Privacy Policy

Last Updated: September 2026

oldhamite ("we," "us," "our," or the "Company") operates oldhamite.com, a software-as-a-service platform accessible via oldhamite.com and any related applications, suboldhamites, and services (collectively, the "Services"). This Privacy Policy describes how we collect, use, disclose, retain, and safeguard information about you when you access or use the Services, and it explains the rights and choices available to you under applicable United States federal and state law.

This Policy applies to all visitors, registered users, account administrators, and business customers of the Services. It does not apply to any third-party website, application, or service that we do not control, even where the Services link to or integrate with such third parties. By accessing or using the Services, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described here, you must discontinue use of the Services.

We adopt a notice-and-choice model consistent with United States law. Except where applicable law requires affirmative opt-in consent — such as the sale or sharing of personal information under the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), or the collection of personal information from children under 13 under the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501-6506 (COPPA) and the COPPA Rule as amended effective June 2025 (16 C.F.R. Part 312, 2025 amendments) — we collect and use information as described herein based on your continued use of the Services. This Policy should be read together with our Cookie Policy and our Terms and Conditions.

1. Information We Collect

We collect information you provide directly to us, information collected automatically when you use the Services, and information obtained from third parties. The categories and specific pieces of information we collect depend on how you interact with the Services, the features you enable, and the configuration choices made by the organization that provisioned your account.

Information you provide. This includes account registration data (name, business email address, organization name, role, username, and password credentials); billing and payment information (billing contact, billing address, and payment card or ACH details processed by our third-party payment processors); profile and preference data; content you upload, submit, or transmit through the Services, including documents, records, messages, and support correspondence; and any other information you voluntarily provide when completing forms, responding to surveys, or communicating with us.

Information collected automatically. When you access the Services, we and our service providers automatically collect certain technical and usage data, including IP address, device type and identifiers, operating system, browser type and version, referring and exit URLs, pages or screens viewed, features used, clickstream data, session timestamps, and approximate geographic location derived from IP address. We collect this data using cookies, pixels, software development kits, and similar technologies as described in Section 4.

Information from third parties. We may receive information from identity verification providers, fraud prevention services, marketing and analytics partners, and integration partners whose applications you connect to your account. Where a business customer administers your account, that customer may provide us with your name, work email address, and role, and may instruct us regarding the processing of your information. In such cases, the business customer is the controller of that information and we process it on its behalf.

Sensitive personal information. The Services are not designed to collect sensitive personal information as defined under applicable state privacy laws, such as government-issued identification numbers, precise geolocation, racial or ethnic origin, religious beliefs, health information, or information concerning sexual orientation. You must not submit such information to the Services unless a separate written agreement with oldhamite expressly authorizes it. Where we process protected health information or nonpublic personal information on behalf of a customer, our obligations may additionally be governed by the Health Insurance Portability and Accountability Act (HIPAA) where applicable, or the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801-6809 (GLBA) for financial institutions, as applicable, and the applicable business associate or confidentiality agreement controls in the event of a conflict with this Policy.

2. How We Use Your Information

We use the information we collect to provide, operate, secure, maintain, and improve the Services; to authenticate users and administer accounts; to process transactions and send related invoices and confirmations; to respond to inquiries and provide customer support; and to communicate with you about service updates, security notices, and administrative matters. These uses are necessary to perform our contract with you or your organization and to operate our business.

We also use information for our legitimate business purposes, including analyzing usage trends, diagnosing technical problems, developing new features, conducting internal research and analytics, measuring the effectiveness of our marketing, and protecting against fraudulent, unauthorized, or illegal activity. We may de-identify or aggregate information so that it cannot reasonably be linked to an identified or identifiable individual, and we may use and disclose such de-identified or aggregated data for any lawful purpose.

Subject to your choices and applicable law, we may use your business contact information to send you marketing communications about products, services, promotions, and events that may be of interest to you. You may opt out of marketing communications at any time by using the unsubscribe mechanism included in each message or by contacting us at [email protected]. We will continue to send transactional and administrative messages regardless of your marketing preferences where those messages are necessary to the operation of your account.

We may combine information collected across the Services and across devices for the purposes described in this Policy. Where we use information for a purpose that is materially different from the purposes described at the time of collection, we will provide notice and, where required by law, obtain your consent before doing so.

3. Information Sharing

We do not sell your personal information for monetary consideration. We may share personal information with third parties in the circumstances described below, and we require our service providers and contractors to handle personal information consistent with this Policy and applicable law.

• Service providers and subprocessors. We share information with vendors that perform functions on our behalf, including cloud hosting, data storage, payment processing, email delivery, customer support, analytics, security, and professional advisory services. These providers are contractually restricted from using personal information for any purpose other than providing services to us.
• Integration and channel partners. When you connect a third-party integration or access the Services through a partner platform, we may share information necessary to enable that integration. Your use of a third-party service is governed by that third party's own privacy policy.
• Business customers and administrators. If your account was provisioned by an organization, that organization and its designated administrators may access information associated with your account, including usage data and content you create within the Services.
• Legal, safety, and compliance purposes. We may disclose information where we believe disclosure is necessary to comply with applicable law, regulation, legal process, or governmental request; to enforce our agreements; to investigate or prevent fraud, abuse, or security incidents; to protect the rights, property, or safety of oldhamite, our users, or the public; or to establish, exercise, or defend legal claims. We may also disclose information in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, in which case we will require the successor entity to honor this Policy with respect to personal information transferred.
• With your direction or consent. We may share information with third parties when you direct us to do so or when you provide consent.

Where required by applicable state law, certain disclosures for cross-context behavioral advertising or the use of third-party tracking technologies may be treated as a "sale" or "share" of personal information. If we engage in such activities, we will honor valid opt-out requests as described in Section 5.

4. Cookies and Tracking

We and our service providers use cookies, web beacons, pixels, local storage, and similar tracking technologies to operate the Services, remember your preferences, maintain sessions, authenticate users, measure performance, and analyze how the Services are used. Cookies are small data files placed on your device that allow us to recognize your browser on subsequent visits.

We use strictly necessary cookies required for the Services to function; functional cookies that remember your settings and preferences; analytics cookies that help us understand usage patterns and improve performance; and, where permitted, advertising cookies used to measure campaign effectiveness and, in some cases, to support cross-context behavioral advertising. Our disclosures and controls regarding these technologies are set out in our Cookie Policy, which is incorporated into this Policy by reference.

You may control cookies through your browser settings. Most browsers allow you to block or delete cookies; however, disabling strictly necessary cookies may prevent the Services from functioning properly. We honor the Global Privacy Control (GPC) signal, as required under the California Consumer Privacy Act as amended by CPRA (Cal. Civ. Code § 1798.120, § 1798.135), and treat a browser-based GPC signal as a valid request to opt out of the sale or sharing of personal information for cross-context behavioral advertising. We also honor applicable industry opt-out mechanisms, including the Digital Advertising Alliance's AdChoices program, with respect to participating third parties.

Certain tracking activities may implicate federal and state communications laws. See the Electronic Communications Privacy Act, 18 U.S.C. § 2511 (limited application), and state wiretapping and invasion-of-privacy statutes (e.g., California Invasion of Privacy Act § 631). We do not knowingly use session-replay technologies to capture form fields, payment card data, or other sensitive inputs, and we configure our analytics deployments to minimize the collection of sensitive information.

5. Your Rights and Choices

Depending on your state of residence, you may have certain rights regarding your personal information. Where applicable, residents of California (California Consumer Privacy Act as amended by the CPRA, Cal. Civ. Code § 1798.100 et seq.), Virginia (Virginia Consumer Data Protection Act, Va. Code § 59.1-575 et seq.), Colorado (Colorado Privacy Act, C.R.S. § 6-1-1300 et seq.), Connecticut (Connecticut Data Privacy Act, Conn. Gen. Stat. § 42-515 et seq.), Utah (Utah Consumer Privacy Act, Utah Code § 13-11-101 et seq.), and other states with comprehensive privacy laws (including Texas, Oregon, Montana, Florida, and Tennessee) may exercise the rights described below, subject to statutory exceptions and verification requirements.

• Right to know and access. You may request confirmation of whether we process your personal information and request access to the categories and specific pieces of personal information we have collected about you, the sources of that information, our purposes for processing it, and the categories of third parties with whom we share it.
• Right to delete. You may request that we delete personal information we have collected from you, subject to exceptions such as our need to complete a transaction, comply with a legal obligation, detect security incidents, or exercise legal rights.
• Right to correct. You may request that we correct inaccurate personal information we maintain about you, taking into account the nature of the information and our purposes for processing it.
• Right to opt out. You may request that we not sell your personal information or share it for cross-context behavioral advertising, and you may request that we not process your personal information for purposes of targeted advertising or profiling in furtherance of decisions with legal or similarly significant effects.
• Right to limit. Where applicable, you may request that we limit the use and disclosure of sensitive personal information to purposes permitted by law.
• Right to non-discrimination. We will not discriminate against you for exercising your privacy rights, including by denying goods or services, charging different prices, or providing a different level of quality, except as permitted by law for bona fide loyalty programs or financial incentives.
• Right to appeal. Where applicable state law provides an appeal right, you may appeal our decision on a rights request by responding to our decision notice or contacting us at [email protected].

To exercise these rights, submit a request to [email protected] or call +16092974262. You may designate an authorized agent to submit a request on your behalf, provided the agent supplies written authorization signed by you and we are able to verify your identity. We will acknowledge receipt of your request within the timeframe required by applicable law and will respond within 45 days, extendable where permitted. We may request information sufficient to verify your identity and residency, and we will use that information only for verification purposes.

6. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit using industry-standard protocols, encryption at rest for designated data stores, role-based access controls, authentication requirements, network monitoring, logging, vulnerability management, and periodic security assessments. Our personnel are subject to confidentiality obligations and receive privacy and security training.

No method of transmission over the internet and no method of electronic storage is completely secure. Accordingly, while we take reasonable steps to protect personal information, we cannot guarantee absolute security, and we expressly disclaim any warranty of security beyond the safeguards required by applicable law. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately of any suspected unauthorized access to your account.

In the event of a security incident involving personal information, we will notify affected individuals and regulators as required by applicable federal and state law, including applicable state breach notification statutes, without unreasonable delay and consistent with the legitimate needs of law enforcement.

7. International Data Transfers

The Services are operated in the United States and are intended for users located in the United States. Information we collect is stored and processed on servers located in the United States, and our service providers may process information in the United States or in other jurisdictions where they operate.

If you access the Services from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your jurisdiction and may afford a different level of protection. By using the Services, you consent to such transfer, storage, and processing to the extent permitted by applicable law.

Where we transfer personal information from jurisdictions imposing cross-border transfer restrictions, we implement appropriate safeguards, such as standard contractual clauses or equivalent mechanisms, and we require our subprocessors to do the same. Business customers subject to such restrictions are responsible for ensuring that their use of the Services complies with their own transfer obligations.

8. Children's Privacy

The Services are intended for business and professional use and are not directed to children under the age of 13. We do not knowingly collect, use, or disclose personal information from children under 13 except as permitted by the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501-6506 (COPPA), and the COPPA Rule as amended effective June 2025 (16 C.F.R. Part 312, 2025 amendments). Where the Services are made available to educational institutions or in other contexts where information about children may be processed, we require verifiable parental or institutional consent as required by law and process such information solely for the purpose for which it was provided.

If we learn that we have collected personal information from a child under 13 without the required consent, we will delete that information promptly. If you believe that a child under 13 has provided personal information to us, please contact us at [email protected]. If you are between 13 and 18 years of age, you may use the Services only with the involvement and consent of a parent or legal guardian. Where required, we honor opt-in or opt-out rights available to consumers under 16 years of age with respect to the sale or sharing of personal information.

9. Changes to Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will post the revised Policy on this page, update the "Last Updated" date, and provide additional notice where required by applicable law, such as by email or by an in-product notification. Your continued use of the Services after the effective date of a revised Policy constitutes acceptance of the revisions to the extent permitted by law.

We encourage you to review this Policy periodically. If you do not agree to a revised Policy, you must stop using the Services and, where applicable, may terminate your account in accordance with our Terms of Service. We will retain prior versions of this Policy for a reasonable period and will make them available upon written request.

10. Contact Information

If you have questions, concerns, or complaints about this Privacy Policy or our privacy practices, or if you wish to exercise any of the rights described in Section 5, please contact us using the details below. We will review and respond to all inquiries in accordance with applicable law.

• oldhamite
• Email: [email protected]
• Phone: +16092974262
• Address: 415 Mission Street, San Francisco, CA 94105, United States

If you are a resident of a state with a comprehensive privacy law and you are not satisfied with our response, you may have the right to appeal our decision as described in Section 5 or to contact your state attorney general. Nothing in this Policy limits any right you may have to lodge a complaint with a competent regulatory authority.

This Policy is governed by the laws of the United States and the state in which oldhamite is organized, without regard to conflict-of-law principles. If any provision of this Policy is held invalid or unenforceable, the remaining provisions will continue in full force and effect.