Privacy Policy

HADEX AI · Effective date: April 10, 2026 · Last updated: April 10, 2026

This Privacy Policy describes how HADEX AI ("HADEX", "we", "us", or "our") collects, uses, and shares information in connection with our Instagram-based lead qualification assistant and related services (collectively, the "Service"). By using the Service, you agree to the collection and use of information in accordance with this Policy.

1. Who we are

HADEX AI operates an AI-powered assistant that helps businesses respond to inbound Instagram Direct Message inquiries, qualify leads, and route qualified prospects to a human sales team. The Service is provided by HADEX AI. You can contact us at privacy@hadexgroup.com.

2. Information we collect

When you send a message to an Instagram Business account operated with our Service, we may receive and process the following information via Meta's Instagram Graph API:

• Your Instagram-scoped user identifier (IGSID) and, where provided by Meta, your Instagram username and profile name.
• The content of messages you send to the connected Instagram account, including text, attachments, and message metadata (timestamps, message IDs).
• Message reactions, read receipts, and postback interactions.
• Any contact information (such as phone number, email, name, city, or business details) that you voluntarily provide during the conversation.

We do not collect your Instagram password, payment card details, biometric data, or other sensitive personal information.

3. How we use information

We use the information we receive to:

• Provide the Service and respond to your messages through an automated or human-assisted reply flow.
• Qualify leads and, where appropriate, hand off the conversation to a human sales representative of the business you contacted.
• Maintain conversation context across messages within the same session.
• Store qualified lead information in our customers' customer relationship management (CRM) systems.
• Monitor, debug, and improve the reliability and quality of the Service.
• Comply with legal obligations and enforce our terms.

4. Legal basis

Where the General Data Protection Regulation (GDPR) applies, we rely on the following legal bases: (a) your consent, given by initiating a conversation with a business that uses our Service; (b) the legitimate interests of the business you contacted in responding to your inquiry; and (c) compliance with legal obligations.

5. How we share information

We share information only in the following cases:

• With the business you contacted. The content of your messages and any lead details you provide are shared with the business operating the connected Instagram account, for the purpose of responding to your inquiry.
• Service providers. We use trusted infrastructure providers to host and operate the Service, including Supabase (database), Hetzner (hosting), OpenRouter and Anthropic (language model inference), and Meta Platforms (Instagram Graph API). These providers process data only as instructed by us and under confidentiality obligations.
• Legal requirements. We may disclose information when required by law, subpoena, or a legally binding request from a public authority.
• Business transfers. If HADEX is involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction, subject to the protections of this Policy.

We do not sell your personal information.

6. Data retention

We retain conversation data for as long as necessary to operate the Service and for up to 24 months after the last interaction, after which conversation content is deleted or anonymized. Lead contact information that has been exported to a customer's CRM is retained according to that customer's own retention policies. You may request deletion at any time as described in Section 8.

7. Security

We implement reasonable technical and organizational measures to protect the information we process, including TLS encryption in transit, access controls, secret management, and monitored infrastructure. However, no method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

8. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or object to the processing of your personal information, as well as the right to data portability and to withdraw consent. To exercise any of these rights, contact us at privacy@hadexgroup.com. We will respond within the timeframes required by applicable law.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to lodge a complaint with a supervisory authority.

9. Children's privacy

The Service is not directed to children under the age of 13 (or the applicable minimum age in your jurisdiction), and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

10. International data transfers

Our infrastructure is located in the European Union (Germany). If you access the Service from outside the EU, your information will be transferred to and processed in the EU. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses to protect international transfers.

11. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated through reasonable means, such as an in-conversation notice or a prominent announcement on our website.

12. Contact

For questions or requests related to this Policy, contact us at:

HADEX AI
Email: privacy@hadexgroup.com
Website: https://bot.hadexgroup.com/