can ask us to delete it sooner at privacy@hexifyer.com.

DevStudio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data we receive from Microsoft is handled on the same terms.

Your sign-in is a Hexifyer account shared with Hexifyer's other product. A summary covering both products is at hexifyer.com/privacy.

05 Why, and on what legal basis

Every purpose we process personal data for, with the legal basis beside it. Where we rely on consent you can withdraw it at any time, and withdrawing it does not affect processing that already happened.

Purpose	Data used	Legal basis
Delivering your project and giving you access to it	Identity, profile, client company record, project content, files	Performance of a contract: the Terms of Service with your organisation, and your own contract with us as a participant.
Assessing a partner or agency application	Partner application and profile, agency application	Steps taken at your request before entering a contract.
Managing partners, agencies and assignments	Partner profile, agency membership, project content, assignments	Performance of a contract, and legitimate interests in running a delivery operation that can staff a project and evidence who did the work. We hold a recorded balancing test for this.
The AI estimator	Estimator submissions	Steps taken at your request before entering a contract. Retention beyond that, and the calibration use, are described in section 06.
AI features: the assistant, the writers, search, automated reports	Project content relevant to the request, assistant chat history, embeddings	Performance of a contract. Section 07 explains what is sent where, and what turning the features off removes.
Calendar sync and AI meeting notes	Calendar and meeting data	Consent. Nothing is read until you connect a calendar, and the notetaker runs only when it is turned on for a meeting.
Client payload	Personal data belonging to a client's own users	We are the processor. The basis is the client's, not ours, and the Data Processing Agreement governs what we may do with it.
Billing, invoicing and tax	Billing and contract records, identity	Performance of a contract, and compliance with a legal obligation for the retention of tax records.
Security, abuse prevention and audit logging	Audit and security logs, usage and device data	Legitimate interests in keeping the service and its customers' data secure, and compliance with a legal obligation to be able to investigate and report a breach. We hold a recorded balancing test for this.
Product analytics and improving DevStudio	Usage and device data	Consent. Analytics run only if you allow them, they are refusable and re-changeable at any time in the cookie notice, and nothing in DevStudio depends on them. The recordings are anonymised. We do not use your project content to improve DevStudio.
Support	Support correspondence, identity	Performance of a contract, and legitimate interests in answering you.
Marketing emails	Marketing contact record	Consent. Separate from the service emails described in section 19.

If you are in Egypt, consent is the default. Egyptian law is consent-first: legitimate interests does not carry across as it does under the GDPR. Where the table above names legitimate interests and Egyptian law applies to you, we collect and record your consent instead, and we keep a register of those consent records with the withdrawal route attached to each. See section 21.

06 The AI estimator

The estimator on our marketing site takes a project description in plain language and returns a breakdown: the team composition we would recommend, estimated hours per phase, cost per role, a total, and a timeline. It exists so you can get a specific answer before you talk to anyone. It gets its own section because it is the one place where somebody who is not a customer, and who has read nothing else on this page, types something sensitive into our systems.

Question	Answer
What we store	Four things: your email address, the project description you wrote, the budget you said you expect, and the estimate we returned. Nothing else. There is no tracking of you across the internet attached to it.
Whether an email is required	Yes. The estimate is delivered to it, so the estimator cannot be used anonymously. If you would rather not give one, write to us instead and we will scope it with you by hand.
Where it goes	The submission is processed by an automation running on n8n Cloud, which calls a model through OpenRouter: the same gateway and the same providers as every other AI feature, under the same no-training and 30-day provider retention position set out in section 07. The stored record sits in our primary database in Frankfurt.
How long we keep it	24 months from your last contact with us about it. At the end of that period we delete your email address, and we keep the description, the budget and the estimate detached from any identifier, so that we can calibrate the estimator against what projects actually cost. If you would rather we deleted the whole record, ask and we will.
Whether we use it to sell to you	No. We do not currently use estimator submissions for commercial follow-up, and submitting one does not put you on a marketing list. If that changes it is a material change under section 22: 30 days' notice, and consent asked for at the form rather than assumed from a submission you already made.
Whether it decides anything about you	No. It estimates a project, not a person. See section 08.

Be deliberate about what you paste into the description field. It is a free text box, and people put more into it than they mean to: named stakeholders, customer lists, internal architecture, things covered by someone else's NDA. We hold it under the terms above and we do not share it, but the cheapest protection available to you is not typing it in the first place. Describe what you want built. You do not need to identify anyone to get an accurate estimate.

07 AI features: what goes where

DevStudio uses AI in four places. The assistant answers questions about your project and carries out actions you ask for. The writers draft content on request: task descriptions, log entries, idea drafts and classification. The reporting engine generates the daily, weekly and monthly reports from real project data. And a scheduled agent runs on a timer without anyone starting it, described at the end of this section. The estimator is the fifth, and section 06 covers it separately.

Which features send content off DevStudio infrastructure

All of them. Every AI feature sends the project content relevant to the request to a model provider outside our infrastructure. In addition, your content is sent for embedding when it is created, not only when you search: that is what makes project search work, and it means the disclosure here is wider than "AI answers your questions".

Which providers receive it

Every AI request leaves DevStudio through a single gateway, OpenRouter, which routes it to the provider serving that request. We name the providers rather than describing them as "third-party model providers", because you cannot assess a transfer you cannot see. The current list, with what each one does and where it processes, is on our sub-processor list, and it is the authoritative version because it changes more often than this policy does. As at the effective date of this policy it is: OpenRouter (gateway), OpenAI (text generation and embeddings), Google (text generation, request classification, and the safety checks that run on every message in and out), and Anthropic (answering questions over retrieved content). All of them process in the United States. DevStudio does not route any AI request to a provider processing outside the United States or the European Union. Estimator submissions additionally pass through n8n Cloud before reaching the gateway.

Whether your content trains a model

No. Your project content is never used to train any model, ours or a provider's. Every request is pinned to a named provider from the list above, and the gateway is not permitted to fall back to a provider that is not listed.

How long a provider keeps it

Up to 30 days, and only for trust, safety and abuse monitoring. The providers we route to retain the inputs and outputs of a request for a maximum of 30 days so that they can detect and investigate misuse of their own services, then delete them permanently. That retention is limited to that purpose: it is not used to train a model, not used to improve a product, and not read by a person unless an automated system flags an incident. Where a provider's data policy for an endpoint cannot be established, we do not route to it.

Where AI processing happens

Not necessarily where your data is stored. Your project content is stored in Frankfurt (section 11), but AI processing happens in the provider's own region. The processing location for each provider is stated in the sub-processor list.

The AI features cannot be switched off

There is no toggle, and asking us will not produce one. The AI features are how DevStudio works (search, the assistant, the reports you receive, the way project content is organised), and the product is not built to run without them. If you use DevStudio, your project content is processed by the AI providers named above.

This is stated plainly because it is the kind of thing a policy is tempted to leave vague. Combined with the paragraph above, it has a specific consequence worth understanding: content is sent for embedding when it is created, so it reaches our embedding provider whether or not anyone on your project ever opens the assistant, and there is no setting that prevents it.

What you get instead of a switch are the commitments in this section, which apply to everyone and cannot be traded away: your content is never used to train a model, no provider keeps it beyond 30 days, every request is pinned to a provider we have named on a public page, and adding a provider takes 30 days' notice during which you can object. A switch you can turn off protects the people who find it. A commitment that binds us protects everyone.

Two things genuinely are optional, and they are the two where the law requires a choice: calendar sync and the AI meeting notetaker. Nothing is read from your calendar until you connect it, and the notetaker runs only when it is turned on for a meeting. Section 05 records both as consent-based for that reason.

If AI processing of your project content is not acceptable to your organisation or your own client, that is a reason not to run the project in DevStudio, and we would rather you knew before signing than discovered it afterwards. Say so during discovery and we will talk about what is possible.

The one place this line is drawn differently, and exactly where it falls. Personal data belonging to your own users is never sent to an AI provider where it reaches us by file upload or through access to your production systems. Those are not embedded, not read by the assistant, not classified. But anything typed or pasted into a task, comment or note is project content from the moment it is saved, and it is processed by the AI features like everything else in a project: there is no setting that prevents it, and no way for us to tell a real customer record from any other sentence. Section 05 of our AI Services Addendum and section 08 of our Data Processing Agreement state it in full. If your users' data matters, do not put it in a text field.

The scheduled agent. One AI feature runs without anyone initiating it: a scheduled agent that reads project content on a timer in order to organise and classify it, and the reporting engine that compiles the daily, weekly and monthly reports on the same basis. Neither is reacting to a click, and we mention them separately because a reasonable person reading "the assistant answers your questions" would not expect it. They send the same content to the same providers, under the same retention and no-training position set out above.

Our AI Services Addendum, a schedule to our Terms of Service, carries the contractual side of this.

08 Automated decisions

DevStudio makes no automated decision that has a legal effect on you, or any other similarly significant effect.

This is a design property, not a promise we are managing. Three specific commitments sit behind it, because in a business that assigns paid work to people this is the section most worth being precise about:

Nothing scores, ranks or shortlists partners. There is no matching algorithm, no rating model, no automated suitability score. A human decides which partner is proposed for a project, and a human decides whether an application is accepted.
The estimator estimates a project, not a person. Its output is an opinion about scope and cost. It does not assess the person who submitted it and it does not feed into any decision about anyone.
The AI proposes and a person confirms. A draft is a draft until someone accepts it, a classification is a suggestion until someone keeps it, and a generated report is a description of work already done. No DevStudio feature decides anything about a person's engagement, pay, access or standing.

If that ever changes, it is a material change to this policy and section 22 tells you how far in advance you will hear about it.

09 Who sees what inside DevStudio

DevStudio is a shared workspace between people who do not work for the same organisation, so "who can see this" is a privacy question and not only a product one. This is the visibility model, stated as a rule.

If you are	You can see	You cannot see
A client	Your company's projects in full (tasks, sprints, logs, meetings and notes, files, assets and reports), and, for each partner on your project, their name and profile photo.	A partner's hourly rate, CV, portfolio, skills profile, agency affiliations, other projects, or any other client's work.
A partner	The projects you are assigned to, and the team members on those projects: the client contacts and the other partners working on them.	Projects you are not assigned to, other partners' rates or profiles beyond the team listing, other clients, or the commercial terms between Hexifyer and the client.
An agency admin	For partners working under your agency: the client organisations and projects they are assigned to, the tasks assigned to them, and the estimated and manually logged hours recorded against those tasks.	Anything that partner does as a personal freelancer or under a different agency. Any project your agency is not on.
Hexifyer staff	What the role requires, for the reason stated in section 16, logged.	Not applicable: this is the row you should read section 16 for.

The hours an agency admin sees are not a measurement of anybody. They are the estimate entered when a task was planned, and the hours the partner chose to log against it. DevStudio runs no timer and observes nothing about how a partner works, as section 04 says, so an agency cannot use this view to check whether someone was at their desk. It shows what was planned and what was reported, nothing else.

Switching context does not merge the contexts. A partner can belong to several agencies and can also work independently, moving between those hats from one account. The work stays partitioned by the hat it was done under: agency A's admin sees agency A's assignments and nothing else, and work done as a personal freelancer is visible to no agency at all. If you take a project independently, no agency you belong to learns about it from us.

What a client learns about a partner is deliberately thin. A name and a photo is enough to work with someone every day. Your rate, your CV and your history are commercial information between you and Hexifyer, and we do not surface them to the client as a matter of course. If a specific engagement requires more (a client who wants CVs before approving a team) we ask you first.

10 Who else we share it with

We do not sell personal data, and we do not share it for anyone else's advertising. We share it with four kinds of recipient:

Other people on your project, and your agency. The model in section 09 is the whole of it.
Sub-processors. Providers we engage to run the service, each limited by written agreement to the purpose we name. Categories: cloud infrastructure and databases, authentication and file storage, workflow automation for the estimator, transactional email, push notifications, meeting transcription, product analytics, and the AI providers in section 07.
Independent controllers. If you sign in with Google, Apple, Microsoft, LinkedIn or GitHub, that provider authenticates you under its own terms. It is not our sub-processor, because we do not instruct it to process anything on our behalf. If you connect a Google or Microsoft calendar, we read it directly from that provider under the permission you grant, and the provider is not our sub-processor for it either. An agency that receives data about its own partners under section 09 acts as a controller of that data in its own right, and its handling of it is governed by its relationship with that partner, not by this policy.
Where the law requires it. A binding legal request, or the defence of a legal claim. We tell the affected customer unless we are prohibited from doing so.

Every sub-processor is named on our sub-processor list, with its purpose, the data it receives, and the country it processes in. The list sits at the end of this page with its own date, so a vendor change does not reopen the rest of this policy.

When the list changes. A new sub-processor is posted in that list and emailed to everyone subscribed to changes at least 30 calendar days before it begins processing customer data. You have 30 calendar days from that notice to object in writing, on reasonable grounds relating to data protection, to privacy@hexifyer.com. We will work with you to resolve the objection, normally by explaining the safeguards, or by making a change to the service available where one is possible. If we cannot resolve it within a reasonable period, you may terminate the affected engagement without penalty.

When you exercise a right that we have to pass on (an erasure or a correction that reached a sub-processor) we propagate it to every affected sub-processor within 30 days, using the route each vendor provides for it.

Each sub-processor is engaged under a standard written vendor agreement, which in most cases is that vendor's own data processing addendum, requiring confidentiality and protection of the data appropriate to the service it provides. Vendor compliance is reviewed periodically. We do not claim more than those agreements actually give.

11 Where your data lives

All DevStudio project content, files and account records are stored in Frankfurt, Germany, in the AWS eu-central-1 region. That is true for every customer and every partner, wherever you are.

Provider	What it holds	Where
Supabase (Supabase, Inc.)	Authentication: user records, credentials, federated sign-in identifiers. Stored files: profile photos, company and agency logos, CVs, project files, task and message attachments.	Germany, AWS eu-central-1
Render (Render Services, Inc.)	The primary database: projects, tasks, logs, meetings, comments, partner and agency records, estimator submissions, audit logs. The AI database: your chat history with the assistant. The DevStudio backend, frontend and AI services.	Germany, AWS eu-central-1
Amazon Web Services (Amazon Web Services, Inc.)	The underlying cloud infrastructure beneath both providers above. AWS does not access the data in the ordinary course.	Germany, eu-central-1
n8n Cloud (n8n GmbH)	The automation that processes an estimator submission and calls the model gateway. It handles the submission in transit; the stored record lives in the primary database above.	Germany

Backups. Backups of both stores are held by Supabase and Render in the same region, AWS eu-central-1. If a backup were ever held outside that region we would say so here.

The narrower categories of data that reach our platform and AI sub-processors are processed in those providers' own regions, as named per row on the sub-processor list. Section 07 covers the AI providers specifically.

DevStudio shares its account system and its database with Polaris, another Hexifyer product. You should know this, and here is exactly what it means.

Hexifyer also operates Polaris, and DevStudio was built alongside it. Your sign-in is a Hexifyer account held in Supabase Auth, and the same account signs you in to both products. The two products also run on the same database and the same schema, not separate databases, and not separate schemas. The separation between the two is enforced by the application, not by the infrastructure underneath it.

What that does not mean: nothing you create in DevStudio appears in the other product, and nothing created there appears in DevStudio. Signing in to one product gives you no access to anything in the other: access to a project or a workspace comes only from being added to it. We do not move content between the two products and we do not use one product's data to run the other.

We are disclosing the architecture rather than the reassurance because "logically separated, physically shared" is a real and material fact about where your data sits, and a procurement team is entitled to weigh it. If that ever changes (if the stores are split, or if anything beyond the account system is ever shared across the two products) it is a material change under section 22.

If you are in Egypt. Because your data is written to Frankfurt when you create it, it leaves Egypt at the point of collection and continuously thereafter, rather than occasionally. Articles 14 to 16 of Egypt's Personal Data Protection Law govern that transfer. The Egypt appendix in section 21 sets out how, and who carries responsibility for it in each of our three roles.

12 How long we keep it

One row per category, with the retention period and what it is based on.

Category	How long	Then what
Active project content	For the duration of the engagement, then 24 months.	Deleted. We hold it after delivery because warranty questions, disputes and follow-on work all reach back into the project record, and 24 months is where that need runs out. A client can ask us to delete their project record earlier, and we will unless a statutory record in the last row of this table requires otherwise.
Deleted content, in trash	30 days, fixed.	Purged from the live systems. Restorable at any point inside the 30 days.
A verified erasure request	Erased from the live systems within 72 hours of us verifying the request.	The data is deleted, not hidden or flagged. Backups follow the row below.
Backups	The last backup copy is gone within 14 days of erasure from the live systems.	Backups exist so we can restore the service after a failure, and they rotate on a schedule rather than being edited. Inside that window your data survives only in backup, is not accessible in the product, and is not used for anything but disaster recovery. If we restore a backup taken before your deletion, we re-apply the deletion to the restored data. Where a stricter rule applies in your jurisdiction, section 21 says so.
Partner profile	For as long as your partner account is open.	Deleted when you close it, on the clocks above. Your rate, CV, portfolio and skills profile go with it.
Agency applications that did not lead to an engagement	12 months from the decision.	Deleted, on the same terms and for the same reason as a partner application.
Partner applications that did not lead to an engagement	12 months from the decision.	Deleted, including the CV. We hold it that long so we can come back to you when something suitable appears, and no longer. Ask us to delete it sooner and we will.
Estimator submissions	24 months from your last contact about it.	Your email address is deleted. The description, budget and estimate are kept without any identifier attached, to calibrate the estimator. Section 06 is the full account, including how to ask for the whole record to go.
Meeting recordings, transcripts and notes	Same as the project they belong to: the engagement plus 24 months.	Deleted with the project record. Any participant can ask us to delete a specific recording earlier, and we do not require a reason.
Embeddings, summaries and other AI-derived data	Deleted in the same transaction as the content they were derived from.	Deleting a comment deletes the embedding of that comment. It is not left behind as a derived copy. See section 07.
Assistant chat history	Until you delete the conversation, or the project record is deleted.	Held in a separate AI database, and deleted on either event under the same 30-day trash and 72-hour erasure figures above.
Data held by an AI provider	Up to 30 days.	Retained strictly for automated security and abuse monitoring, then permanently deleted. Never used to train a model. See section 07.
Client payload	As the client instructs, and by default no longer than the engagement requires.	Returned or deleted at the end of the engagement, at the client's election, as the Data Processing Agreement requires. Production access granted to our developers is revoked at the end of the engagement or the phase that needed it, whichever is sooner.
Audit and security logs	12 months from the event.	Deleted. We keep them this long because we cannot scope a security incident inside 72 hours without records predating it, and we are telling you the period rather than claiming logs are exempt from erasure.
Inactive accounts	We do not delete data for inactivity.	Nothing. There is no dormancy sweep, and we do not reserve a right to delete an inactive account's content. If that ever changes it is a material change under section 22.
Marketing contact records	Until you unsubscribe, then deleted within 30 days.	We keep a minimal suppression record so we do not email you again.
Support correspondence	24 months from the last message in the thread.	Deleted.
Contracts, invoices and tax records	Longer than anything else, and not our choice: 5 years under Egyptian VAT law, 7 years under UAE corporate tax law.	This is a statutory override. It survives your account deletion, the end of your engagement and an erasure request, because we are legally required to keep it. It is contract, invoice and tax data only, not your project content. These records are held outside DevStudio, since the platform has no payments module.

One thing deletion cannot reach: email we have already sent. DevStudio notification emails carry the content of the item they are about (a task title, a comment, a project name), because a notification you have to click into to understand is not a notification. That means deleting an item in DevStudio does not remove it from email already delivered to someone's mailbox. Those copies sit in recipients' mail systems, outside our control, and we cannot recall them. We are disclosing this rather than engineering it away, because the alternative (content-free notifications) makes the product worse, and because a policy that implied deletion was total would be untrue.

13 Your rights and how to use them

Write to privacy@hexifyer.com. Exercising any of these rights is free of charge.

Right	What you can ask for
Access	A copy of the personal data we hold about you, and confirmation of whether we hold any.
Rectification	Correction of inaccurate data, and completion of incomplete data. This is the route for your email address: see section 04.
Erasure	Deletion of your personal data. Section 14 explains what this reaches and what it does not.
Restriction	That we stop processing your data while a dispute about its accuracy or our basis is resolved.
Objection	That we stop processing where we rely on legitimate interests, including product analytics and the partner-management purpose in section 05.
Portability	Your data in a structured, commonly used, machine-readable form. Section 15 is the specification.
Withdrawing consent	Withdrawal of any consent you gave (calendar sync, the notetaker, marketing, analytics) at any time.
Not being subject to automated decisions	Human involvement in a decision with legal or similarly significant effect. DevStudio makes none: see section 08.

How long we take

We respond within 6 working days. That is the deadline Egyptian law sets, and it is shorter than the one month the GDPR and UAE law allow. We publish the shortest deadline that applies to us rather than the most convenient one, and we apply it to every customer and every partner in every market. A request logged on Monday has a decision recorded by the following Tuesday.

How we verify who you are

We verify a request against the account it concerns, usually by requiring it to come from, or be confirmed at, the account's registered email address, and for an organisation-level request by confirming the requester's role. If we cannot verify you we tell you what we need rather than refusing silently. We do not ask for identity documents.

If your request is about a client payload

We route it to the client organisation that controls it, as section 02 explains, and we tell you we have done so within the same six working days. This is the only category where we cannot answer you ourselves.

If you are not satisfied

Write to us first: most of it is a misunderstanding we can fix. You also have the right to complain to a supervisory authority. Section 21 names the authority and the route for each region.

14 Deleting your account

You can ask us to delete your account at any time, and there is a 14-day grace period during which you can cancel and nothing is lost. After it, erasure from the live systems completes within 72 hours, and the backup tail in section 12 applies.

Your account is a Hexifyer account. The same account signs you in to Polaris, so deleting it from DevStudio deletes it for both products and removes your access to Polaris as well. What happens to what you had in Polaris is set out in Polaris's Privacy Policy. If anything in either product blocks the deletion, the product tells you before you confirm.

What deletion reaches depends on which kind of account you hold.

A partner account. Your account record, your profile, your rate, your availability, your links, your skills and your uploaded CV are deleted. The work you did stays in the project record, because the project record belongs to the engagement and the client is entitled to it, but your authorship of it is anonymised. The team sees that the work exists and that a former partner did it; they do not see your name, email or profile. Your name persists in audit records for their 12 months, and in any signed contract or invoice for the statutory periods in section 12, neither of which we have discretion over.

A client contact account. Your account record and personal data are deleted. Your company's project record is not, because it belongs to the company rather than to you, and other contacts at your company may still be working on it. Your authorship inside it is anonymised on the same terms as a partner's. If you want the company's project record deleted, that is a request from the company and section 12's first row is the answer.

An agency admin account. The same as a client contact, with one block: if you are the only admin of an agency that still has partners in it, we stop the deletion until another admin is appointed or the agency is closed. We do this deliberately: deleting the only admin of a live agency leaves its partners with assignments nobody can administer, and we would rather stop you for a moment than hand them that problem.

The honest limit on what deletion reaches. Deleting your account removes your account record and anonymises your profile. It does not empty the project. Project content and historical logs stay as they are, including personal data about you that someone else typed into them: your name in a meeting note, your email address in a task description, a mention of you in a comment.

That is deliberate. A project record is the evidence of what was built, by whom and when. The client is entitled to it, warranty and dispute questions reach back into it, and a record with pieces cut out of it is no longer a reliable account of the engagement. So we do not undertake to sweep project content for mentions of a departing person, and we would rather say that than promise a redaction service we are not set up to run.

Where the law requires something to be removed in a specific case, we will assess that case and act on it: the erasure right in section 13 is not displaced by this paragraph, and it is not absolute either. What has gone is the expectation that closing your account quietly erases you from a project's history. It does not, and now you know before you click it rather than afterwards.

Before you delete anything, section 15 tells you how to get a copy.

15 Exporting your data

Ask at privacy@hexifyer.com and we deliver your export within 5 working days. Five rather than six is deliberate: a portability request is a rights request, so the six working days in section 13 is the ceiling, and we keep a day of margin.

What you get	Detail
One ZIP archive	`devstudio-export-<project or account>-<YYYY-MM-DD>.zip`
A README	The export date, what it covers, who requested it, every entity type included: and anything excluded, named explicitly. An export you have to reverse-engineer to trust is not much of an export.
Your data as UTF-8 CSV	One file per entity type. For a project: tasks, subtasks, comments, logs, meetings and notes, sprints, topics, custom field values, team members with their roles, assistant chats, and an audit extract. For a partner: your profile, your application, your assignments and your contributions. Archived content is included.
Keys in every row	Each row carries its own identifier and its parent's, so the structure survives the export. Without them a CSV bundle is readable text rather than a portable dataset.
Your files	Attachments and deliverables in their original formats, with a manifest mapping stored filename to original filename, parent item, uploader and upload date.

A self-serve export in the product is on our roadmap. Until it ships, the email route above is the commitment, and it is the same commitment in our Terms of Service.

16 How we protect it

Encryption. In transit over TLS, and at rest in every store described in section 11.

Authentication. Password hashing, optional two-factor authentication, and federated sign-in with Google, Apple, Microsoft, LinkedIn and GitHub.

Access control inside the product. The role model in section 09 determines what each participant can see and do, and it is enforced per project and per agency context rather than per organisation.

Audit logging. Sign-ins, permission changes and content changes are recorded, and kept for the 12 months stated in section 12.

Staff access. Hexifyer staff run your project, so staff access to project content is not exceptional: it is the service. Access beyond the people delivering your project requires a business reason and is logged. Staff access to data stored in Frankfurt is remote access; it does not move your data.

Access to client systems. Where a client grants our developers access to a live production system, that access is scoped to the people who need it, revoked at the end of the engagement or the phase that needed it, and covered by the Data Processing Agreement. Partners are bound by confidentiality terms before they are assigned to a project.

Sub-processor diligence. Standard written vendor agreements, in most cases the vendor's own data processing addendum, with vendor compliance reviewed periodically.

We hold no security certifications, and we are not going to imply otherwise. Hexifyer DevStudio has no SOC 2 report and no ISO 27001 certificate. What we have is the list above, our sub-processor list, and a Data Processing Agreement you can hold us to. If a certification matters to your procurement process, tell us and we will tell you honestly where we are.

17 If something goes wrong

If personal data we hold is breached, we notify the relevant supervisory authority within 72 hours of becoming aware of it, and sooner where a regime requires it. That figure is the same under Egyptian, Saudi and EU law, so it is one clock rather than three. In the UAE the requirement is to notify immediately on discovery, and we work to that.

Where the breach touches a client payload and we are the processor, we notify that client organisation without undue delay so it can meet its own obligations as controller, and we give it what it needs to do so.

Where a breach is likely to result in a high risk to you personally, we notify you as well: partners and client contacts alike. In Egypt, the Data Protection Centre notifies affected individuals within three days of being notified by us.

We document every breach, including ones that do not meet the notification threshold, and why we reached that conclusion.

18 Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the product is used. The last of those includes session recording of the web app. Those recordings run only if you allow analytics, and they are anonymised: we do not send your name or your email address to our analytics provider, and text you type into input fields is masked before it leaves your browser.

Essential cookies are required for DevStudio to work. Everything else (analytics, session recording, and the attribution and advertising technologies on our marketing site) you can refuse without losing any product functionality, including the estimator.

What is set, by whom, for what purpose, and how long each persists is in our Cookie Notice, which is also where you change your choices.

19 Marketing communications

There are two kinds of email from DevStudio and they are not the same thing.

Service email. Project invitations, email verification, password resets, assignment notifications, sprint and meeting notifications, billing notices, security alerts, and the notifications you have configured. These are part of the service. You cannot opt out of them while your account is active, though you control which notifications you receive in your profile.

Marketing email. Product news, announcements, and anything else we send to persuade you of something. Consent only, and one click to stop. Every marketing email carries an unsubscribe link, unsubscribing takes effect immediately, and it never affects your service email. Submitting an estimator request is not consent, and neither is applying to be a partner: see section 06.

Notification emails carry your content. A notification about a task includes the task's title and the relevant text, so it is useful without opening the app. Those emails are delivered to recipients' mail systems, which we do not control, and deleting the item in DevStudio does not remove it from mail already delivered. Section 12 says the same thing, because it matters in both places: if content is sensitive enough that a copy in a colleague's inbox is a problem, set notification preferences accordingly before it is created.

20 Age

You must be at least 18 to hold a DevStudio account. Every account holder here is either acting for a company that is buying software or a person contracting to be paid for work, and both of those are things a minor cannot do.

We do not knowingly collect personal data from anyone under 18, and DevStudio is not directed at children. If we learn that we hold personal data belonging to someone under 18, we delete the account and its personal data promptly. If you believe a minor has an account, write to privacy@hexifyer.com and we will act on it.

21 Regional terms

The sections above apply to everyone. These appendices add what is specific to a region, and where they conflict with anything above, the appendix wins for people in that region.

Egypt

Item	Detail
Applicable law	Personal Data Protection Law No. 151 of 2020 and its 2025 Executive Regulations.
Authority	The Egyptian Personal Data Protection Centre. You may complain to the Centre directly, and you do not have to come to us first.
Response deadline	6 working days, per Article 32. This is the deadline we publish for every customer and partner in every market.
Legal basis	Consent is the primary basis. Where section 05 names legitimate interests, we collect and record your consent instead, and maintain a register of consent records with the withdrawal route attached.
Licensing	The Law provides for licences issued by the Centre to controllers and processors. Hexifyer FZ-LLC does not currently hold one. We would rather tell you that than imply otherwise: everything else in this policy describes what we actually do, and a claim about our own regulatory status is not the place to start making exceptions. The protections described here (where your data is held, who can reach it, how long we keep it, and what you can ask us for) do not depend on it and apply to you in full.
Transfer out of Egypt	Your personal data is written to Frankfurt, Germany when you create it, so it is transferred out of Egypt at the point of collection and continuously thereafter. Articles 14 to 16 govern it, and the arrangement differs by role. Where we are the controller (your account, your partner profile, project content, estimator submissions) we rely on the level of protection available at the destination: Germany is an EU member state, and the data is protected there by the GDPR and by German federal data protection law. Where we are the processor (client payload) the transfer is governed by the Data Processing Agreement between Hexifyer FZ-LLC and the client organisation, incorporated into the Terms of Service, which makes that organisation the exporter and Hexifyer the importer. Hexifyer does not obtain Egyptian licences or permits on a client's behalf. We do not ask individual users to consent to the transfer, and no individual consent is required for either arrangement.
Breach	Notified to the Centre within 72 hours of awareness. The Centre notifies affected individuals within three days of our notification.

United Arab Emirates

Item	Detail
Applicable law	Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Hexifyer FZ-LLC is registered in a Ras Al Khaimah free zone, which has no data protection legislation of its own, so the federal law applies and the DIFC and ADGM regimes do not.
Authority	The UAE Data Office. Its Executive Regulations have not yet been issued.
Response deadline	The federal law requires a response without undue delay and sets no number. We apply 6 working days, as above.
Breach	Notified immediately upon discovery, which is stricter than the 72-hour clock and is what we work to.
Language	This policy is published in Arabic and English with the same effective date. Where the two versions conflict, the English version governs, except where UAE consumer protection rules require otherwise.

Saudi Arabia

Item	Detail
Applicable law	The Personal Data Protection Law and its Implementing Regulations.
Authority	SDAIA, the Saudi Data and AI Authority.
Response deadline	6 working days, as above, which is shorter than the Law requires.
Backups	Where Saudi law requires that all backup copies of erased data be destroyed rather than allowed to rotate out, we destroy them, and the 14-day figure in section 12 is a ceiling rather than a schedule for you.
Records	We keep our record of processing activities for the processing period plus five years, as required.
Transfers	Your data is stored in the EU. The transfers described in section 07 to providers processing in the United States are covered by the safeguards in our Data Processing Agreement. Where the Law requires a particular instrument for a transfer out of the Kingdom of a client payload, putting it in place is the client organisation's, as the exporter of that data.

European Economic Area and United Kingdom

Item	Detail
Applicable law	The EU General Data Protection Regulation, and the UK GDPR with the Data Protection Act 2018.
Authority	Your national data protection authority, or in the UK the Information Commissioner's Office.
Storage	Your data is stored in Frankfurt, Germany. No transfer out of the EEA arises from hosting it.
Transfers	The AI sub-processors in section 07 and in the sub-processor list process in the United States. Those transfers rely on Standard Contractual Clauses with the supplementary measures set out in our Data Processing Agreement.
Backups	The 14-day figure in section 12 is our disclosure of the backup delay, made in advance as guidance requires. Regulatory guidance on backup erasure is expected to develop, and we will update this figure and tell you if it changes.
Data Processing Agreement	Incorporated into our Terms of Service by reference, so it is already in force for every client without needing to be signed separately. It includes Standard Contractual Clauses and the security annex carrying every figure in section 12. A copy is available at privacy@hexifyer.com, and we will sign a countersigned version on request.

California

We do not sell personal information and we do not share it for cross-context behavioural advertising. Section 12 gives our retention period per category, as required. California's rules permit a delay in erasing data held in backup until that backup is restored or next used; our practice is the 14-day figure in section 12, which is shorter, and we apply the shorter one.

22 Changes to this policy

The effective date of this version is at the top of the page.

Material changes (a new purpose, a new category of recipient, a longer retention period, a weaker commitment, a change to how deletion works, or any change to the separation described in section 11) are announced at least 30 days before they take effect, by email to client contacts, agency admins and partners, and by a notice in the product. Shipping a payments module, adding automated time tracking, introducing automated partner scoring, or using estimator submissions for sales follow-up would each be a material change under this clause, and each is named because each is something we have told you above that we do not currently do.

Everything else (clarifications, corrections, a rewritten sentence that does not change what we do) takes effect when we publish it, and the last-updated date at the top changes.

Previous versions are kept in a public archive, so you can see what this policy said on any date and what changed.

The sub-processor list is not part of this policy. It changes on its own cadence with its own 30-day notice and objection window, described in section 10, which is exactly why it lives on its own page.

Cookie Notice

Effective date: 31 October 2026 · Last updated: 28 September 2026 · Version: v1.0

Section numbers in this notice refer to its own sections.

This notice explains what DevStudio stores on your device, why, and what you can do about it. It covers the DevStudio web application, the DevStudio mobile applications and our marketing site.

We use the word “cookies” as shorthand, but this notice covers everything we keep on your device: cookies, browser storage that behaves like cookies, and the small amount of data our mobile apps keep locally. Where any of it is personal data, our Privacy Policy explains your rights over it.

01 The short version

Category	What it is for	Can you refuse it?
Strictly necessary	Keeping you signed in and keeping your account secure. Without these, DevStudio does not work.	No, but they do nothing else.
Functional and preferences	Remembering your theme, your language, whether the sidebar is collapsed, which view you were in, and drafts you have not submitted.	Yes, by clearing site data: you will lose the preferences, not your work.
Analytics	Understanding how DevStudio is used so we can improve it. Set by Microsoft Clarity, a third party, and anonymised.	Yes, and they do not load unless you say yes. See section 07.

We do not use cookies to advertise to you, and we do not sell what we collect.

02 Cookies we have to set

These are the only true cookies DevStudio itself sets. They exist so you can sign in and stay signed in safely.

Cookie	What it does	How long it lasts
`sb-<project-ref>-auth-token`	Holds your authentication session so you stay signed in as you move around DevStudio. Set by Supabase, our authentication provider. First-party.	For the life of your sign-in session
`password_reset_pending`	A short-lived marker used during password reset and multi-factor verification, so the flow can complete safely. First-party, and removed when the flow ends.	Minutes: the length of the flow

These cannot be switched off. If you block them, you cannot sign in.

03 What we keep in your browser

Most of what DevStudio remembers is not a cookie at all: it is browser storage, which stays on your device and is not sent to us with every request. It falls into three groups.

Signing in, and getting you to the right place

Item	What it does
`authToken`	Keeps your session valid in the application.
`app_source`	Remembers whether you arrived at Polaris or at Hexifyer DevStudio, so you land in the right product.
`hexifyer_pending_invite_url`	Remembers the project invitation you were opening, so you go there after signing in rather than to a blank home page.
Sign-up cooldown timers	Stops repeated sign-up and verification attempts in quick succession. A basic abuse control.

Remembering how you like DevStudio

Item	What it does
Language (`i18nextLng`) and theme	Keeps your language and appearance choice between visits.
Sidebar and widget layout	Remembers whether your sidebar is collapsed and how you have arranged your dashboard widgets.
View modes	Remembers whether you last used Kanban or list view on a project.
Dismissed hints and tours	Stops us showing you the same tip after you have dismissed it.

Caches and unfinished work

Item	What it does
Attachment display URLs	A short-lived cache so files you are viewing do not have to be re-fetched constantly.
Meeting recording timers	Keeps a recording's elapsed time accurate if the page reloads mid-meeting.
Unsubmitted drafts	Holds work in progress (an estimator wizard you have not finished, for example), so a refresh does not lose it.
Session-only items	Project and task filters, and temporary redirects during sign-up. These live in session storage and disappear when you close the tab.

All of this stays on your device. Clearing your browser's site data removes it, and nothing you have saved in DevStudio is affected: your work lives on our servers, not in your browser.

04 On our mobile apps

The DevStudio mobile apps do not use cookies. They keep three things in the app's own storage on your device:

A push notification subscription ID (onesignal_subscription_id), so notifications reach your device and not someone else's.
The chat thread you currently have open, so the app returns you to it.
Grouped notification contents (onesignal_group_thread:<id>), so several notifications about the same thing arrive as one entry rather than twenty.

Deleting the app removes all of it. You can turn notifications off in your device settings at any time.

05 Analytics

If you allow analytics, we use Microsoft Clarity to understand how people use DevStudio, which features get used, where people get stuck, and what breaks. Clarity records interactions such as mouse movement, clicks, scrolling and how pages render, and replays them as a session so we can see what happened.

Clarity is a Microsoft product and sets its own cookies, but only once you have allowed analytics. Two are first-party; the rest are Microsoft's own, set across Microsoft services.

Cookie	Set by	What Microsoft uses it for
`_clck`	First-party	Holds a Clarity identifier for your browser, so repeat visits are recognised as the same person.
`_clsk`	First-party	Joins the pages you view into a single recorded session.
`CLID`	Microsoft	Identifies the Clarity project the recording belongs to.
`ANONCHK`	Microsoft	Indicates whether a user identifier is used for analytics only, and supports fraud checks.
`MR`	Microsoft	Controls whether the MUID identifier below is refreshed.
`MUID`	Microsoft	Identifies a browser across Microsoft sites. Microsoft's own documentation describes it as used for advertising, site analytics and other operational purposes.
`SM`	Microsoft	Synchronises the MUID identifier across Microsoft domains.

We do not use Clarity for advertising and we do not run advertising campaigns against this data, but those cookies are Microsoft's, and they behave as Microsoft describes. We would rather list all seven than describe Clarity as “two analytics cookies” and leave you to find the rest.

Analytics only run if you allow them. Clarity does not load until you accept analytics in the cookie settings, and nothing in DevStudio depends on it. If you decline, or never answer, it is not loaded and none of the cookies above are set.

What we do not send. We do not send Clarity your name or your email address. A recording is not tied to a named account, and we cannot look up “what did this person do”: we look at how a screen behaved, not at who was on it. Text you type into input fields is masked before it leaves your browser.

The honest limit. Masking covers what you type; it does not cover page addresses. A page's URL can reach Clarity as part of a recording, and a DevStudio URL can contain a project name. That is why analytics are behind consent rather than on by default.

Microsoft retains Clarity recordings for up to 30 days, and up to nine months for recordings that have been marked as samples or favourites. Microsoft's own privacy statement governs what it does with the data it holds.

You can change your mind at any time: section 07 explains how, and nothing in the product depends on Clarity running.

06 What we do not use

Worth saying plainly, because the absence is deliberate:

No Google Analytics, and no advertising or attribution pixels in the DevStudio application.
No advertising profiles. We do not build one, buy one, or sell what we hold.
No IndexedDB, and no persistent offline database. Our API caches live in memory only and are gone the moment you refresh the page.
No cross-site tracking of you around the web. The only third party that sets anything through DevStudio is Microsoft Clarity, described in section 05.

07 How to control all of this

Analytics. We ask before we load them. You can change your answer at any time from the cookie settings link in the footer of any DevStudio page. Declining stops Clarity loading; it does not affect anything else.

Everything else. Your browser controls the rest. Every major browser lets you view and delete cookies and site data for a single site, block third-party cookies, or clear everything on exit. Clearing DevStudio site data signs you out and resets your preferences: it does not touch your work.

On mobile. Notification permissions are in your device settings. Removing the app removes what it stored.

Do Not Track and global privacy signals. Browsers disagree about what these mean, and we would rather give you a control that does something than honour a signal inconsistently. Use the cookie settings link above.

If you want to know what we hold about you, or want it deleted, our Privacy Policy explains how to ask and how quickly we answer.

08 Changes to this notice

If we add a cookie, add a provider, or start using one of them for a new purpose, we update this notice. A material change (a new third party, or an existing one used for something new) is announced at least 30 days before it takes effect, the same notice period as our Privacy Policy and our Terms of Service. Corrections and clarifications take effect on publication and the last-updated date changes. Previous versions are kept in a public archive.

Sub-processors

Last updated: 28 September 2026

This list changes more often than the policy above and carries its own date.

Hexifyer DevStudio is operated by Hexifyer FZ-LLC, a free zone company registered in Ras Al Khaimah, United Arab Emirates under licence number 47017173, at FOAM1588, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates. To run the service we use a small number of third-party providers that store or process personal data. Each of these is a sub-processor.

This list names every one of them, what it does, what data reaches it, and where that processing happens. We keep it current. If you want to be told before the list changes, subscribe at the end of this list.

01 What a sub-processor is, and the one thing that is different here

A sub-processor is a company we engage to help deliver the service, and which may access personal data in the course of doing so. Each is engaged under a standard written vendor agreement (in most cases that vendor's own data processing addendum) requiring confidentiality and protection of the data appropriate to the service it provides, and we review vendor compliance periodically. We stay responsible to you for what they do.

The difference from a normal software subscription is worth stating at the top, because it changes what this list means. In DevStudio, Hexifyer is the controller of most of what is described here (project content, partner and agency records, account records), because we run the delivery rather than renting you a tool. We are the processor for one narrower thing: personal data belonging to your own users, which our Privacy Policy calls client payload. Section 02 of the Privacy Policy sets out all three roles, and the Data Processing Agreement governs the second.

Client payload does not reach most of this list, and the route decides it. Personal data belonging to your own users never reaches an AI sub-processor where it arrives by file upload or through access to a production system. An uploaded file is held by the infrastructure providers in the first table and by nobody else; a production system we are given access to stays on your infrastructure and involves no sub-processor of ours at all.

Text typed or pasted into a task, comment or note is a different matter: that is project content whatever it contains, it is embedded the moment it is saved, and it reaches the AI providers in the fourth table. Section 08 of the Data Processing Agreement states where the line falls and who is responsible for staying on the right side of it.

02 Infrastructure sub-processors

These providers hold the DevStudio service and the data in it.

Sub-processor	Purpose of processing	Data processed	Processing location	More information
Supabase (Supabase, Inc., United States)	Authentication and file storage	Account records and credentials, including email addresses, password hashes and federated sign-in identifiers. Stored files: profile photos, company and agency logos, partner CVs, agency application documents, project files, and task and message attachments.	Germany (AWS eu-central-1)	supabase.com/privacy
Render (Render Services, Inc., United States)	Application hosting and databases	The primary database: projects, sprints, tasks, logs, meetings, comments, partner and agency records, applications, estimator submissions and audit logs. The AI database: chat history between a user and the DevStudio assistant. Render also hosts the DevStudio backend, frontend and AI services.	Germany (AWS eu-central-1)	render.com/privacy
Amazon Web Services (Amazon Web Services, Inc.)	Underlying cloud infrastructure	All data held by Supabase and Render sits on AWS. AWS does not access it in the ordinary course.	Germany (eu-central-1)	aws.amazon.com

Where your data sits. All DevStudio project content, files and account records are stored in Frankfurt, Germany, in the AWS eu-central-1 region, for every client and every partner wherever they are. Backups of both stores are held in the same region. The platform and AI sub-processors below receive narrower categories of data and process them in their own regions, which are named in each row.

03 Platform sub-processors

These providers deliver specific features. Each one receives only the data that feature needs.

Sub-processor	Purpose of processing	Data processed	Processing location	More information
n8n Cloud (n8n GmbH, Germany)	Workflow automation behind the AI estimator	An estimator submission in transit: the email address given, the project description written, the expected budget, and the estimate returned. The stored record is held in the primary database above. Section 06 of the Privacy Policy is the full account of what happens to a submission.	Germany	n8n.io/legal/privacy
Twilio SendGrid (Twilio Inc., United States)	Transactional email delivery	Recipient name and email address, and the content of the message. This includes project invitations, email verification, password resets, assignment and sprint notifications, and estimator results. Notification emails carry task and project names.	United States	twilio.com/legal/privacy
OneSignal (OneSignal, Inc., United States)	Mobile push notifications	Device push token, device and app identifiers, and the content of the notification, which can carry task and project names. Delivery to the device is completed by Apple Push Notification service on iOS and Firebase Cloud Messaging on Android.	United States	onesignal.com data handling
Nylas (Nylas, Inc., United States)	AI meeting notes	Where the AI notetaker is used: the details of the meeting it joins, the meeting audio, the transcript, and the notes generated from it. Sprint demos and client calls are the usual case.	United States	nylas.com/platform/security
Microsoft Clarity (Microsoft Corporation, United States)	Product analytics and session recording. Loaded only where a user has accepted analytics, and not at all otherwise.	Anonymised session recordings of use of the DevStudio web app: pages viewed, clicks, scrolling, form interaction, device and browser, and approximate location derived from IP address. We do not send Microsoft a user's name or email address, and text entered into input fields is masked before it leaves the browser. Page addresses are not masked and can form part of a recording.	United States	privacy.microsoft.com

There is no payments sub-processor, because there is no payments module. DevStudio holds no card numbers, no bank details and no payout credentials. Invoicing and paying partners happen outside the product. When a payments module ships it will bring a payment processor with it, and that is a new sub-processor under the notice terms in section 05.

Sign-in providers are not sub-processors. When you sign in to DevStudio with Google, Apple, Microsoft, LinkedIn or GitHub, that provider authenticates you under its own terms and hands us the profile fields you approve. We do not instruct it to process anything on our behalf, so it acts as an independent controller. Your account record, including the identifier linking it to that provider, is held by Supabase, which is listed above. If you connect a Google or Microsoft calendar, DevStudio reads it directly from that provider under the permission you grant, on the same basis. Google appears in the AI table for a different reason: the models DevStudio uses, not your sign-in.

04 AI sub-processors

DevStudio uses AI in five places. The assistant answers questions about a project and carries out actions. The writers draft task descriptions, log entries and summaries. The reporting engine compiles the daily, weekly and monthly reports. A scheduled agent organises and classifies project content on a timer, without anyone starting it. And the AI estimator turns a project description into an estimate.

All of them send the relevant content to a model provider outside DevStudio infrastructure. Every AI request leaves through a single gateway, OpenRouter, which forwards it to the provider serving that request.

Sub-processor	Purpose of processing	Data processed	Processing location	More information
OpenRouter (OpenRouter, Inc., United States)	AI gateway. Every AI request passes through OpenRouter, which routes it to the model provider that serves it.	The full request sent to the model: the message, recent conversation history, and whatever project content the request needs, retrieved tasks, logs, meeting notes, comments and activity records. Estimator submissions reach the gateway through n8n Cloud.	United States	openrouter.ai/privacy
OpenAI (OpenAI, L.L.C., United States)	Text generation and embeddings. Drafting tasks and logs, writing the final reply, summarising retrieved documents, and generating the embeddings that make project search work.	The request content above, plus the text of project content that is embedded for search. Content is embedded when it is created, so it reaches this provider whether or not anyone uses the assistant.	United States	openai.com/policies
Google (Google LLC, United States)	Text generation, and everything that runs before a request reaches a model. Drafting task descriptions, classifying and routing requests, tool selection, rewriting search queries, compiling reports, and safety checks on messages in and out.	The request content above. The classification step and the safety checks see every message sent to and from the assistant.	United States	policies.google.com/privacy
Anthropic (Anthropic, PBC, United States)	Text generation over retrieved content. Answering questions about project activity and documents, from the records retrieved for that question.	The retrieved records and documents, the question asked, and recent conversation history.	United States	anthropic.com/legal/privacy

Retention and training. The providers above retain the inputs and outputs of a request for a maximum of 30 days, solely so that they can detect and investigate misuse of their own services, and then delete them permanently. That retention is limited to trust, safety and abuse monitoring: it is not used to train any model and not used to improve a product. Where a provider's data policy for an endpoint cannot be established, DevStudio does not route to it. Each request is pinned to a named provider from the table above; the gateway is not permitted to fall back to a provider that is not listed here. The Privacy Policy states the same 30-day figure in sections 07 and 12.

Every AI provider processes in the United States. DevStudio does not route any AI request to a provider processing outside the United States or the European Union. The Data Processing Agreement sets out the safeguards that apply to these transfers.

There is no way to switch the AI features off. No toggle, for a project or an account, and none planned. The features are how DevStudio works (search, retrieval, the assistant, the reports), so using DevStudio means project content is processed by the providers above, including at the moment it is created rather than only when someone searches. What replaces a switch is the set of commitments in this list: no training, 30-day maximum provider retention, pinning to named providers, 30 days' notice before a provider is added, and the client-payload line in section 01. Section 09 of the AI Services Addendum and section 07 of the Privacy Policy say the same.

Two things are genuinely optional, because consent is the lawful basis for them: calendar sync and the AI meeting notetaker. Nothing is read from a calendar until it is connected, and the notetaker runs only when it is turned on for a meeting.

05 Change notifications

We update this list when we add, replace or remove a sub-processor.

New sub-processors are posted here, and everyone subscribed below is emailed, at least 30 calendar days before they begin processing customer data.
You have 30 calendar days from that notice to object in writing, on reasonable grounds relating to data protection, by writing to privacy@hexifyer.com. That applies to every client, every partner and every agency, not only to clients.
We will work with you to resolve the objection. If we cannot within a reasonable period, you may terminate the affected engagement without penalty.
Removing a sub-processor needs no notice and no objection window, but this list and our configuration change in the same release, so the list is never ahead of or behind what is running.

Notice and objection run to the same length on purpose: you have the whole notice period to decide, and the new sub-processor does not begin processing until it has run.

Models may be swapped freely within a named provider. Adding a provider cannot happen inside a month. That is a real operational constraint on us rather than a paperwork step, and it is the reason the pinning commitment above means anything.

06 Get told when this list changes

Subscribe at privacy@hexifyer.com and we will add you to the sub-processor notice list. We will only use that address to send sub-processor and data processing notices.

07 Questions

Write to privacy@hexifyer.com. Our Data Processing Agreement is a schedule to our Terms of Service and is already in force. If your procurement process needs a countersigned copy, ask at the same address.

Deleting your account

How to delete your DevStudio account, what is deleted, and what is kept. Section 14 of the Privacy Policy above has the full detail.

Your account is a Hexifyer account. The same account signs you in to Polaris, so deleting it removes your access to both products. What happens to what you had in Polaris is set out in Polaris's Privacy Policy.

In the app. On the web, or in the DevStudio app for iOS or Android, open your account settings and choose Delete account. Before you confirm, the app tells you which case below applies to you and whether anything blocks the deletion.

By email. Write to privacy@hexifyer.com from the address on your account and ask us to delete it. We verify the request against the account and respond within 6 working days.

What is deleted. Your account record, your credentials and your profile.

If you hold a partner account, your profile, rate, availability, links, skills and uploaded CV are deleted. The work you did stays in the project record, and your authorship of it is anonymised.
If you hold a client contact account, your company's project record stays, because it belongs to the company, and your authorship inside it is anonymised.
If you are the only admin of an agency that still has partners in it, the deletion is blocked until another admin is appointed or the agency is closed.

What is kept, and for how long. Invoice and tax records, for the statutory periods in section 12. Audit records, for 12 months. Your name in any signed contract or invoice, for the statutory periods in section 12. Project content stays with the project record, as section 14 explains.

When it happens. There is a 14-day grace period, during which you can cancel and nothing is lost. After it, your data is erased from the live systems within 72 hours, and the last backup copy is gone within 14 days of that.