Privacy Policy

01Introduction

This Privacy Policy explains how Ohexion LLC ("Ohexion," "we," "us," or "our") handles information in connection with www.ohexion.com (the "Site"). It applies only to this Site.

By using the Site, you agree to the handling of information described here. If you don't agree, please don't use the Site or its contact form. This policy is incorporated into our Terms of Service.

02Who we are

Ohexion LLC is an Idaho limited liability company and is the party responsible for the information described here (in EU/UK terms, the "data controller"). You can reach us at any time:

Ohexion LLC
Idaho, United States
contact@ohexion.com

03Information we collect

Information you give us through the contact form

The contact form on our home page is the only feature on this Site that collects personal information. There is no account system, no newsletter signup, and no checkout. When you submit the form, we receive and store:

Please don't include confidential, sensitive, or regulated information in the form — see Section 3 of our Terms of Service.

Information collected automatically when you submit the form

Alongside your message, our backend records two technical items:

• A one-way hash of your IP address. We do not store your IP address itself. It is converted with SHA-256 into a fingerprint that can't be reversed back into an address, and used solely to enforce a submission limit (five submissions per fifteen minutes) so the form can't be used for spam or abuse.
• Your browser's user-agent string — the browser and operating system version your browser reports. Used to diagnose problems with the form and to identify automated abuse.

Hosting logs

Like effectively every website, our hosting provider automatically logs standard technical information when you visit — including your IP address, the pages requested, referring page, and timestamps. These are ordinary web server logs kept by our host for security, performance, and abuse prevention. They are not used to build a profile of you, are not combined with contact form submissions, and are not sold.

What we do not collect

• No analytics or measurement tools of any kind;
• No advertising, remarketing, or tracking pixels;
• No first-party or third-party tracking cookies;
• No payment or card information (this Site processes no payments);
• No special-category data (health, biometrics, precise geolocation, and similar), which we never ask for.

04Legal bases for processing

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the General Data Protection Regulation:

Regulation (EU) 2016/679, Article 6(1); UK GDPR & Data Protection Act 2018

• Article 6(1)(b) — steps prior to entering a contract. Handling a business inquiry you sent us so we can respond and discuss possible work.
• Article 6(1)(f) — legitimate interests. Keeping the form and Site secure and free from spam and abuse (the hashed IP and user-agent), and keeping business records of inquiries. We've considered your interests, and the data involved is minimal and non-sensitive.
• Article 6(1)(c) — legal obligation. Where we must retain or disclose something to comply with the law.

We do not rely on consent for anything on this Site, and we do not carry out automated decision-making or profiling that produces legal effects.

05How we use information

Our use of what we collect is limited to:

• Reading and responding to your inquiry, and any follow-up correspondence about it;
• Assessing whether we're a fit for the work you're describing;
• Operating, maintaining, and securing the Site and its contact endpoint;
• Preventing spam, abuse, and automated submissions, and enforcing rate limits;
• Diagnosing technical problems; and
• Complying with legal obligations and enforcing our Terms of Service.

06Cookies, storage & fonts

Cookies

This Site sets no cookies — not for analytics, not for advertising, not for sessions. There is no cookie banner because there is nothing to consent to.

Browser storage

The Site stores a single value in your browser's sessionStorage under the key ohexionBooted. Its only purpose is to remember that you've already seen the intro animation so it doesn't replay as you move between pages. It contains no personal information, is never transmitted to us, and your browser discards it when you close the tab.

Web fonts

The Site loads typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). To serve those files, your browser makes a request to Google, which necessarily discloses your IP address and user-agent to Google, and that request is handled under Google's Privacy Policy rather than this one. Google Fonts does not set cookies for this purpose. We mention this because it's a real disclosure of your IP address to a third party, even though we receive nothing from it.

If we ever add analytics or any cookie-based tool, we will update this section before that tool collects anything, and note the change under Section 15.

07Service providers & disclosure

We don't sell, rent, or trade personal information. We rely on a small number of providers to operate the Site, and they process information on our behalf under their own terms (in EU/UK terms, as "processors"):

We may also disclose information we hold:

• When required by law, subpoena, or other valid legal process;
• To protect the rights, property, or safety of Ohexion LLC, our clients, or others, including investigating suspected fraud or abuse; or
• In connection with a merger, acquisition, financing, or sale of assets — in which case any successor would be bound by this policy with respect to information collected before the transfer, and we would note the change on this page.

08International data transfers

Ohexion LLC operates in the United States, and the infrastructure behind the contact form is hosted in the United States (the Cloud Function runs in Google's us-central1 region). If you contact us from outside the United States, your information will be transferred to and stored in the United States, which may have different data protection laws than your country.

Where GDPR applies to a transfer, we rely on appropriate safeguards for transfers to the United States, including the European Commission's Standard Contractual Clauses as incorporated into our providers' data processing terms.

Regulation (EU) 2016/679, Chapter V (Articles 44–49)

09How long we keep information

• Contact form submissions — kept while we're corresponding with you and afterward as a business record of the inquiry. We review submissions periodically and delete those with no ongoing relevance. You can ask us to delete yours at any time (see Section 10).
• Rate-limiting records — the hashed-IP counters expire automatically and are retained no longer than 24 hours.
• Hosting logs — retained according to our hosting provider's standard log retention practices.

10Your privacy rights

Depending on where you live, you may have some or all of the following rights over information we hold about you:

• Access — ask for a copy of what we hold about you;
• Correction — have inaccurate information fixed;
• Deletion — ask us to delete what we hold;
• Restriction or objection — object to certain processing, including processing based on legitimate interests;
• Portability — receive your information in a portable format;
• Non-discrimination — we will not treat you differently for exercising any of these rights.

GDPR Articles 15–22 · CCPA as amended by the CPRA, Cal. Civ. Code § 1798.100 et seq.

How to exercise them

Email contact@ohexion.com from the address you used to contact us, or tell us the reference number shown when you submitted the form (for example OX-3F9A2C71), which helps us locate your submission quickly. We'll respond within 30 days, or within 45 days for California requests where an extension is permitted. We may need to verify your identity before acting, and we'll only ask for what's necessary to do so.

If you're in the EEA or UK, you also have the right to lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner's Office.

GDPR Article 77

11California disclosures

For California residents, under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• The categories of personal information we collect are identifiers (name, email address, hashed IP), commercial information (the inquiry type and budget range you select), professional information (company name, if you provide it), and internet activity information (user-agent string, server logs).
• We collect it directly from you, or automatically when you submit the form.
• We use it for the purposes in Section 5.
• We have not sold personal information, and have not shared it for cross-context behavioural advertising, in the preceding twelve months. We do not sell or share the personal information of minors under 16.
• We do not use or disclose sensitive personal information beyond what is necessary to provide and secure the Site.

Because we do not sell or share personal information, there is no "Do Not Sell or Share My Personal Information" link on this Site. You may still exercise your access, deletion, and correction rights as described in Section 10. You may use an authorized agent to submit a request on your behalf, and we may ask for proof of that authorization.

Cal. Civ. Code §§ 1798.100, 1798.105, 1798.106, 1798.110, 1798.120, 1798.135 · "Shine the Light," Cal. Civ. Code § 1798.83

12Children's privacy

This Site is a business-to-business site and is not directed at children. We do not knowingly collect personal information from anyone under 13, consistent with the Children's Online Privacy Protection Act. If you believe a child has provided us information through the contact form, email contact@ohexion.com and we'll delete it promptly.

COPPA, 15 U.S.C. §§ 6501–6506

13Data security

We take specific, practical steps to protect what the form collects:

• The Site is served over HTTPS, and form submissions are transmitted encrypted;
• Submissions are stored in Google Cloud Firestore with database rules that deny all client access — they are readable only through privileged server-side credentials;
• We store a hash of your IP address rather than the address itself;
• The endpoint enforces rate limits and validates every field server-side to resist abuse;
• A Content Security Policy and standard security headers are applied to the Site.

That said, no method of transmission over the internet or electronic storage is 100% secure, and we can't guarantee absolute security.

14Breach notification

If we become aware of a breach of security affecting personal information we hold, we will investigate and provide notice to affected individuals and to any regulator, in the manner and within the timeframes required by applicable law — including Idaho's data breach notification statute for our home jurisdiction, and, where the GDPR applies, notification to the relevant supervisory authority without undue delay and where feasible within 72 hours.

Idaho Code §§ 28-51-104 to 28-51-107 · GDPR Articles 33–34

15Changes to this policy

We may update this Privacy Policy as the Site changes — for example if we add analytics, a newsletter, or a client portal. We'll update the "Last updated" date at the top of this page whenever we do, and material changes will be described clearly here. Where a change would affect information we already hold in a materially different way, we'll seek your consent if the law requires it. Continuing to use the Site after an update means you accept the revised policy.

16Contact us

Questions about this policy, or about how we handled something you sent us, can go to contact@ohexion.com — the same address that receives contact form inquiries.

Ohexion LLC
Idaho, United States
contact@ohexion.com

See also our Terms of Service.