Privacy Policy

This Privacy Policy explains how Hambone Services LLC (“HB Services,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you use our websites and client portal at hbservices.net and app.hbservices.net, schedule a diagnostic call, or otherwise interact with us (together, the “Services”).

It applies to personal information about visitors, account holders, prospective clients, and the representatives of businesses that engage us. It does not apply to third-party websites or services we link to. This Policy is part of, and should be read with, our Terms of Service.

A. Information you provide to us.

• Account information — when you create an account, your name, email address, and a password. If you sign in with Google or Microsoft, we receive your name, email address, profile image, and an account identifier from that provider instead of a password.
• Business intake information — when you complete the onboarding questionnaire, the business details you choose to provide, which may include your business name, addresses, contact details, industry, size and revenue range, the tools and software you use, your customers and goals, samples of your brand voice, and whether your business is subject to particular regulations.
• Scheduling information — when you book a diagnostic call, the information needed to create the calendar event and send you an invitation, such as your name and email address.
• Communications — information in messages you send us through contact forms, newsletter sign-up, support emails, or the Hambone chatbot.

B. Information collected automatically. When you use the Services, we and our analytics providers collect technical information such as your IP address, device and browser type, pages viewed, referring pages, approximate location derived from your IP address, and interaction events. We collect this through cookies and similar technologies (see Section 5) and through server logs.

C. Information from third parties. If you sign in with a third-party identity provider, that provider gives us the account information described above, subject to your settings with that provider.

We use personal information to:

• provide, operate, maintain, and secure the Services;
• create and manage your account and authenticate your sign-in;
• schedule, prepare for, and conduct the diagnostic call, and prepare for any engagement;
• understand your business so we can give relevant consulting guidance;
• communicate with you — including service messages, responses to your inquiries, and, where you have opted in, occasional updates;
• monitor, debug, and improve the Services, including through aggregated and analytics data;
• prevent, detect, and respond to fraud, abuse, security incidents, and other harmful or unlawful activity; and
• comply with legal obligations and enforce our Terms of Service.

Where required by law, we rely on a lawful basis for processing — typically performance of our agreement with you, your consent (for example, for marketing emails), our legitimate interests in operating and improving the Services, or compliance with a legal obligation.

The Services include AI-powered features, including the Hambone chatbot. When you use these features, the text you submit is sent to our AI infrastructure provider to generate a response.

We do not sell your information, and we do not use your content or conversations to train AI foundation models. We select AI infrastructure providers on terms that do not permit them to use the content we send for processing to train their own models. AI processing is used to operate the feature you requested — nothing more.

As noted in our Terms of Service, AI-generated output can be inaccurate and should not be relied on as fact or as professional advice.

We use cookies and similar technologies for two purposes:

• Strictly necessary — cookies that keep you signed in, secure your session, and protect against abuse (including our bot-protection provider). The Services cannot function without these.
• Analytics — to understand how the Services are used so we can improve them. We use a combination of analytics tools, some of which are designed to be privacy-friendly and to avoid tracking individuals across sites.

Our analytics providers currently include PostHog, Plausible, Microsoft Clarity, and Cloudflare Web Analytics. We use these to measure usage in aggregate; we do not use them to build advertising profiles or to serve ads. You can control cookies through your browser settings, and you may opt out of certain analytics — see Section 11 and Section 15.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share personal information only as described here:

• Service providers and sub-processors — companies that host our infrastructure and help us operate the Services, under contracts that limit their use of the information to providing services to us (see Section 7).
• At your direction — when you ask us to, such as when you book a call and a calendar invitation is sent to you.
• Legal and safety — when we believe disclosure is reasonably necessary to comply with a law, regulation, legal process, or governmental request; to enforce our Terms; or to protect the rights, property, or safety of HB Services, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

We rely on a small set of established providers to run the Services. The main ones are:

• Cloudflare — website and application hosting, database, file storage, bot protection, AI processing, and web analytics.
• Google — email delivery and calendar scheduling through Google Workspace, and, if you choose it, sign-in with Google.
• Microsoft — sign-in with Microsoft, if you choose it, and the Microsoft Clarity analytics tool.
• PostHog and Plausible — product and website analytics.
• Sentry — error monitoring that helps us detect and fix technical problems.

Each provider receives only the information needed for its function and is bound by its own terms and privacy commitments. We will update this list as our providers change.

HB Services operates from the United States, and our infrastructure providers store and process information primarily in the United States, with content delivery handled across a global network of edge locations.

If you access the Services from outside the United States, understand that your information will be transferred to and processed in the United States and other countries, which may have different data-protection rules than your own. Where required, we rely on appropriate safeguards for such transfers.

We keep personal information for as long as it is needed for the purposes described in this Policy:

• Account and intake information — while your account is active and for a reasonable period afterward, so we can re-establish a relationship if you return and meet our legal and recordkeeping needs.
• Communications — for as long as needed to address your inquiry and keep a reasonable record of our correspondence.
• Technical and analytics data — generally retained for a limited period, and in aggregated or de-identified form for longer.
• Backups — information in routine backups persists for a limited backup-retention window even after deletion from the live system.

When information is no longer needed, we delete it or de-identify it. You may ask us to delete your information sooner — see Section 11.

We take reasonable measures designed to protect personal information, including:

• encryption of data in transit using current TLS standards;
• storage on established infrastructure providers that encrypt data at rest at the storage layer;
• hashing of account passwords, so they are not stored in readable form;
• access controls that limit who can reach systems and data;
• bot protection and rate limiting on sign-in and other sensitive actions; and
• ongoing work to add application-level encryption for the most sensitive stored fields.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and the appropriate authorities as required by applicable law.

Regardless of where you live, you can ask us to:

• Access the personal information we hold about you;
• Correct information that is inaccurate or incomplete;
• Delete your personal information and close your account; and
• Export a copy of the information you provided to us.

You can also unsubscribe from marketing emails at any time using the link in those emails; we will still send necessary service messages.

To make a request, email legal@hbservices.net. We will verify your request, respond within the time required by applicable law (generally within 45 days, with an extension where permitted), and will not discriminate against you for exercising these rights. An authorized agent may submit a request on your behalf with proof of authorization.

Several U.S. states give residents specific privacy rights, which generally include the rights to know, access, correct, and delete personal information, to obtain a portable copy, and to opt out of the sale of personal information, of sharing for targeted advertising, and of certain profiling.

We do not sell personal information and we do not share it for cross-context behavioral or targeted advertising, so there is no such activity for you to opt out of. You may still exercise the access, correction, deletion, and portability rights above by emailing legal@hbservices.net, and you may appeal a decision by replying to our response.

For Florida residents: Florida has enacted the Florida Digital Bill of Rights. Its core obligations apply only to very large companies above a high revenue threshold, which HB Services does not meet; even so, we extend the access, correction, deletion, and portability choices described in this Policy to all of our users.

The Services are operated from the United States and are intended for businesses in the United States. We do not target the Services to the European Economic Area, the United Kingdom, or other regions with comprehensive data-protection regimes.

If you are located in a region whose laws grant data-protection rights — such as rights of access, rectification, erasure, restriction, objection, and portability — and you believe those laws apply to your use of the Services, contact us at legal@hbservices.net and we will work with you in good faith to honor applicable rights.

The Services are intended for businesses and for adults acting on their behalf. They are not directed to children, and we do not knowingly collect personal information from anyone under 18, and in particular from any child under 13.

If you believe a child has provided us personal information, contact legal@hbservices.net and we will delete it.

Some browsers offer a “Do Not Track” signal. Because there is no common industry standard for how to respond to it, the Services do not currently respond to Do Not Track signals.

Because we do not sell or share personal information for targeted advertising, there is no opt-out for us to apply in response to a Global Privacy Control or similar opt-out preference signal. You can still exercise your choices as described in Section 11.

The Services may link to third-party websites and services that we do not control. This Policy does not apply to them. We encourage you to review the privacy policies of any third-party site you visit.

We may update this Privacy Policy from time to time. The “Last updated” date at the top shows when the current version took effect. If we make a material change, we will provide reasonable notice — for example, by email or a notice within the Services. Your continued use of the Services after a change takes effect means you accept the updated Policy.

For questions about this Privacy Policy, or to exercise any of your privacy choices, contact us at legal@hbservices.net. For general inquiries, contact hello@hbservices.net.