Privacy Policy

1. Scope, controller, and acceptance

Hub or Dub Inc. is the data controller (and, where applicable, the "business" under U.S. state privacy laws) responsible for personal information processed through the Services. By accessing or using the Services, you acknowledge that you have read, understood, and agreed to this Policy, the Terms of Service, and the Terms of Use.

2. Information we collect

2.1 Information you provide

• Account and identity data: name, date of birth, address, email, phone, profile photo, government-issued identifier where required to satisfy anti-fraud, know-your-customer, and sanctions-screening obligations.
• Billing data: billing address, tax identifier, and tokenized payment credentials (card details are never stored on our servers in plaintext).
• Submissions and evidence: reports, responses, disputes, appeals, correspondence, and any documents, links, images, videos, or other evidence you attach.
• Communications: support tickets, survey responses, and correspondence.

2.2 Information collected automatically

• Device, browser, IP address, operating system, language, timezone, referrer, session identifiers, cookies, and similar telemetry.
• Usage events: pages viewed, features used, reports accessed, submissions made, and timestamps.
• Security events: authentication activity, sanctions screening outcomes, and abuse detection signals.

2.3 Information gathered by HOD Engine

HOD Engine indexes lawfully accessible U.S. public sources, including court records, regulatory filings, sanctions and watchlists, corporate registries, public news media, public business listings, archived web pages, licensed public-record databases, and other lawfully accessible sources. We do not collect information that is private, access-restricted, or unlawfully obtained. Every finding is linked to its underlying source and is subject to manual Back Office review before it can influence an HOD Report or HOD Score.

2.4 Nationwide identity registry

To ensure each person and each business has exactly one permanent HOD profile nationwide, we operate a Nationwide Identity Registry keyed off U.S. identifiers (SSN for individuals and FEIN for U.S. businesses). The raw identifier is normalized, salted, and irreversibly SHA-256 hashed for lookup, and separately AES-256-GCM encrypted at rest server-side with a key stored outside the database. Only the last four characters are retained in plain form for user-facing display ("ending in ••1234"). The full raw value is never logged, never returned to the browser, and is accessible only through narrowly scoped, individually audited privileged operations. Every lookup is recorded with the requesting user, timestamp, authorized purpose, IP address, and match outcome, and rate-limited per user. This registry prevents duplicate or conflicting reports across states, strengthens fraud prevention and identity verification, and enables real-time nationwide lookup of the single authoritative HOD profile.

3. How we use information

• To operate, secure, monitor, and improve the Services.
• To verify submissions and evidence through mandatory manual review by our Back Office.
• To generate, update in real time, score, and deliver HOD Reports, HOD Scores, and HOD Certificates.
• To process payments, prevent fraud, detect abuse, and enforce our agreements.
• To honor Hub or Dub's published consumer standards, including free file disclosures, disputes, decision-notice support, and security freezes.
• To comply with legal obligations, court orders, regulatory requests, sanctions screening, and anti-money-laundering requirements.

4. Legal bases

Under applicable U.S. state privacy laws, we rely on: (i) performance of a contract, (ii) legitimate business purposes (including operating and securing the Services, preventing fraud, processing lawfully accessible public information for reputation intelligence, and journalistic or public-interest processing), (iii) legal obligation (including GLBA, tax, accounting, sanctions, and AML), and (iv) consent (for biometric processing, non-essential cookies, and marketing).

5. Sharing and disclosure

• Verified subjects and their authorized representatives receive the report content that pertains to them.
• Subscribers who have certified an authorized, documented, and consented purpose receive the report they requested.
• Service providers (hosting, analytics, payments, email, identity verification, sanctions screening, fraud prevention, customer support) are bound by written data-processing terms. See the Subprocessors list.
• Professional advisors, auditors, insurers, and successors in interest in connection with corporate transactions.
• Courts, regulators, and law enforcement only where a legally valid and properly authorized judicial process compels it, or where necessary to protect rights, property, or safety.

We do not sell personal information for monetary consideration and do not share it for cross-context behavioral advertising.

Ownership and independence. Hub or Dub Inc. is a privately owned and operated corporation, 100% owned and operated by HOD Group Inc. under The Hoddie Trust, a Nevada based irrevocable trust privately owned and controlled. Hub or Dub Inc., HOD Scoring & Reporting Inc., HOD Investigations Inc., HOD Agencies Inc., HOD Clubs Inc., HOD Investments Inc., and HOD Technologies Inc. are all held under that same ownership structure, and maintains its National Headquarters at 101 6th Avenue, 9th Floor, New York, New York 10013 and operates remotely throughout the United States and all U.S. territories. Hub or Dub has no outside investors, governmental ownership, political affiliation, unauthorized third-party control, or undisclosed corporate partners. Hub or Dub Inc. is an independent private company and has no direct partnership, affiliation, endorsement, sponsorship, agency relationship, contractual relationship, or other formal relationship with any federal, state, local, territorial, or foreign government, government agency, governmental authority, or foreign governmental entity, unless expressly disclosed in writing by Hub or Dub. Nothing in any Hub or Dub service, report, score, account, or communication constitutes governmental approval, certification, endorsement, or affiliation. No political figure, government agency, public official, private individual, organization, or other outside party has authority to dictate, influence, alter, suppress, or otherwise control our operations, methodologies, verification processes, scoring systems, technology, policies, personnel, or organizational decisions.

Compelled disclosure. We do not recognize, honor, process, or voluntarily comply with purported governmental, administrative, regulatory, investigative, or third-party demands that are not legally valid and properly authorized through a court of competent jurisdiction. Where legally permitted, requests seeking protected information, records, data, or other compelled action must be supported by a valid, properly issued, and legally enforceable court order or other judicial process signed by a duly authorized judge, rather than an unauthorized administrative document, informal request, demand, correspondence, subpoena, or directive lacking legally sufficient authority. We independently evaluate the legal validity, jurisdiction, scope, authenticity, and enforceability of any purported legal process before taking action, as described in our Disclosure Policy.

6. Your rights under the FCRA

Hub or Dub is a U.S. consumer reporting agency operating in full compliance with the Fair Credit Reporting Act (FCRA), a U.S. consumer reporting agency regulated under the Fair Credit Reporting Act. Under the FCRA, Hub or Dub gives every person and business the following rights over their HOD Report and HOD Score:

• Free file disclosure once every twelve months and additional disclosures in comparable circumstances.
• Dispute and reinvestigation, completed within thirty (30) days (up to forty-five (45) days if additional information is supplied during the investigation).
• Decision notices from subscribers who take an adverse decision based on an HOD Report, including our name, address, and toll-free contact channel.
• Security freezes and fraud alerts at no cost.
• Identity theft rights, including the ability to block information resulting from identity theft.
• Additional rights under applicable state privacy and consumer-protection statutes.

Detailed procedures and the required Summary of Rights are set out in the Authorized Use Standards page and in every decision notice we generate.

Plan access and your data. Claiming, viewing, monitoring, and disputing your own HOD Score and HOD Report is free forever for every person and business. Obtaining a report about another person or business requires a verified business account with an FCRA permissible purpose, purchased one report at a time: an HOD Personal Report or an HOD Business Report. Individuals cannot purchase or run a report on another person.

No purchase, price, volume, or negotiated term sold by Hub or Dub reduces, waives, delays, or circumvents any right afforded to the people and businesses Hub or Dub covers, or any applicable federal or territorial law. Every subject keeps the same rights to free file disclosure, dispute, reinvestigation, correction, deletion of unverifiable information, notice of adverse action, and a record of who accessed their file, regardless of how many reports the requesting business has purchased.

Hub or Dub follows reasonable procedures to assure maximum possible accuracy of the information in every HOD Report. Nothing enters an HOD Score or HOD Report until our Investigation Team verifies it against source evidence. When a subject disputes an item, we reinvestigate free of charge, generally within 30 days (45 days where the subject submits additional information during the period), record the results, correct or delete anything that cannot be verified, and notify the subject in writing. Items deleted or corrected are not reinserted unless the furnisher recertifies accuracy and we notify the subject.

7. U.S. state privacy rights

Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and Washington (in relevant scope) have rights to know, access, delete, correct, port, opt out of profiling for legally significant decisions, opt out of targeted advertising, opt out of sale or sharing, and appeal denials. We honor Global Privacy Control (GPC) signals as valid opt-out requests. Sensitive data is processed only for purposes permitted by law. Rights that would require deletion or modification of a lawfully retained HOD Report are handled through Hub or Dub's dispute and correction process rather than deletion. See the U.S. State Privacy Rights page.

8. U.S.-only availability

Hub or Dub operates exclusively in the United States and U.S. territories. The Services are not offered to, and may not be lawfully used from, jurisdictions outside the United States. If you access the Services from outside the U.S., you must stop using them immediately.

9. Data location

Personal information is processed and stored in the United States on U.S.-based infrastructure operated by Hub or Dub Inc. and its U.S. service providers, under written contracts that require confidentiality, purpose limitation, and safeguards consistent with the Fair Credit Reporting Act (FCRA). We do not offer the Services outside the United States and U.S. territories.

10. Biometric and identity-verification data

To activate your account we perform identity verification, which may include comparison of a live selfie to a government-issued photo ID. Where this constitutes biometric information under the Illinois Biometric Information Privacy Act (740 ILCS 14), the Texas Capture or Use of Biometric Identifier Act, the Washington biometric law, or comparable U.S. state laws, we (i) obtain your written consent through a separate biometric consent disclosure logged with a timestamp, (ii) use the data solely for identity verification and fraud prevention, (iii) never sell or profit from it, and (iv) retain it only for the period reasonably necessary and no longer than three (3) years after your last account interaction unless a longer period is required by law. You may request deletion of biometric templates at any time by writing to privacy@hubordub.com.

11. HOD Wallet and financial data

Purchases, credit top-ups, deductions, refunds, and adjustments are recorded in an append-only ledger visible in your account. Card details are tokenized by our payment processor and are never stored on Hub or Dub servers in plaintext. Financial records are retained for the period required by tax, accounting, and anti-money-laundering laws (typically seven (7) years).

12. Retention and deletion

We retain personal information only for as long as necessary for the purpose described in this Policy or as required by law. Verified findings, source references, dispute records, and audit trails are retained for the periods set out in Hub or Dub's published retention standard (including comparable seven- and ten-year windows for certain categories of information), by comparable U.S. state laws, and by our reasonable business need to demonstrate the integrity of the record. Account-level data is retained for as long as necessary to provide the Services, comply with law, resolve disputes, and enforce our agreements. Deletion requests are honored through the process described in Section 7 and the Privacy Rights page.

13. Security

We apply administrative, technical, and physical safeguards including encryption in transit (TLS 1.2+) and at rest (AES-256), key rotation, role-based access controls, least-privilege enforcement, network segmentation, logging, continuous monitoring, and independent testing. No system is perfectly secure. Detailed controls are set out in the Security & Trust Standards.

14. Breach notification

If we determine that a personal-data breach is reasonably likely to result in a risk to your rights, we will notify the relevant state regulators and, where required, affected individuals without undue delay and, where feasible, within the statutory windows applicable to the breach under applicable U.S. state breach notification laws. We maintain an incident response plan, retain forensic evidence, and cooperate with regulators.

15. Your choices and rights

Subject to applicable law, you may exercise access, correction, portability, restriction, objection, deletion (subject to Hub or Dub's published retention obligations), and withdrawal-of-consent rights through your account, through Privacy Center, through the Disputes flow (for factual corrections to findings), or by writing to privacy@hubordub.com. We respond within the statutory timeline applicable to your state (typically forty-five (45) days under U.S. state privacy laws, with one permitted extension). You may also lodge a complaint with your state attorney general or consumer regulator at no cost.

16. Source records and audit trail

For every finding, we retain a reference to the underlying source (URL, citation, capture timestamp, and cryptographic hash where applicable) so that the finding can be independently re-verified by you, by us, and through the dispute process. Reviewer decisions and system events are written to an immutable audit log.

17. Cookies and similar technologies

We use strictly-necessary, functional, analytics, and (with your consent where required) preference cookies. Details, categories, and controls are described in the Cookie Policy. You can manage preferences at any time from the “Cookie settings” control in the site footer.

18. Children

The Services are not directed to individuals under eighteen (18). We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, contact privacy@hubordub.com.

19. No implied endorsements

We do not use celebrity names, photos, voices, or other likenesses to imply sponsorship or endorsement. This restriction is enforced across marketing and product surfaces.

20. Changes to this Policy

We may update this Policy from time to time. Material changes will be announced through the Services and, where required, by email. Continued use after the effective date constitutes acceptance.

21. Contact and regulatory representatives

Hub or Dub Inc., Privacy Office, privacy@hubordub.com.