Privacy Policy

1. Information We Collect

1.1 Information you give us directly

• Account information. When you sign in to the client portal we collect your name, email address, and any profile information you provide to our authentication provider (e.g. Google, GitHub, or email magic link via Clerk).
• Newsletter subscription. Your email address and, if you subscribe to a paid tier, a Stripe customer reference. We do not receive your full payment card details — those are handled by Stripe.
• Consulting and contact inquiries. Any information you include in a form submission, email, or scheduled call (name, company, project description, phone number if you choose to share it).

1.2 Information collected automatically

• Basic request data. IP address, user agent, referring URL, and pages visited — logged by our hosting provider (Vercel) for security, abuse prevention, and traffic analytics.
• Analytics. Aggregated, anonymized usage metrics (page views, country-level geography, device class) via Vercel Analytics. We do not use cross-site advertising trackers.
• Advertising attribution. If you arrive via a Google Ads click, a conversion identifier may be stored to measure ad effectiveness. No personally identifying information is sent to Google through this mechanism.

2. How We Use Your Information

• Operate, secure, and improve the Site and the client portal.
• Authenticate you and authorize access to portal content (proposals, deliverables, blueprints you have purchased).
• Send newsletter emails you have subscribed to and respond to inquiries you initiate.
• Deliver and bill for consulting engagements you contract with us.
• Detect, prevent, and respond to fraud, abuse, or security incidents.
• Comply with legal obligations.

We do not use your personal information to train AI models, and we do not share your information with third parties for their own marketing.

3. Third-Party Services (Sub-Processors)

We rely on the following providers to operate the Site. Each is bound by its own privacy policy:

• Vercel — hosting, edge functions, analytics. Privacy policy
• Clerk — authentication and session management for the client portal. Privacy policy
• Stripe — payment processing for paid newsletter tiers and consulting invoices. Privacy policy
• Resend — transactional and newsletter email delivery. Privacy policy
• Google (OAuth & Ads) — optional sign-in via Google and ad-conversion measurement. Privacy policy
• GitHub — optional sign-in via GitHub and code-related portal features. Privacy policy

4. Cookies and Similar Technologies

We use a small number of strictly necessary cookies to keep you signed in to the client portal and to maintain CSRF protection. Analytics is performed without cross-site tracking cookies. You can disable cookies in your browser; the portal sign-in flow will not work without them.

5. Data Retention

• Portal accounts: retained until you delete the account or request deletion.
• Newsletter subscribers: retained until you unsubscribe; unsubscribe records kept for up to 24 months to honor opt-outs.
• Consulting client records: retained for the lesser of (a) the duration of our business relationship plus 7 years (for tax and legal reasons), or (b) any longer period required by law.
• Server access logs: retained by Vercel per their default policy (typically 30 days).

6. Your Rights

Depending on where you live (e.g. EU/UK under GDPR, California under CCPA/CPRA, or similar regimes), you may have the right to:

• Request access to the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your information.
• Object to or restrict certain processing.
• Receive a portable copy of your information.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email hector@htek.dev. We will respond within 30 days.

7. Security

We use industry-standard transport encryption (TLS) for all traffic to the Site, and we rely on Clerk, Stripe, and Vercel for at-rest encryption of credentials, payment data, and session tokens. No system is perfectly secure; we encourage you to use a strong, unique password and to enable multi-factor authentication on your sign-in provider.

8. International Transfers

htek.dev operates from the United States. Our sub-processors may store and process data in the U.S. and other jurisdictions. By using the Site you consent to the transfer of your information to the U.S., which may have different data protection laws than your country.

9. Children's Privacy

The Site and services are not directed to children under 13 (or under 16 in the EU/UK), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced on this page with a new effective date. Continued use of the Site after the new effective date constitutes acceptance of the updated policy.