Privacy Policy
Last updated [ SET AT LAUNCH · date ]
This site collects one thing: what you type into the contact form. This policy explains what happens to it, who else sees it, how long we keep it, and how to make us delete it.
01Who we are
[ CONFIRM LEGAL NAME · e.g. Huntera, Inc. ] (“Huntera”, “we”, “us”) operates huntera.ai. We are the controller of the personal data described in this policy.
Contact us about anything in this policy, including any request about your own data, at spema@huntera.ai. A person reads that address; it is not automated.
02What this policy covers
This policy covers the public website at huntera.ai and nothing else.
It does not cover Huntera SecureReplay, the product. If you become a Huntera customer or design partner, the handling of data inside the product is governed by the agreement we sign with you, not by this policy.
It does not cover other companies' websites we link to.
03What we collect
What you give us
The site has one form. It asks for:
- Name — required
- Firm or organization — required
- Email address — required, so we can reply
- Message — optional, up to 500 characters
All of it is voluntary. If you would rather not use the form, email us instead using the address in the last section.
Send us only what you would be comfortable having in an ordinary business email. Do not send confidential, proprietary, or regulated information through this form, and do not include special-category data — health, biometric, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life or sexual orientation — or government identifiers. We do not ask for any of it and we do not want it.
What is collected automatically
- Request data. Your IP address, browser user agent, and standard request headers reach Cloudflare, which serves and protects the site. This happens on every web request to any site; it is how the page gets to you.
- A rate-limit fingerprint. When you submit the form, we take your IP address, combine it with a secret value, hash it one way, and store a truncated fragment of that hash for up to one hour. It exists solely to cap how many messages one network can send. We do not store your IP address itself, and the stored fragment cannot be turned back into it.
- Bot-challenge signals. The form is protected by Cloudflare Turnstile. Cloudflare processes your IP address and technical characteristics of your browser and connection to tell a person from a script. Cloudflare states that Turnstile does not access, store, or transmit your form entries.
We do not run analytics, advertising, session recording, heatmaps, or any other tracking on this site today. If we add analytics, we will update this policy and this page's “last updated” date before or when it goes live.
05Why we use it, and our lawful basis
| What we do | Data used | Lawful basis (UK/EU GDPR) |
|---|---|---|
| Reply to your inquiry | Name, firm, email, message | Legitimate interests (Art. 6(1)(f)) — responding to someone who approached us about our business. Where your inquiry concerns a possible investment or commercial relationship, also steps taken at your request before entering a contract (Art. 6(1)(b)). |
| Keep a record of who contacted us and when | Name, firm, email, message, timestamp | Legitimate interests (Art. 6(1)(f)) — running and documenting our own fundraising and business development. |
| Stop spam and abuse of the form | Rate-limit fingerprint, bot-challenge signals | Legitimate interests (Art. 6(1)(f)) — network and information security (see GDPR Recital 49). |
| Serve the site and keep it available | Request data | Legitimate interests (Art. 6(1)(f)) — delivering and defending a website you asked to load. |
Where we rely on legitimate interests, we have weighed those interests against your rights, and we think a business contact form that only does what you asked it to do is squarely what you would expect. You can object at any time — see Your rights.
We do not use your data to make automated decisions that produce legal or similarly significant effects, and we do not profile you.
07How long we keep it
| What | How long |
|---|---|
| Your inquiry email | For as long as the conversation is live, and afterwards only while it stays relevant to the relationship it concerns. We review contact records periodically and delete what is no longer needed. |
| Rate-limit fingerprint | One hour maximum. It expires on its own; nobody deletes it by hand. |
| Resend delivery logs | About 30 days, under Resend's own retention schedule |
| Cloudflare request and security logs | Under Cloudflare's own retention schedule |
The website itself keeps no database of submissions. Your message is relayed to a mailbox and nothing on this site stores a copy.
You can ask us to delete your inquiry sooner than the schedule above, and we will unless we are legally required to keep it.
08Where data is processed
Our service providers process data in the United States and, in Cloudflare's case, on servers around the world.
If you are in the European Economic Area, the United Kingdom, or Switzerland, sending us a message means your personal data is transferred outside your country. We rely on the European Commission's Standard Contractual Clauses (and the UK Addendum or Swiss equivalent where they apply) for those transfers, and on the EU–U.S. Data Privacy Framework and its UK Extension where the provider is certified under it. Resend states that it complies with the EU–U.S. Data Privacy Framework and the UK Extension.
Those safeguards are in place because both Cloudflare and Resend publish data processing agreements that incorporate the Clauses and bind on acceptance of their terms. You can ask us for details of the safeguards covering your data.
09Your rights
Depending on where you live, you have some or all of the following rights over the personal data we hold about you:
- Access — get a copy of it.
- Rectification — have it corrected if it is wrong.
- Erasure — have it deleted.
- Restriction — have us pause using it while a dispute is sorted out.
- Objection — object to processing based on legitimate interests, including everything on this site. If you object, we stop unless we have compelling grounds that override your rights.
- Portability — receive it in a machine-readable form.
- Withdraw consent — where we ever rely on consent. Withdrawing it does not undo processing that already happened.
- Complain — to your data protection supervisory authority. In the UK that is the Information Commissioner's Office; in the EEA it is the authority in your country of residence or workplace. You do not have to come to us first, though we would like the chance to fix it.
To exercise any of these, email the privacy contact in the last section. We will respond within one month, and will tell you if we need to extend that (GDPR allows up to two further months for complex requests). We may need to confirm your identity first — usually by replying from the address you contacted us from. Exercising these rights is free; we only charge or refuse where a request is manifestly unfounded or excessive, and we will explain if that ever happens.
10California privacy disclosures
This section is for California residents, under the California Consumer Privacy Act as amended by the CPRA.
We do not sell personal information and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months. Because there is nothing to opt out of, there is no “Do Not Sell or Share My Personal Information” link on this site. We honour Global Privacy Control signals, and they change nothing here because we do not sell or share.
We do not collect sensitive personal information through this site, so the right to limit its use does not arise.
Categories of personal information collected in the preceding twelve months:
| Category | Examples | Purpose | Disclosed to |
|---|---|---|---|
| Identifiers | Name, email address, IP address | Replying to your inquiry; site security | The service providers listed above |
| Professional information | Your firm or organization | Understanding who is contacting us | The service providers listed above |
| Internet activity | Request headers, user agent, bot-challenge signals | Serving and defending the site | Cloudflare |
| Other information you provide | The content of your message | Replying to your inquiry | Resend and our email provider |
Your California rights are to know what we collect and how we use it, to access a copy, to correct inaccuracies, to delete it, and not to be discriminated against for exercising any of them — we offer no financial incentives tied to your data, and using this site costs you nothing either way. Email the privacy contact below to exercise them; we respond within 45 days and will tell you if we need the additional 45 days the statute allows. You may use an authorised agent, in which case we will ask for proof of their authority and may still verify your identity directly.
11Security
The site is served only over HTTPS. Form submissions are validated on our server, not just in your browser, and are rate limited. The contact endpoint rejects submissions sent from other websites. There is no submissions database to breach, because the site does not keep one — your message is relayed to a mailbox and nothing is stored here.
No system is perfectly secure, and email in particular is not a confidential channel. Please treat this form as you would an ordinary business email.
12Children
This site is aimed at investors and businesses. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us something, email the privacy contact below and we will delete it.
13Changes to this policy
We will update this page when our practices change, and we will change the “last updated” date at the top. If a change materially affects how we use data you already gave us, we will say so prominently on this page rather than quietly revising it.
14How to reach us
For anything in this policy, including a request to access, correct, or delete your data, email spema@huntera.ai.
If you need a postal address for a formal request, ask at that address and we will provide one.