Privacy notice

1. Notice at collection

This notice describes how Hodor Vault and the organization operating it (the “Company,” “we,” “us”) collect, use, and disclose personal information, and the rights available to California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, the “CCPA”). We provide this notice at or before the point at which we collect personal information so that you understand the categories of information we collect and the purposes for which they are used.

2. Categories of personal information we collect

Depending on your role and how you use the platform, we may collect the following categories of personal information:

• Identifiers — name, email address, telephone number, account username, and IP address.
• Professional information — job title, employer or contracting entity, and worker classification (contractor or employee).
• Field documentation — photographs and video captured in the field, measurements, barcodes, notes, and the metadata embedded in captured media.
• Precise geolocation — GPS coordinates attached to field photos and capture events. Under the CCPA, precise geolocation is treated as sensitive personal information. See our geolocation notice for details.
• Electronic signature records — signature images, consent text, intent indicators, timestamps, IP address, and user agent associated with documents you sign.
• Usage and device information — log data, browser and device characteristics, and audit records of actions taken in the workspace.

3. Purposes for which we use personal information

We use the personal information described above to:

• provide, operate, and secure the platform and your account;
• document field work, validate where and when work was performed, and support review, approval, and reverse-invoicing workflows;
• create and preserve tamper-evident records of electronic signatures and consents;
• communicate with you about your account, work assignments, and service changes;
• maintain audit logs, prevent fraud and abuse, and comply with legal obligations.

We use sensitive personal information — precise geolocation — only for the limited purpose of validating field work, providing the service, and related security and recordkeeping. We do not use it to infer characteristics about you.

4. We do not sell or share your personal information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA. We disclose personal information only to service providers and contractors who process it on our behalf under written contracts that restrict their use of the information, and where required to comply with law.

5. Your rights

Subject to verification and legal exceptions, California residents have the right to:

• Know and access the categories and specific pieces of personal information we have collected;
• Delete personal information we have collected from you;
• Correct inaccurate personal information;
• Opt out of any sale or sharing of personal information (note: we do not sell or share);
• Limit the use and disclosure of sensitive personal information to what is necessary to provide the service;
• Non-discrimination for exercising any of these rights.

You may exercise these rights by contacting us using the details in Section 8. We will not discriminate against you for exercising your rights, and you may use an authorized agent to submit a request on your behalf.

How requests are handled today. There is no self-service tool for these requests in the application. Each one is carried out manually by our team after we verify who is asking, and we will respond within the timeframes the law requires. Where a record must be kept to evidence completed work — for example a signature, or a daily report an invoice was raised against — we will tell you what we are retaining and on what basis rather than deleting it.

6. Retention

We retain personal information for as long as needed to provide the service, maintain required business and legal records, and resolve disputes. Your organization can record a retention period in its workspace settings; that setting is a stated preference and no automatic deletion currently runs against it, so records are kept until they are deleted on request. Signature and consent records are retained for the period necessary to evidence the underlying transaction.

7. Security

We maintain reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, use, alteration, and disclosure. These include access controls scoped to your organization, encryption of credentials and signing secrets, and audit logging of sensitive actions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Contact us

To exercise your rights or ask questions about this notice, contact your organization’s administrator or the privacy contact designated by the Company. Requests will be verified before they are fulfilled.