Effective 2026-08-11 · Last updated 2026-08-11
This Privacy Policy explains how The Holding Company ("HoldCo," "we") collects, uses, and shares personal data when you use USERNAME.md (the "Service"). We are the controller of the data described here.
1. Data we collect
| Category | Examples | Why |
|---|---|---|
| Account & handle | Handle, display name, profile links, public keys, verified claims | Provide and serve your profile and API |
| Contact | Email address and forwarding target | Account notices; email forwarding at [email protected] |
| Payment | Billing metadata, last4, Stripe customer/token IDs (no full card number) | Process purchases and refunds |
| Usage | Aggregate, privacy-friendly analytics (Plausible); server logs | Security, reliability, product improvement |
2. How we use data
- To operate your handle, profile, signed records, and the read API;
- To forward email and send transactional/account messages;
- To process payments and provide refunds under our launch guarantee;
- To secure the Service, prevent abuse, and comply with law;
- To improve the Service using aggregate, non-identifying analytics.
3. Public by design
Your profile and its signed record are public by nature — that is the purpose of a shareable handle. Do not publish data you wish to keep private. Fields you add to your profile are served to anyone (including AI agents) who requests them.
4. Legal bases (EEA/UK)
We process data to perform our contract with you (providing the Service), for our legitimate interests (security, product improvement), to comply with legal obligations, and, where required, with your consent (e.g. non-essential cookies).
5. Sharing
We share data with processors acting on our behalf, including Stripe (payments), our email-forwarding and email-sending providers, hosting/CDN, and analytics. We do not sell your personal data. We may disclose data to comply with law or to protect rights and safety. See our Data Processing Addendum for business customers.
6. Retention
We keep account and handle data while your handle is active and as needed to provide the Service. Payment records are retained as required for tax and accounting. Logs are retained for a limited period for security and debugging, then deleted or aggregated.
7. Your rights
Depending on your location, you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to object or withdraw consent. To exercise these, email [email protected]. You may also complain to your local data-protection authority.
8. International transfers
We may process data in the United States and other countries. Where required, we use appropriate safeguards such as Standard Contractual Clauses for transfers out of the EEA/UK.
9. Security
We use encryption in transit, scoped access controls, and key material held in a secrets vault. No system is perfectly secure; report concerns to [email protected].
10. Children
The Service is not directed to children under 16, and we do not knowingly collect their data.
11. Changes & contact
We will post updates here with a new effective date. Controller: The Holding Company — [email protected]. See also our Cookie Policy.