legal

Privacy Policy

Effective date: [EFFECTIVE DATE] · Last updated: [EFFECTIVE DATE]

1. Scope and roles

This Policy explains how [COMPANY LEGAL NAME] (“Hearth,” “we,” “us”) collects, uses, and shares personal data via our website, accounts, and the Hearth object storage platform (the “Service”).

Account and billing data (name, work email, company, payment details, support messages): we are the controller/business for this data. Customer Data you store using the Service: you or your organization are the controller, and we act as processor/service provider under our Data Processing Addendum at [DPA URL]. End users of a Hearth customer should contact that organization directly about data stored on their behalf.

2. Personal data we collect

We do not intentionally collect special-category data (health, biometric, etc.) for account administration.

3. How we use data, and our legal bases

4. Cookies and similar technologies

We use strictly necessary cookies (e.g. the session cookie), preference cookies, and, where used, analytics cookies. Where required by law, we request consent before setting non-essential cookies and provide a way to withdraw it via [COOKIE PREFERENCE TOOL LINK]. Blocking strictly necessary cookies may prevent login.

5. How we share personal data

We share data with subprocessors and service providers under contract (hosting, payment processing, email delivery, support tooling, analytics — current list at [SUBPROCESSOR LIST URL]); professional advisors; parties to a corporate transaction, under confidentiality; and where required by law or to protect rights, property, or safety. We do not sell personal data for money; see Section 10 on opting out of any "sharing" as defined under US state law.

6. International data transfers

We are headquartered in [COMPANY REGISTRATION JURISDICTION] and use infrastructure and subprocessors in multiple countries (list at [SUBPROCESSOR/REGION LIST URL]). Transfers of EU/EEA, UK, or Swiss personal data to countries without an adequacy decision rely on safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, with supplementary measures as needed. Request a copy via [PRIVACY CONTACT EMAIL].

7. Data retention

We retain data as long as needed to provide the Service and for legitimate business, legal, tax, and accounting purposes: account data for the life of the account plus [RETENTION PERIOD]; billing records per applicable tax law (often 6–10 years); support communications for [RETENTION PERIOD]; server logs for [RETENTION PERIOD].

8. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, port, or object to processing of your data, and to withdraw consent, without discrimination for exercising these rights, and to lodge a complaint with your local data protection authority. Contact [PRIVACY CONTACT EMAIL] to exercise any of these; we respond within the time required by applicable law (e.g. one month under GDPR, 45 days under CCPA/CPRA, each extendable once).

9. California and other US state privacy rights

California residents have CCPA/CPRA rights to know, delete, correct, port, and opt out of "sale" or "sharing" of personal data (including cross-context behavioral advertising, if applicable), plus non-discrimination. We do not knowingly sell personal data for money. Submit requests via [CA PRIVACY REQUEST LINK/EMAIL] or an authorized agent, subject to verification. Residents of other states with comprehensive privacy laws (e.g. Virginia, Colorado, Connecticut, Utah, Texas) have similar rights honored consistent with each state's requirements.

10. Brazil, Canada, and other jurisdictions

Where the LGPD, PIPEDA, or a comparable law applies, you have substantively similar rights to those in Section 8 (confirmation of processing, access, correction, anonymization or deletion, portability, information about sharing). Contact [PRIVACY CONTACT EMAIL] to exercise these.

11. Children's privacy

The Service is directed at businesses and professionals and not intended for account use by individuals under 18. We do not knowingly collect personal data directly from children for account registration; contact [PRIVACY CONTACT EMAIL] if you believe otherwise so we can delete it.

12. Do Not Track and Global Privacy Control

We do not currently respond to browser "Do Not Track" signals differently, absent an industry standard. Where legally required, we treat a detected Global Privacy Control signal as a valid opt-out of sale/sharing of personal data for that browsing session.

13. Security

We use technical and organizational measures including encryption in transit and at rest, access controls, and routine testing. No method is 100% secure. We will notify you and any required authority of a breach affecting your personal data as required by law (e.g. within 72 hours of awareness under GDPR, where applicable).

14. Automated decision-making

We do not currently use this data to make decisions with legal or similarly significant effects about you through fully automated means without human involvement. If this changes, we will update this Policy and provide rights required by law, including human review where applicable.

15. Third-party links

Our website and Service may link to third-party sites we do not control; this Policy does not apply to them.

16. Changes to this Policy

We may update this Policy and will give notice of material changes before they take effect. The date above shows the latest revision.

17. Contact us / Data Protection Officer

[COMPANY LEGAL NAME], [COMPANY ADDRESS]
Email: [PRIVACY CONTACT EMAIL]
EU representative / DPO (if applicable): [NAME AND CONTACT]
UK representative (if applicable): [NAME AND CONTACT]