Privacy policy

We collect the following types of personal information:

• Account information: Name, email address, password, phone number
• Company information: Business name, entity type, state of formation, EIN, registered agent details
• Financial information: Billing details and payment method, entered on Stripe’s hosted checkout and processed by Stripe. The bank account a payout goes to is collected and held by Stripe; HYVV doesn’t store it
• Ownership data: Cap table entries, equity allocations, revenue sharing agreements, vesting schedules
• Usage data: Pages visited, features used, session duration, actions taken within the platform
• Technical data: IP address, browser type, device information, operating system, referral URLs

We process your data for the following purposes:

• Providing and maintaining the HYVV platform and its features
• Processing company formations, legal documents, and financial transactions
• Facilitating revenue sharing payouts and ownership tracking
• Sending transactional emails, invoices, and account notifications
• Improving our Service, developing new features, and fixing bugs
• Detecting, preventing, and addressing fraud, abuse, and security issues
• Complying with legal obligations and responding to lawful requests
• Communicating about new features, updates, and promotional offers (with your consent)

We share your information only in the following circumstances:

• Stripe: Payment processing, Stripe Connect for revenue sharing payouts
• State filing agencies: Company formation filings
• Setup providers you choose: Banks, accounting and workspace tools, to help you open or set up an account during Hyper Formation (setup only; HYVV doesn’t connect to or manage those accounts)
• Analytics providers: Aggregated, anonymized usage data to improve our Service
• Legal requirements: When required by law, regulation, or valid legal process
• Business transfers: In connection with a merger, acquisition, or sale of assets

We never sell your personal data to advertisers, data brokers, or any third parties for marketing purposes.

We protect your data with these measures:

• Every page and request is served over HTTPS, and browsers are told to always use it (HSTS)
• Passwords are stored only as bcrypt hashes; two-factor keys and recovery codes are encrypted with AES-256 before they’re saved
• Access is scoped per company: membership is checked on every request, and admin-only actions check your role
• Role changes, member removals, ownership transfers, disconnecting Stripe and deleting a company are written to an audit log
• Hosting and payments run on providers that publish their own security audits (Vercel and Stripe)

While we strive to protect your data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

We retain your personal information for as long as your account is active or as needed to provide the Service. After account deletion, we retain certain data as required by law (e.g., financial records for tax compliance) or for legitimate business purposes (e.g., fraud prevention).

Company formation records, signed documents and payment records may be kept after account closure for as long as tax and other laws require.

Depending on your location, you may have additional rights under the GDPR (EU/EEA), CCPA (California), or similar data protection laws:

• Right to access: Request a copy of your personal data
• Right to rectification: Correct inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data
• Right to portability: Export your data in a machine-readable format
• Right to object: Opt out of certain processing activities
• Right to restrict processing: Limit how we use your data
• Right to non-discrimination: Exercise your privacy rights without adverse treatment

To exercise any of these rights, contact us at team@hyvv.io. We will respond within 30 days.

HYVV operates primarily in the United States. If you access the Service from outside the US, your data may be transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) and other approved mechanisms for lawful international data transfers in compliance with applicable data protection regulations.

HYVV is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with personal data, we will take steps to delete that information promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or through a prominent notice on our platform. We encourage you to review this policy periodically for the latest information on our privacy practices.