Privacy Policy

Effective date: April 11, 2026

This Privacy Policy explains how Hodler Suite collects, uses, stores, and deletes personal data and technical data processed through the website, account system, support workflows, billing flows, and platform security controls.

1. Controller Context

Hodler Suite acts as the operator of the Service for platform accounts, billing workflows, support records, and security telemetry. This policy is intended to align with applicable European data-protection law, including the GDPR, for data we control in connection with the Service.

2. Categories of Data We Process

Account data: email address, user ID, role, first name, last name, date of birth, gender, corporate-account flag, and base region where provided.
Authentication and security data: password hashes, 2FA/TOTP metadata, verification-code events, anti-abuse signals, device identifiers, browser/OS details, and login/session telemetry.
Support data: ticket subject, message, attachments, category details, and support conversation history.
Billing data: plan identifiers, checkout sessions, order references, invoice URLs, subscription states, provider payment identifiers, and payment-status callbacks.
Sign-up source: when you sign up through one of our campaign links, for example the QR code on our event badges or the button in a blog post, your account's sign-up record keeps the name of that campaign. We use it only to count sign-ups per event or post. It is kept as long as your account and is never shared.
Operational data: service-status samples, runtime audit traces, and logs necessary to maintain service reliability and security.

3. Why We Process Data

To create and secure accounts, authenticate users, and enforce role-based access rules.
To operate support, billing, subscription, and payment-reconciliation workflows.
To prevent abuse, detect suspicious activity, investigate incidents, and protect the integrity of the Service.
To provide user-facing exports, privacy requests, and account-management features.
To monitor reliability, troubleshoot failures, and maintain auditability of important administrative actions.

4. Legal Bases

Contractual necessity: to provide the account, subscription, checkout, support, and platform features you request.
Legitimate interests: to secure the Service, prevent fraud and abuse, investigate incidents, and keep the platform reliable.
Legal obligations: where records must be kept or disclosed for compliance, law-enforcement cooperation, accounting, tax, or similar legal duties.
Consent or acknowledgement where applicable: for flows that require a user-facing acknowledgement before optional or device-scoped processing is enabled.

5. Cookies and Similar Technologies

The homepage requires acknowledgement of strictly necessary cookies before continuing. Those cookies are limited to what is needed to keep the Service working, secure sessions, remember the device-scoped cookie acknowledgement state, and maintain security or anti-abuse flows.

We also defer external widgets that may involve third-party cookies until that device-scoped acknowledgement has been recorded. The cookie-acknowledgement record is stored per device for up to 730 days unless cleared earlier.

6. Processors and Recipients

We may use infrastructure, payment, email, and traffic-protection providers strictly to deliver or secure the Service. These providers act under their own terms and responsibilities where applicable. We do not sell personal data.

7. International Transfers

Depending on provider regions and service architecture, data may be processed outside the country from which you access the Service. Where required, appropriate contractual or technical safeguards are applied to such transfers.

8. Retention and Deletion

We retain data only for as long as it is needed for the purposes above, or for as long as applicable law, fraud-prevention, security, tax, accounting, or claims-defense obligations require.

User operation logs: 180 days.
Known-device records: 180 days.
Login-context records: 90 days.
API audit history and related runtime traces: 180 days.
Billing webhook events: 180 days.
Core account, support, and subscription records: retained while the account or commercial relationship remains active and thereafter only as long as reasonably necessary for contract, security, legal, or dispute-resolution purposes.

9. Security Measures

Password hashing, session controls, role-based access restrictions, and optional 2FA.
CSRF protection, security headers, reverse-proxy controls, rate limits, and anti-bot challenge flows.
Operational monitoring, service probes, reconciliation jobs, and privileged-operation audit trails.

No security control is absolute, but we implement layered protections designed for practical risk reduction and incident response.

10. Automated Processing Notice

Token risk scores, anomaly indicators, and related analytics are generated through automated processing. These outputs are intended as decision-support signals and should not be treated as fully autonomous legal or financial determinations.

11. Your GDPR Rights

Subject to applicable law, you may request access, rectification, erasure, restriction, objection, or data portability regarding personal data we control. We may ask for additional information to verify identity before acting on a request.

Verified requests are handled without undue delay and normally within one month of receipt. Where a request is complex or numerous, that period may be extended by up to two additional months, and we will tell you within the first month if an extension is needed.

If a request is refused or limited, we will explain why to the extent required by law. You also have the right to lodge a complaint with a competent supervisory authority.

12. How to Exercise Your Rights

Rectification: signed-in users can update profile fields from Account Settings.
Access / portability: signed-in users can download a machine-readable JSON export from Account Settings.
Erasure / restriction / objection / further review: signed-in users can submit a verified privacy request from Account Settings.
If you cannot access your account: use the Help Center and select the legal/privacy route appropriate to your issue.

13. Policy Updates

We may update this Privacy Policy when product behavior, operational controls, or legal requirements change. Updated versions become effective when published with a revised effective date.

For usage rules, disclaimers, and service obligations, see Terms of Use.