Legal
Privacy Policy
Hodenote collects as little as possible and keeps it for as short a time as possible. This page explains exactly what that means, for visitors in the United States, the EU and UK, and elsewhere.
Last updated October 10, 2026 · Effective October 10, 2026
1. Who we are
Hodenote, LLC, Atlanta, GA, United States, is the controller of personal data described here. You can reach us at partner@hodenote.com about anything on this page.
2. What we collect
Three things: what you type into a form, aggregate traffic counts that identify nobody, and short-lived server logs kept to defend the site. There are no tracking pixels, no advertising tags, and no third-party marketing scripts.
| Source | Data | Kept for |
|---|---|---|
| Contact form | Name, company, work email, revenue band, the topics you tick, your message | 24 months |
| Careers form | Name, email, profile link, areas of interest, your note | 12 months |
| Analytics | Page views, referrer, country, device type — aggregate counts only, with no identifier that could be traced back to you | Not personal data |
| Server logs | IP address, timestamp, requested path, and browser type — for security and abuse prevention | Up to 30 days |
3. Why, and on what legal basis
For visitors in the EU and UK, our legal bases under the GDPR are:Article 6(1)(b), taking steps at your request before entering a contract, for business inquiries; Article 6(1)(f), legitimate interests, for keeping the site secure and for considering career introductions; and your consent under Article 6(1)(a) for keeping a career introduction on file beyond its immediate consideration, which you may withdraw at any time.
Aggregate traffic measurement is not listed above because it does not process personal data at all — see section 8.
4. How long we keep it
As set out in the table above. Form submissions are delivered to us by email and are not written to a database. When a retention period ends, the message is deleted from the mailbox.
5. Who else sees it
Hodenote does not sell, rent, or share personal data for advertising, and does not engage in “sharing” for cross-context behavioral advertising as the CPRA defines it.Three processors handle data on our behalf, each bound by a data processing agreement:
- Cloudflare, Inc. — Hosting, form delivery, Turnstile spam filtering, and Cloudflare Web Analytics
- Resend — Sends form submissions on to us as email
- Microsoft Corporation — Microsoft 365 hosts the mailbox those submissions land in
6. International transfers
Hodenote is established in the United States, so when you send us a message it reaches the US directly. Sending data to us on your own initiative is not a restricted transfer, and there is no agreement for us to sign with ourselves.
Where our processors move EEA or UK data onward, those transfers rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum for UK data) and supplementary technical measures, or on the processor’s certification under the EU–US Data Privacy Framework. Swiss data relies on the separateSwiss–US Data Privacy Framework where the processor is certified under it.
7. Your rights
EU / UK — GDPR
Access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent at any time.
California — CCPA / CPRA
Know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of — and we will never discriminate against you for asking.
Email partner@hodenote.com to exercise any right. We aim to reply within30 days, and will always respond within the statutory deadline — one month under the GDPR, or 45 days under the CCPA. Where a request is complex we may extend that period as the law allows, and we will tell you why before the original deadline passes. We will not charge you or ask you to create an account. An authorized agent may act for you with written proof.
8. Cookies and analytics
This site sets no cookies at all — none for analytics, none for advertising, and none that are merely “essential.” There is no consent banner because there is nothing to consent to. Traffic measurement is cookieless and aggregate: it stores no identifier, cannot recognize you on a return visit, and cannot follow you to other sites. Web fonts are served from this site rather than a third-party font host. The full detail is on the Cookies & Tracking page.
9. Security
The site is served over HTTPS only. Form submissions travel encrypted, are rate-limited, and are checked for spam without profiling the sender. Rate limiting counts requests per IP address for about a minute and then discards the count; nothing about you is stored. Access to the mailbox that receives submissions is protected by multi-factor authentication.
10. Children
This site is aimed at businesses and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us information, write to partner@hodenote.com and we will delete it.
11. Changes to this policy
If this policy changes we will update the date at the top of the page. Where a change materially affects how we handle data you have already sent us, we will contact you directly rather than relying on you to re-read this page.
12. Contact and complaints
Write to partner@hodenote.com. EEA and UK residents may also complain to their national supervisory authority, or to the UK Information Commissioner’s Office.