Privacy
Policy.

We collect the following categories of personal information:

• Account data — your name, email address, and profile image provided when you register or sign in via an OAuth provider.
• Usage data — log files, IP addresses, browser type, pages visited, and other diagnostic data generated as you interact with the portal.
• Client content — documents, messages, and files you upload or submit through the portal in connection with your engagement.
• Authentication data — session tokens and credential identifiers necessary to maintain your authenticated session securely.
• Contact form data — name, email, phone, and message content submitted via our public contact form.

We do not sell personal information.

We use the information we collect to:

• Provide, operate, and maintain the Services, including authenticating your identity and managing your portal access.
• Communicate with you regarding your engagement, including notifications about documents, messages, and account events.
• Improve the Services through aggregate usage analysis.
• Comply with legal and regulatory obligations.
• Detect, prevent, and address security incidents, fraud, and technical issues.

We do not sell, rent, or trade your personal information. We share data only with:

• Supabase / PostgreSQL — our database hosting provider, which stores all portal data in a managed PostgreSQL instance.
• Vercel — our application hosting provider, which serves the portal and may process request logs.
• OAuth providers — if you sign in using GitHub or another third-party identity provider, that provider shares basic profile information with us under its own privacy policy.

We may disclose personal information if required by law, court order, or governmental authority.

We retain your account data and client content for as long as your account remains active or as needed to provide the Services. When an engagement concludes, we may retain certain records as required by applicable professional, tax, or legal retention obligations.

Upon a verified deletion request, we will delete or anonymize your personal data within 30 days, subject to any overriding legal retention obligations.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access (GDPR Art. 15) — request a copy of the personal data we hold about you.
• Correction (GDPR Art. 16) — request correction of inaccurate or incomplete data.
• Erasure (GDPR Art. 17) — request deletion of your personal data. See our Data Deletion page.
• Portability (GDPR Art. 20) — request a machine-readable copy of data you have provided to us.
• Objection (GDPR Art. 21) — object to processing based on legitimate interests.

To exercise any of these rights, contact privacy@hawthorneridge.co. We will respond within 30 days.

The portal uses strictly necessary cookies to maintain your authenticated session. These cookies are required for the portal to function and cannot be disabled without affecting functionality.

We do not use advertising cookies, third-party tracking pixels, or behavioral profiling technologies.

We implement industry-standard technical and organizational measures to protect your personal data, including transport-layer encryption (TLS), server-side session management, HMAC-signed download tokens, and role-based access controls within the portal.

No transmission over the internet is 100% secure. In the event of a data breach that poses a high risk to your rights and freedoms, we will notify you and relevant authorities as required by applicable law.

The Services are intended solely for business use by adults. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected information from a minor, please contact us at privacy@hawthorneridge.co.

We may update this Privacy Policy from time to time. For material changes, we will notify you via email or a prominent in-portal notice at least 14 days before the change takes effect.

Hawthorne Ridge LLC is the data controller for personal data processed through the Services.