Privacy Policy

[legal entity name] (“we”, “us”) provides Hound (the “service”) at https://www.hound.page. Our address is [registered address]. You can contact us about privacy at [privacy email].

We play two roles:

• Controller for account data (your sign-in details and how you use your account), website visitor data, security logs, and communications with us. We decide why and how that data is used.
• Processor (or “service provider” under US state laws) for customer data: everything an organisation puts into its workspace, including records about its staff, freelancers and borrowers. The organisation is the controller of that data and decides how it is used. If your question is about data in an organisation’s workspace, please contact that organisation first. We will help them respond.

Some information sits in both places. Your name, email address and sign-in details belong to your account, which we control. Your profile details (phone, job title, employee number, photo and notes) are also stored with your account rather than with a single organisation. This means every organisation you belong to sees the same profile, and an administrator of any of those organisations can change it.

Information you give us

You need to give us your email address, first name and a password to create an account, because we cannot sign you in or contact you without them. Everything else is optional, although your organisation may ask you for more.

Profile photos and organisation logos are stored at a long, hard-to-guess web address. Anyone who has that address can view the image without signing in, so do not upload a photo you would not want seen outside your organisation.

Information your organisation puts in

• Your membership, role, department and location in the organisation, and the history of changes to them and who made them.
• Equipment records, and the custody record of who checked items out or in, when, in what condition, and with what notes.
• Borrow requests, tickets, events, maintenance records and their notes.
• Uploaded files: attachments (images and PDFs), organisation logos, profile photos, floor plans and imported spreadsheets.
• An NFC badge link: if your organisation links an NFC tag to you, we store a one-way hash of the tag’s ID, not the ID itself.
• People without accounts: staff can record that equipment was lent to someone by typing that person’s name. We store the name as a record in the organisation. That person does not have an account, and the organisation is responsible for telling them.
• Invitations: the invitee’s email address, optional name, and who invited them.

Information collected automatically

We do not use analytics tools, advertising pixels, fingerprinting or session recording. We do not collect precise location. Location in the service means a place your organisation names (for example “Studio B”), not your device’s GPS.

Sensitive information

We do not ask for sensitive personal information, such as health, biometric, racial or ethnic origin, or government ID data. Please do not enter it in notes or attachments. Your account password and one-time codes are “account log-in credentials”, which some US state laws treat as sensitive. We use them only to sign you in.

We collect personal information from you, from your organisation (its admins and other members), from your browser and device, and from our providers (for example email delivery status from Mailgun).

Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for details and you can object (section 9).

We do not use personal information for automated decisions that have legal or similarly significant effects. We do not use it to train artificial intelligence models.

Within your organisation

People in your organisation can see information about you according to their role. Admins can see your profile, your equipment activity and the history of your membership. See section 14.

Service providers (subprocessors)

We give these providers only what they need, and they are bound by contracts to protect it. We will list changes to these providers on this page and tell organisation owners at least 30 days before adding a new one.

Other sharing

We may disclose information (a) if required by law, court order or a valid government request, (b) to protect the rights, safety or property of our users, the public or us, (c) to professional advisers under confidentiality, or (d) to a buyer or successor if our business is sold or reorganised, who must honour this policy.

No selling, no advertising

We do not sell personal information. We do not “share” personal information for cross-context behavioural advertising, and we do not use it for targeted advertising. We have not done so in the past 12 months.

We are based in [state or country of registration], and our providers store and process data in the United States and the other locations listed in section 5. If you are in the European Economic Area, the United Kingdom or Switzerland, your data will be transferred to countries that may not have the same data protection laws. When it is, we rely on the EU-U.S. Data Privacy Framework and its UK extension where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, together with additional safeguards where needed. You can ask for a copy of the relevant safeguards at [privacy email].

If your organisation turns on Telegram, the messages it chooses to send go to Telegram’s servers, which may be in other countries. That transfer happens at the organisation’s direction, and the organisation is responsible for its legal basis.

We may keep data longer if the law requires it or to establish or defend a legal claim.

• Passwords are stored as salted PBKDF2-SHA-512 hashes. We never store your password in readable form.
• Sign-in requires a one-time code emailed to you. Codes expire after 10 minutes and allow 5 attempts.
• Invitation, verification and password reset links are stored only as hashes.
• Sessions expire after 12 hours, are kept in a cookie that page scripts cannot read, and are cancelled when your password is reset.
• Sign-in, sign-up, password reset and invitation pages are rate limited.
• Each organisation’s data is kept logically separate in a shared database, every request is checked against the organisation, and access inside an organisation follows roles.
• File uploads and downloads use short-lived signed links, and only certain file types are accepted. Profile photos and logos are the exception: they are served from a hard-to-guess but public address (section 2).
• Data is encrypted in transit with TLS. Our database and file storage providers encrypt stored data by default. We do not add a separate layer of encryption to individual fields, so integration secrets such as a Telegram bot token are protected by these general measures rather than encrypted separately.

No system is perfectly secure. If you think your account is at risk, contact [security contact email].

If there is a breach. If a security incident affects your personal data, we will notify affected organisations without undue delay, and in any case within 72 hours of becoming aware of it, so they can meet their own obligations. Where we are the controller, we will notify the relevant authorities and affected people as required by law.

You can update your name and profile in the service, delete your account from your settings, and, while signed in, download a copy of your account data as a JSON file from /api/me/export. For anything else, email [privacy email]. Which rights apply depends on where you live and on whether that law applies to us.

UK, EEA and Swiss residents

You can complain to us first at [privacy email]. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay. You can also complain to a data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EEA, the authority in your country; in Switzerland, the Federal Data Protection and Information Commissioner.

California notice at collection

In the last 12 months we have collected these categories under the CCPA: identifiers (name, email, IP address); visual information (profile photos); professional or employment-related information (job title, employee number, department, role); internet or other electronic network activity (security logs, server logs); sensitive personal information (account log-in credentials, used only to sign you in); and other information your organisation enters (equipment custody records, notes, files). We collect them for the purposes in section 4, disclose them to the service providers in section 5 for business purposes, keep them for the periods in section 7, and do not sell or share them. We have not sold or shared personal information of consumers under 16. We do not offer financial incentives in exchange for personal information. We do not disclose personal information to third parties for their own direct marketing purposes.

How to make a request

Email [privacy email]. Tell us your name, the email on your account, and what you want. We will verify your request by confirming you control that email address (for example by sending a code to it), and may ask for more information if needed. You can use an authorised agent; we will ask for proof that they are authorised and may ask you to confirm your identity directly. If your request is about data an organisation controls (section 1), we will pass it to that organisation, or tell you to contact them, and help them respond.

We respond within one month for UK and EEA requests (extendable by two more months for complex requests) and within 45 days for US requests (extendable by 45 more days where allowed). We will tell you if we need more time and why. Requests are free unless they are clearly unfounded or excessive.

Appeals

If we decline your request, you can appeal by replying to our decision or emailing [privacy email] with “Appeal” in the subject. We will respond within 45 days, or 60 days where a state’s law allows it, and explain our decision. If you are not satisfied, you can contact your state attorney general.

We use only what the service needs to work. We do not use advertising, analytics or third-party tracking cookies, so we do not show a cookie consent banner.

Fonts are served from our own domain. We do not load content from Google or other third parties when you browse the app.

Data in local storage and IndexedDB stays on your device after you sign out. On a shared device, clear your browser data when you finish.

We do not track you across other websites and do not sell or share personal information, so we treat every visitor as opted out. We honour Global Privacy Control (GPC) signals as a request to opt out of sale and sharing, which is already our practice. We do not respond differently to Do Not Track signals because we do not track.

The service is for businesses and is not directed to children. You must be at least 18 (or the age of majority where you live) to create an account. Organisations must not invite anyone under 16 as a user and must not record anyone under 13 in the service, including as a borrower without an account. If an organisation records a person aged 13 to 17 as a borrower, that organisation is responsible for any notice or consent, including a parent’s consent, that the law requires. We do not knowingly collect personal information from children under 13. If you think a child’s information is in the service in breach of these rules, contact [privacy email] and we will work with the organisation to delete it.

We will post changes on this page and update the “Last updated” date. If a change is material, we will tell organisation owners by email and ask users to review it when they next sign in, at least 30 days before it takes effect where possible. Our Terms of Service explain the rest of the agreement between us.

If you use Hound because your employer, school, production or client invited you, that organisation is in charge of your data in its workspace.

• Your admin controls your data. Admins can add and edit your profile (including phone, job title and employee number), change your role, remove you, and see what equipment you have checked out and your history of actions in their workspace.
• History stays with the organisation. Records of equipment you handled remain in the organisation’s history after you leave it or delete your account. If you delete your account, those records show “Deleted user”.
• Your profile is shared across organisations. If you belong to more than one organisation, they all see the same profile, and an admin of any of them can edit your phone, job title, employee number and notes.
• Notifications. The organisation decides which notifications are sent, including emails to you about equipment and, if turned on, messages to a Telegram chat that may include your name. You cannot turn off individual service emails yourself today; ask your organisation’s admin.
• People without accounts. If staff recorded that you borrowed equipment by typing your name, the organisation holds that record. Contact the organisation about it, or contact us and we will pass your request on.
• Your requests. For access, correction or deletion of data in an organisation’s workspace, contact that organisation. You can also contact us and we will help them respond. You can always delete your own account in your settings, which also removes you from every organisation.
• The organisation’s own policy. The organisation’s own privacy notice (for example an employee privacy notice) explains why it uses the service and its legal basis.

• [legal entity name], [registered address]
• Privacy questions and requests: [privacy email]
• Security issues: [security contact email]
• EU representative (GDPR Art. 27): [EU representative name and address, or remove]
• UK representative (UK GDPR Art. 27): [UK representative name and address, or remove]
• Data protection officer: [data protection officer, or a statement that none is required]