Privacy Policy

1. Data Controller

UNITED4 LLC is the data controller for personal information processed in connection with the HikariBlue platform and website.
Address: Austin, Texas 78701, United States
Contact: privacy@hikariblue.com

2. Information We Collect

We collect information in the following categories:

Information you provide directly:

• Name, email address, phone number, and company name (via contact forms, account registration)
• Billing information (processed by our payment processors; we do not store credit card numbers)
• Communications you send us (support requests, inquiries, feedback)
• Professional information (job title, department, company size) submitted during onboarding

Information collected automatically:

• Device and browser information (type, version, operating system, screen resolution)
• IP address and approximate geolocation (country/region level)
• Usage data (pages visited, features used, session duration, interaction patterns)
• Log data (access times, referring URLs, error logs)

Customer Data:

Data submitted by customers to the Platform (agent configurations, governance policies, audit logs) is processed on behalf of the customer as a data processor. The customer remains the data controller for such data.

3. Legal Basis for Processing (GDPR)

For individuals in the European Economic Area (EEA) and the United Kingdom, we process personal data under the following legal bases:

• Contract performance — to provide the Platform and Services you have requested
• Legitimate interests — to improve our services, ensure security, prevent fraud, and conduct analytics
• Consent — for marketing communications (which you may withdraw at any time)
• Legal obligation — to comply with applicable laws and regulations

4. How We Use Your Information

• Provide, maintain, and improve the Platform and Services
• Process transactions and send related information (confirmations, invoices)
• Respond to inquiries, support requests, and communications
• Send relevant product updates and marketing communications (with consent where required)
• Monitor and analyze usage patterns to improve user experience
• Detect, prevent, and address technical issues, fraud, and security threats
• Comply with legal obligations and enforce our Terms of Service

5. Data Sharing and Disclosure

We do not sell personal information. We may share information with:

• Service providers — third parties that perform services on our behalf (hosting, analytics, payment processing), subject to contractual data protection obligations
• Legal requirements — when required by law, regulation, legal process, or governmental request
• Business transfers — in connection with a merger, acquisition, or sale of assets, with notice to affected users
• With your consent — when you have given explicit authorization

6. Data Retention

• Account data: retained for the duration of your account, plus twelve (12) months after account deletion
• Contact form submissions: retained for twenty-four (24) months
• Technical and access logs: retained for twelve (12) months
• Contractual and billing data: retained as required by applicable tax and commercial law (typically seven years)
• Customer Data (Platform): retained per the terms of the applicable SOW or subscription agreement

7. International Data Transfers

Your data may be processed in the United States and the European Union. When transferring personal data from the EEA, UK, or Switzerland to the United States, we rely on: (a) Standard Contractual Clauses (SCCs) approved by the European Commission; (b) adequacy decisions where applicable; and (c) other lawful transfer mechanisms as required. We ensure that all data transfers are subject to appropriate safeguards and contractual protections.

8. Your Rights

Depending on your jurisdiction, you may exercise the following rights:

For all users:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (“right to be forgotten”)
• Opt out of marketing communications at any time

Additional rights for EEA/UK residents (under GDPR):

• Right to data portability
• Right to restrict processing
• Right to object to processing based on legitimate interests
• Right to withdraw consent at any time
• Right to lodge a complaint with your local data protection authority

Additional rights for California residents (under CCPA/CPRA):

• Right to know what personal information is collected, used, and disclosed
• Right to request deletion of personal information
• Right to opt out of the sale or sharing of personal information (we do not sell personal information)
• Right to non-discrimination for exercising your privacy rights

Additional rights for Texas residents (under TDPSA):

• Right to confirm whether we process your personal data
• Right to access, correct, and delete personal data
• Right to obtain a portable copy of personal data
• Right to opt out of targeted advertising and profiling

To exercise any of these rights, contact us at privacy@hikariblue.com. We will respond within thirty (30) days, or as required by applicable law.

9. Data Security

We implement administrative, technical, and physical security measures designed to protect personal information, including: end-to-end encryption for data in transit and at rest; role-based access controls; regular security audits and penetration testing; immutable audit logging; and incident response procedures. While we strive to protect personal information, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Cookies and Tracking Technologies

Our website uses only strictly necessary cookies required for proper functionality (session management, language preferences, authentication). We do not use third-party tracking cookies, advertising cookies, or behavioral analytics cookies. No cookie consent banner is required as we rely solely on technically essential cookies under applicable law.

11. Third-Party Service Providers

We use the following categories of service providers:

• Hosting and infrastructure: Vercel Inc. (deployment and CDN)
• Database and authentication: managed MySQL and OAuth2 API (Laravel Passport), region-bound deployments.
• Cloud infrastructure: Amazon Web Services and/or Google Cloud Platform

All service providers are contractually bound to process data only as instructed and to maintain appropriate security measures. Data processing agreements (DPAs) are in place with all providers that process personal data on our behalf.

12. Children's Privacy

The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately at privacy@hikariblue.com and we will promptly delete such information.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, technologies, or legal requirements. Material changes will be communicated via email to registered users or by posting a prominent notice on our website at least thirty (30) days before the effective date. Your continued use of the Platform after the effective date constitutes acceptance of the updated policy.

14. Contact

For questions, concerns, or requests regarding this Privacy Policy or our data practices:
UNITED4 LLC
Austin, Texas 78701, United States
privacy@hikariblue.com