Privacy Policy

1. Who we are

This Privacy Policy explains how Hart Enterprises, LLC ("Hart", "we", "us"), a California limited liability company, collects, uses, discloses and protects personal information when you visit this website, hartenterprises.io (the "Site") or contact us about our eCommerce, ERP, CRM, mobile and AI services. Our mailing address is 360 E 1st Street, Suite 110, Tustin, CA 92780.

2. Scope

This policy covers the Site and the enquiries we receive through it. Personal information we process on behalf of our clients while delivering a project is governed by our contract with that client, not this policy.

3. Information we collect

• Information you give us. If you contact us through our contact form or by mail, we collect what you provide: through the form, your name, email address, company (optional), the topic you choose, your message, the page you were on when you submitted it, and any campaign (UTM) tags in the address of that page; by mail, whatever you write. Each form enquiry is emailed, through Spacemail (the email service of our hosting provider, Spaceship), to an inbox hosted by our inbox provider, Grok Bot (mail.grokbot.com), which receives and stores the enquiry on our behalf.
• Device and usage information. When you visit, our hosting provider, Spaceship (shared hosting), automatically receives standard technical data such as your IP address, browser type, device information, referring website, pages requested and timestamps.
• Content personalization. When a page loads, your browser asks our own server which version of our content to show (for example, which headline appears on the home page and which services are listed first). With that request your browser sends the page path, the address of the page that linked you to the Site (if your browser shares it), any campaign (UTM) tags in the link you followed, and any content code in that link. This request goes only to our server, and it happens whatever you chose on the cookie notice. Our server uses these details only to pick the content and does not save them, but like every request to the Site, it appears in our hosting provider's standard request logs. If you click Accept, two more things happen: a script in your browser keeps a short list of topic scores (for example "shopify" or "magento") based on the links and buttons you click or hover over and the pages you visit, in the hart_interests cookie, and our server may set the hart_persona cookie to remember which version you were shown. Your browser sends these cookies back to our server, which uses them to choose content. They contain topic scores and a content code only, never your name, email address or anything you type into a form. See "Content personalization and automated decisions".
• Booking a call. The Site's "Book a call" links open a booking page run by Cal.com in a new browser tab. The Site does not embed Cal.com or load any Cal.com script, and Cal.com receives nothing from the Site unless you click one of those links; when you do, your browser tells Cal.com only that you came from our domain. Cal.com receives what you enter on its booking page (for example your name, email and chosen time) and handles it under its own privacy policy.
• Spam protection. To prevent abuse of the contact form, we limit each visitor to 5 messages in 10 minutes. To do this, the form handler on our server stores a one-way (SHA-256) hash of your IP address, never the IP address itself, together with the time of each submission, in a small file in a private folder on our server that sits outside the public web folder and cannot be reached from the web. These files are generally deleted within 24 hours (at the next form request). The contact form uses Cloudflare Turnstile, an anti-spam check. The Cloudflare script loads only on pages that have a form, and only when you first click, tap or type in the form; it does not load when you simply view a page. This happens whatever you chose on the cookie notice. When it loads and when you submit, Cloudflare receives your IP address and browser data, and we send Cloudflare the check token and your IP address so it can verify you are a person. If the check fails, the form cannot be submitted.
• Analytics (only if you click Accept). If you click Accept, we turn on PostHog, a product analytics service. Its script is served from our own domain; once you accept, your browser contacts PostHog's US servers to load its settings and send usage data, so we can understand how visitors use the Site. PostHog stores an identifier in your browser's local storage and receives page views, clicks and other interactions, which version of our content you were shown and why (for example, because of a campaign tag), device and browser information, and your IP address. PostHog is not loaded before you accept, if you reject, or if your browser sends a Global Privacy Control signal. If you later reject, or your browser sends a GPC signal after an earlier Accept, we opt you out of PostHog and remove its stored keys.
• Site administration. The Site has a private sign-in page for our administrator, who edits the personalized content. It is not meant for visitors. If anyone tries to sign in there and fails, our server records a one-way hash of the IP address (never the IP address itself) and the time of each failed attempt, so it can block repeated guessing. These records are kept in a private folder outside the public web folder and are deleted during routine cleanup once they are more than 24 hours old.

4. Cookies and similar technologies

• The Site asks for your choice with a cookie notice that has equally prominent Accept and Reject buttons. Optional cookies, for content personalization and analytics, are used only if you click Accept. We do not treat continued browsing as consent.
• hart_consent: records your choice (accepted or rejected) so we do not ask again. Set when you click Accept or Reject. Expires after 1 year.
• hart_interests (optional): stores topic scores from the links you click, the items you hover over and the pages you visit on the Site, used by your browser and our server to choose content. Set only after you accept, and only while personalization is running. If you accept partway through a visit, the scores from that page so far are saved at that moment. Expires after 90 days.
• hart_persona (optional): remembers which version of our content you were shown, so it stays consistent on your next visit. Set by our server only after you accept and only if your browser does not send a GPC signal. It is not set for the standard version of the content or when you open a link that names a specific version. Expires after 90 days.
• hart_admin (strictly necessary, administration only): a security cookie for the administrator sign-in page. It is set only if you open that page, is sent only to that page, cannot be read by scripts on the Site, and is deleted when you close your browser. A signed-in session also ends on our server after 30 minutes without activity or 8 hours in total.
• If you click Reject, we set only hart_consent=rejected, delete hart_interests and hart_persona if they exist, and, if PostHog had been loaded, opt you out of it and remove its keys from your cookies, local storage and session storage. Our server also stops reading any personalization cookies.
• Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as a refusal: the cookie notice is not shown, we do not set personalization cookies or load PostHog, and our server ignores personalization cookies. If you had accepted earlier, GPC overrides that choice: we store your choice as rejected (hart_consent=rejected), delete hart_interests and hart_persona, opt you out of PostHog and remove its keys from your cookies, local storage and session storage.
• Browser storage. PostHog (only after you accept; PostHog's US servers) stores an identifier in your browser's local storage, which is removed if you reject or your browser sends a GPC signal. In your browser's session storage, which is cleared when you close the tab, we store hart_pop_dismissed (remembers that you closed a pop-up on the Site), hart_vocab (the list of topic keywords our server uses to match clicks to topics; it is the same for every visitor and says nothing about you) and, only if a personalization request fails, hart_persona_api_off (a flag so the page does not keep retrying). These session-storage items are stored whatever you chose on the cookie notice. Session storage is not a cookie and is not sent to our servers.
• You can also block or delete cookies and storage in your browser settings. The Site still works without them; content just will not be personalized from your earlier browsing, and optional analytics will not run. We do not use advertising cookies, ad pixels or any third-party advertising tags. The Site's fonts are hosted on our own servers.

5. How we use personal information

• To respond to enquiries, prepare proposals and provide the services you request.
• To operate, secure and troubleshoot the Site and prevent abuse, including protecting the administrator sign-in page.
• To understand and improve how the Site is used.
• To personalize Site content, such as which headline and services are shown first, based on the link you followed, the page you landed on and, if you accept, your topic interests on the Site.
• To comply with legal, tax and accounting obligations and to protect our rights.

6. Content personalization and automated decisions

Our server chooses which version of our marketing content to show using fixed rules that we set, in this order: a content code in the link you followed, campaign (UTM) tags, your topic scores (only if you accepted), the website that linked you to the Site, the page you landed on, the version you were shown last time (only if you accepted), and otherwise our standard version. We do not use an artificial intelligence (AI) service for this, and none of this information is sent to any outside AI provider. Personalization only changes which marketing headline, text, buttons and service order you see. Everyone can see all of the same pages and services, and it has no legal or similarly significant effect on you. To stop personalization based on your browsing, click Reject, use a GPC signal, or delete the hart_interests and hart_persona cookies.

7. How we disclose personal information

• Service providers that host, secure and support the Site and our communications: Spaceship (web hosting, and Spacemail for sending contact-form emails); Cloudflare (Turnstile anti-spam check); Grok Bot (mail.grokbot.com), which hosts the inbox that receives contact-form enquiries; and PostHog (analytics on its US servers, only if you accept). They may use the information only to provide services to us.
• Cal.com, if you choose to book a call: it receives what you enter on its booking page.
• Professional advisers such as lawyers and accountants.
• Legal and safety reasons, when required by law or to protect rights, property or safety.
• Business transfers, as part of a merger, acquisition or sale of all or part of our business.
• We do not sell personal information, and we do not share it for cross-context behavioral advertising.

8. Retention

We keep enquiry information in our enquiry inbox for as long as needed to respond and manage any resulting relationship, and then for 3 years after our last contact unless a longer period is required by law. Cookies expire as listed above. Server request logs are kept by our hosting provider, Spaceship, for the period set by its policies and our hosting account's log settings. Anti-spam rate-limit records are kept as described in "Information we collect". Failed sign-in records for the administrator page are deleted during routine cleanup once they are more than 24 hours old, and administrator session files on our server expire after 8 hours and are then removed during routine cleanup. Our server does not save the details it uses to choose personalized content.

9. Security

We use reasonable administrative, technical and physical safeguards, including encrypted (HTTPS) connections and restricted access to administrative systems. The administrator sign-in uses a single account with a securely hashed password, protection against forged requests, session time limits, and temporary lockouts after repeated failed attempts. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Your California privacy rights (CCPA/CPRA)

• If you are a California resident, you have the right to: know what personal information we collect, use and disclose; access a copy of it; request deletion; request correction of inaccurate information; opt out of the sale or sharing of personal information; and limit the use of sensitive personal information.
• Categories collected in the last 12 months: identifiers (such as name, email address, IP address and the online identifier PostHog stores in your browser); professional information (company, role); internet or other electronic network activity (pages viewed, referrer, campaign tags, interactions); and inferences (topic interest scores and the version of our content chosen for you, only if you accept). Sources: you, your device, and our service providers. Purposes: those listed in "How we use personal information". Categories disclosed for a business purpose: identifiers and professional information (what you enter in the contact form, plus campaign tags), to Grok Bot, which hosts our enquiry inbox, and to Spaceship, which sends the email; identifiers (including IP address) and internet or other electronic network activity, to Spaceship, our hosting provider, and, only if you accept cookies, to PostHog; inferences (which version of our content you were shown), to PostHog, only if you accept cookies; identifiers (IP address and browser data), to Cloudflare for the Turnstile anti-spam check; and identifiers and any other information you enter, to Cal.com if you book a call.
• We do not sell or share personal information as those terms are defined by California law, and we do not knowingly sell or share the personal information of consumers under 16. We do not use sensitive personal information for purposes that would require offering a right to limit.
• We will not discriminate against you for exercising your rights. To make a request, use our contact form (choose "Privacy request") or write to us at the mailing address below. These are our request methods. We will respond within 45 days, or tell you within that time if we need more time, as the law allows. We will verify your request by matching information you provide with information we hold. You may use an authorized agent, who must provide proof of your authorization.
• We honor Global Privacy Control (GPC) browser signals as a request to opt out of sale or sharing: when your browser sends GPC, the Site does not set personalization cookies or load PostHog, our server ignores personalization cookies, and if you had accepted earlier we switch your choice to rejected and clear that data (see "Cookies and similar technologies"). Although we do not sell or share personal information, we apply GPC in this way.

11. Visitors outside California

Depending on where you live, you may have additional rights, such as those under other US state laws or the GDPR in the EU/UK, including the right to object to processing and to lodge a complaint with a supervisory authority. Contact us to exercise them. Our servers and providers may process information in the United States and other countries.

12. Children's privacy

The Site is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

13. Links to other websites

The Site links to third-party websites, such as technology vendors. Their privacy practices are their own; please review their policies.

14. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new "last updated" date and, for material changes, give additional notice on the Site.

15. Contact us

For privacy questions or requests, use our contact form and choose or mention "Privacy request", or write to Hart Enterprises, LLC, Attn: Privacy, 360 E 1st Street, Suite 110, Tustin, CA 92780.