Privacy policy

What we collect

Only what you give us, plus what any web server sees when a page loads:

• When you apply for an audit: your name, company and email address, and your company's revenue band and headcount. We also keep what you write about the work that slows you down, and how you heard about us.
• When you join the letter: your email address and the place on the site where you signed up.
• With an application, two facts about your visit: the first page you read here, and the site that sent you, if your browser shared it.
• When we speak: our notes. If everyone on the call agrees at the start, also a recording and its transcript (see “Calls and recordings” below).
• When you write to us: your message and whatever it contains.
• When any page loads: your IP address, browser type, the page requested and the time, recorded in our server logs and by our network provider.

We do not ask for payment details on the site. The written agreement for paid work sets how we invoice it.

What we use it for

• To read your application, reply to it and decide with you whether an audit makes sense. A person reads every application, and we make no decision about you by automated means.
• To prepare for and run the calls you book with us, and to write the audit if you go ahead.
• To send you the letter, if you joined it.
• To see which pages and sources bring us the people who apply, counted across all applications.
• To keep the site secure and working, and to meet our legal and accounting obligations.

European data protection law asks us to name the legal basis for each use. For applications and calls, it is the steps you ask us to take before a contract. For the letter and for recordings, it is your consent. For security, and for knowing where our clients come from, it is our legitimate interest in running the site.

Calls and recordings

We ask before we record. If everyone on the call agrees, we record it with an AI note-taking tool, which produces a transcript. If anyone says no, we take notes by hand and record nothing.

We use transcripts and the material you share with us to prepare the audit, with the help of Anthropic's Claude. Under Anthropic's commercial terms, what we send is not used to train its models. Once you become a client, the written agreement for that work also covers the material you share. It sets how we handle and return that material.

If you speak about other people on a call, such as your employees or customers, keep it to what the work needs. We use it only to do that work.

Who else processes it

We use a small number of companies to run the site and our work. Each sees only what its job needs:

We do not sell or rent your information to anyone. We would disclose it to an authority only where the law requires us to. If Hundredfold were ever sold or merged, it would pass to the new owner under the same promises.

Cookies

The site sets two cookies of its own, and neither is used for advertising or tracking across other sites:

• A session cookie, deleted when you close your browser. It remembers the first page you read, so that an application you send later still says where you came in.
• A language cookie, set only when you choose English or French yourself, kept for one year.

Cloudflare may set a cookie that tells real visitors from automated traffic. We run no analytics, advertising or social media tracking on the site.

How long we keep it

• Applications, notes, recordings and transcripts from people who do not become clients: 24 months after our last contact, then deleted.
• Clients: for the length of the work and as long afterwards as the written agreement, tax and accounting law require.
• The letter: until you unsubscribe. Reply to any letter or write to [email protected] and we remove you.
• Server logs: only as long as we need them to keep the site secure and fix faults.

Your rights

Wherever you live, you can ask to see what we hold about you. You can also ask us to correct it, delete it, or send it to you in a portable format. You can withdraw a consent at any time, and object to what we do on the basis of our legitimate interest. Write to [email protected] and we reply within one month.

If you are in the European Union or the United Kingdom, you can also complain to your data protection authority. In France, that is the CNIL.

If you are in California, you have the right to know, delete and correct the personal information we hold. You also have the right to opt out of its sale or sharing. We do not sell or share personal information as the California Consumer Privacy Act defines it. We will not treat you differently for using these rights.

Where your information is kept

We are a US company, and our servers are in the United States. Information you send from Europe therefore goes to the United States. Each provider that receives personal data from the European Union has one of two safeguards in place. The first is the European Commission's standard contractual clauses. The second is a certification under the EU-US Data Privacy Framework.

Security

The site uses only encrypted connections, and only the two founders can read applications. No system is perfectly secure. If a breach affected your information, we would tell you and the authorities as the law requires.

Children

The site and our services are for people running businesses. We do not knowingly collect information from anyone under 18.

Changes to this policy

When we change this policy, we update the date at the top. If a change affects how we use information you have already given us, we tell you by email before it applies.