Legal
Privacy Policy
This policy covers ultracfo.co. It is written to be read, not to cover anyone in legal fog. Last updated .
What we collect
Information you give us. If you submit a form (newsletter, waitlist, contact, booking), we collect what you type: typically your name, email address, and your message. We use it to do the thing you asked for, and for nothing else.
What your browser sends with a form. A form submission also carries the user-agent string your browser sends, which names the browser and operating system you are on, and the page you came from if your browser reported one. Both arrive with the request rather than being asked for. We keep them on the submission so we know where an enquiry came from. Neither is collected while you are only reading the site.
Numbers you run through our tools. Our tools compute in your browser. The figures you enter stay on your device, and one tool also saves your last run there so you can come back to it. They are sent to us only if you ask us to email you a report. Our analytics never receive a figure you typed: a finished run records which of 6 result ranges you landed in, and nothing else about the result.
Tool submissions. If you do ask for the report, we store the figures you entered and the readings they produced, together with your email address and your name if you gave one, so we can write that report and follow up. We do not sell them or pass them outside the providers listed below. We keep them until you ask us to delete them, and replying to any email from us is enough to ask.
Usage analytics. We measure page visits with PostHog. By default this is cookieless: nothing is stored on your device, and a return visit looks like a new visitor to us. If you click Accept on the cookie bar, we set 1 measurement cookie so we can understand repeat visits. If you click Reject, we stay cookieless. The site works identically either way.
Text messaging
Our business phone number sends and receives text messages, and we use it to work with people who are already our clients: replying to what you send us, confirming appointments, scheduling huddles, and sending service updates about your engagement. If you message us, we collect your mobile number and the contents of your message so a human here can read it and reply.
We do not share or sell consumer personal information, including mobile phone numbers, with third parties or affiliates for marketing or lead generation purposes. No mobile information is shared with third parties or affiliates for marketing or promotional purposes. We do not send marketing or promotional texts, and we do not build texting lists. The infrastructure providers listed below process this data on our behalf and are contractually prohibited from using it for their own marketing.
Opt-in, opt-out, and consent management
How you opt in. You expressly opt in before we send you anything. We do not publish our business number, we do not buy numbers, and we do not add anyone to a texting list. You are given the number in person during your onboarding meeting, where we tell you that you may text us, explain that message frequency varies with your engagement and that message and data rates may apply, and tell you that you can reply STOP to opt out or HELP for assistance at any time. You agree to that out loud, before the first message.
How you opt out. Reply STOP to any message and we stop texting you. Reply HELP for assistance. Opting out changes nothing about the service you get from us; we will reach you by email instead, and you can ask us to start texting again whenever you want.
What we do not do
We do not share or sell consumer personal information, including mobile phone numbers, with third parties or affiliates for marketing or lead generation purposes. We do not rent your information. We do not run session recording. We do not currently use any advertising or retargeting pixels; if that ever changes, this policy will say so first and the pixel will only load for visitors who accepted.
Where your data lives
Like every modern site, we run on infrastructure providers who process data on our behalf: Vercel (hosting), Cloudflare (network and DNS), Supabase (database for form submissions), Resend (transactional email), PostHog (analytics), and Google Workspace (email). Form submissions also flow into our internal operations tooling so a human can respond.
Client conversations run through Zoom (business phone and text messaging) and Front (the shared inbox where our team reads and answers them). If you reach us on WhatsApp, that message also passes through Meta, who operate it, on its way to the same inbox.
Every provider named here is contractually prohibited from using your information for their own marketing.
How long we keep it
Form submissions are kept until you ask us to delete them. Analytics data is kept in aggregate.
Your choices
Email hi@xhack.co to ask what we hold about you, correct it, or have it deleted. We honor these requests regardless of where you live, which also covers the rights granted under GDPR and the California privacy laws. You can at any time, and withdrawing is the same one click as accepting.
Accessibility
If a disability makes any part of this site hard to use, including this policy or the cookie bar, see our accessibility statement for how to reach us and what we will do about it.
Contact
Privacy questions: hi@xhack.co.