Privacy Policy

1. Scope, controller, and acceptance

Hub or Dub Inc. is the data controller (and, where applicable, the “business” under U.S. state privacy laws and the “consumer reporting agency” under the FCRA) responsible for personal information processed through the Services. By accessing or using the Services, you acknowledge that you have read, understood, and agreed to this Policy, the Terms of Service, and the Terms of Use.

2. Information we collect

2.1 Information you provide

• Account and identity data: name, date of birth, address, email, phone, profile photo, government-issued identifier where required to satisfy anti-fraud, know-your-customer, sanctions, and consumer-reporting obligations.
• Billing data: billing address, tax identifier, and tokenized payment credentials (card details are never stored on our servers in plaintext).
• Submissions and evidence: reports, responses, disputes, appeals, correspondence, and any documents, links, images, videos, or other evidence you attach.
• Communications: support tickets, survey responses, and correspondence.

2.2 Information collected automatically

• Device, browser, IP address, operating system, language, timezone, referrer, session identifiers, cookies, and similar telemetry.
• Usage events: pages viewed, features used, reports accessed, submissions made, and timestamps.
• Security events: authentication activity, sanctions screening outcomes, and abuse detection signals.

2.3 Information gathered by HOD Engine

HOD Engine indexes lawfully accessible U.S. public sources, including court records, regulatory filings, sanctions and watchlists, corporate registries, public news media, public business listings, archived web pages, licensed public-record databases, and other lawfully accessible sources. We do not collect information that is private, access-restricted, or unlawfully obtained. Every finding is linked to its underlying source and is subject to manual Back Office review before it can influence an HOD Report or HOD Score.

2.4 Nationwide identity registry

To ensure each person and each business has exactly one permanent HOD profile nationwide, we operate a Nationwide Identity Registry keyed off U.S. identifiers (SSN for individuals and FEIN for U.S. businesses). The raw identifier is normalized, salted, and irreversibly SHA-256 hashed for lookup, and separately AES-256-GCM encrypted at rest server-side with a key stored outside the database. Only the last four characters are retained in plain form for user-facing display ("ending in ••1234"). The full raw value is never logged, never returned to the browser, and is accessible only through narrowly scoped, individually audited privileged operations. Every lookup is recorded with the requesting user, timestamp, permissible purpose, IP address, and match outcome, and rate-limited per user. This registry prevents duplicate or conflicting reports across states, strengthens fraud prevention and identity verification, and enables real-time nationwide lookup of the single authoritative HOD profile.

3. How we use information

• To operate, secure, monitor, and improve the Services.
• To verify submissions and evidence through mandatory manual review by our Back Office.
• To generate, update in real time, score, and deliver HOD Reports, HOD Scores, and HOD Certificates.
• To process payments, prevent fraud, detect abuse, and enforce our agreements.
• To honor consumer reporting rights, including free file disclosures, disputes, adverse action support, and security freezes.
• To comply with legal obligations, court orders, regulatory requests, sanctions screening, and anti-money-laundering requirements.

4. Legal bases

Under applicable U.S. state privacy laws, we rely on: (i) performance of a contract, (ii) legitimate business purposes (including operating and securing the Services, preventing fraud, processing lawfully accessible public information for reputation intelligence, and journalistic or public-interest processing), (iii) legal obligation (including FCRA, GLBA, tax, accounting, sanctions, and AML), and (iv) consent (for biometric processing, non-essential cookies, and marketing).

5. Sharing and disclosure

• Verified subjects and their authorized representatives receive the report content that pertains to them.
• Users of an HOD Report who have certified a permissible purpose receive the report they requested.
• Service providers (hosting, analytics, payments, email, identity verification, sanctions screening, fraud prevention, customer support) are bound by written data-processing terms. See the Subprocessors list.
• Professional advisors, auditors, insurers, and successors in interest in connection with corporate transactions.
• Courts, regulators, and law enforcement only where a legally valid and properly authorized judicial process compels it, or where necessary to protect rights, property, or safety.

We do not sell personal information for monetary consideration and do not share it for cross-context behavioral advertising.

Ownership and independence. Hub or Dub Inc. is a privately owned and operated corporation, 100% owned and operated by Stutson Global Inc. under the Stutson Family Trust, a Nevada based irrevocable trust owned and controlled privately by the Stutson family. Hub or Dub Inc., HOD Scoring & Reporting Inc., HOD Investigations Inc., HOD Clubs Inc., HOD Investments Inc., and HOD Technologies Inc. are all held under that same ownership structure., and maintains its National Headquarters at 101 6th Avenue, 9th Floor, New York, New York 10013 and operates remotely throughout the United States and all U.S. territories. Hub or Dub has no outside investors, governmental ownership, political affiliation, unauthorized third-party control, or undisclosed corporate partners. Hub or Dub Inc. is an independent private company and has no direct partnership, affiliation, endorsement, sponsorship, agency relationship, contractual relationship, or other formal relationship with any federal, state, local, territorial, or foreign government, government agency, governmental authority, or foreign governmental entity, unless expressly disclosed in writing by Hub or Dub. Nothing in any Hub or Dub service, report, score, account, or communication constitutes governmental approval, certification, endorsement, or affiliation. No political figure, government agency, public official, private individual, organization, or other outside party has authority to dictate, influence, alter, suppress, or otherwise control our operations, methodologies, verification processes, scoring systems, technology, policies, personnel, or organizational decisions.

Compelled disclosure. We do not recognize, honor, process, or voluntarily comply with purported governmental, administrative, regulatory, investigative, or third-party demands that are not legally valid and properly authorized through a court of competent jurisdiction. Where legally permitted, requests seeking protected information, records, data, or other compelled action must be supported by a valid, properly issued, and legally enforceable court order or other judicial process signed by a duly authorized judge, rather than an unauthorized administrative document, informal request, demand, correspondence, subpoena, or directive lacking legally sufficient authority. We independently evaluate the legal validity, jurisdiction, scope, authenticity, and enforceability of any purported legal process before taking action, as described in our Disclosure Policy.

6. Consumer reporting agency disclosures (United States)

Hub or Dub operates as a consumer reporting agency (“CRA”) under Section 603(f) of the Fair Credit Reporting Act, 15 U.S.C. § 1681a(f). When an HOD Report is furnished for a permissible purpose under 15 U.S.C. § 1681b, it is a “consumer report.” Consumer rights include:

• Free file disclosure once every twelve months and additional disclosures in the circumstances required by 15 U.S.C. § 1681j.
• Dispute and reinvestigation under 15 U.S.C. § 1681i, completed within thirty (30) days (up to forty-five (45) days if additional information is supplied during the investigation).
• Adverse action notices from users of a consumer report under 15 U.S.C. § 1681m, including our name, address, and toll-free contact channel.
• Security freezes and fraud alerts under 15 U.S.C. § 1681c-1 at no cost.
• Identity theft rights, including the ability to block information resulting from identity theft under 15 U.S.C. § 1681c-2.
• Additional rights under equivalent state statutes, including the California Consumer Credit Reporting Agencies Act, the New York Fair Credit Reporting Act, the Maine Fair Credit Reporting Act, and comparable state laws.

Detailed procedures and the required Summary of Rights are set out in the FCRA & CRA Compliance page and in every adverse action notice we generate.

Plan access and your data. Free accounts and My HOD+ members may view, monitor, dispute, and correct only their own HOD Score and HOD Report. Obtaining a report about another person or business requires HOD Run+, HOD Pro+, or HOD Enterprise+, together with identity verification and a recorded permissible purpose for every request. Only HOD Pro+ and HOD Enterprise+ may obtain consumer reports for FCRA-covered eligibility decisions.

No plan, tier, add-on, seat count, service level, or negotiated term sold by Hub or Dub reduces, waives, delays, or circumvents any right afforded to consumers under the Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.), Regulation V (12 C.F.R. Part 1022), or any other applicable federal or territorial law. HOD Enterprise+ is not an exception. Every consumer keeps the same rights to free file disclosure, dispute, reinvestigation, correction, deletion of unverifiable information, notice of adverse action, and a record of who accessed their file, regardless of which plan the requesting party holds or how much that party pays.

Hub or Dub follows reasonable procedures to assure maximum possible accuracy of the information in every HOD Report, as required by FCRA § 607(b). Nothing enters an HOD Score or HOD Report until our Investigation Team verifies it against source evidence. When a consumer disputes an item, we reinvestigate free of charge, generally within 30 days (45 days where the consumer submits additional information during the period), record the results, correct or delete anything that cannot be verified, and notify the consumer in writing. Items deleted or corrected are not reinserted unless the furnisher recertifies accuracy and we notify the consumer.

7. U.S. state privacy rights

Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and Washington (in relevant scope) have rights to know, access, delete, correct, port, opt out of profiling for legally significant decisions, opt out of targeted advertising, opt out of sale or sharing, and appeal denials. We honor Global Privacy Control (GPC) signals as valid opt-out requests. Sensitive data is processed only for purposes permitted by law. Rights that would require deletion or modification of a lawfully retained consumer report are handled through the FCRA dispute and correction process rather than deletion. See the U.S. State Privacy Rights page.

8. U.S.-only availability

Hub or Dub operates exclusively in the United States and U.S. territories. The Services are not offered to, and may not be lawfully used from, jurisdictions outside the United States. If you access the Services from outside the U.S., you must stop using them immediately.

9. Data location

Personal information is processed and stored in the United States on U.S.-based infrastructure operated by Hub or Dub Inc. and its U.S. service providers, under written contracts that require confidentiality, purpose limitation, and FCRA-consistent safeguards. We do not offer the Services outside the United States and U.S. territories.

10. Biometric and identity-verification data

To activate your account we perform identity verification, which may include comparison of a live selfie to a government-issued photo ID. Where this constitutes biometric information under the Illinois Biometric Information Privacy Act (740 ILCS 14), the Texas Capture or Use of Biometric Identifier Act, the Washington biometric law, or comparable U.S. state laws, we (i) obtain your written consent through a separate biometric consent disclosure logged with a timestamp, (ii) use the data solely for identity verification and fraud prevention, (iii) never sell or profit from it, and (iv) retain it only for the period reasonably necessary and no longer than three (3) years after your last account interaction unless a longer period is required by law. You may request deletion of biometric templates at any time by writing to privacy@hubordub.com.

11. HOD Wallet and financial data

Purchases, credit top-ups, deductions, refunds, and adjustments are recorded in an append-only ledger visible in your account. Card details are tokenized by our payment processor and are never stored on Hub or Dub servers in plaintext. Financial records are retained for the period required by tax, accounting, and anti-money-laundering laws (typically seven (7) years).

12. Retention and deletion

We retain personal information only for as long as necessary for the purpose described in this Policy or as required by law. Verified findings, source references, dispute records, and audit trails that form part of our consumer reporting activity are retained for the period required by the FCRA (including the seven- and ten-year windows under 15 U.S.C. § 1681c), by comparable U.S. state laws, and by our reasonable business need to demonstrate the integrity of the record. Account-level data is retained for as long as necessary to provide the Services, comply with law, resolve disputes, and enforce our agreements. Deletion requests are honored through the process described in Section 7 and the Privacy Rights page.

13. Security

We apply administrative, technical, and physical safeguards including encryption in transit (TLS 1.2+) and at rest (AES-256), key rotation, role-based access controls, least-privilege enforcement, network segmentation, logging, continuous monitoring, and independent testing. No system is perfectly secure. Detailed controls are set out in the Security & Trust Standards.

14. Breach notification

If we determine that a personal-data breach is reasonably likely to result in a risk to your rights, we will notify the relevant state regulators and, where required, affected individuals without undue delay and, where feasible, within the statutory windows applicable to the breach under applicable U.S. state breach notification laws. We maintain an incident response plan, retain forensic evidence, and cooperate with regulators.

15. Your choices and rights

Subject to applicable law, you may exercise access, correction, portability, restriction, objection, deletion (subject to CRA retention obligations), and withdrawal-of-consent rights through your account, through Privacy Center, through the Disputes flow (for factual corrections to findings), or by writing to privacy@hubordub.com. We respond within the statutory timeline applicable to your state (typically forty-five (45) days under U.S. state privacy laws, with one permitted extension). You may also lodge a complaint with your state attorney general or consumer regulator at no cost.

16. Source records and audit trail

For every finding, we retain a reference to the underlying source (URL, citation, capture timestamp, and cryptographic hash where applicable) so that the finding can be independently re-verified by you, by us, and through the dispute process. Reviewer decisions and system events are written to an immutable audit log.

17. Cookies and similar technologies

We use strictly-necessary, functional, analytics, and (with your consent where required) preference cookies. Details, categories, and controls are described in the Cookie Policy. You can manage preferences at any time from the “Cookie settings” control in the site footer.

18. Children

The Services are not directed to individuals under eighteen (18). We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, contact privacy@hubordub.com.

19. No implied endorsements

We do not use celebrity names, photos, voices, or other likenesses to imply sponsorship or endorsement. This restriction is enforced across marketing and product surfaces.

20. Changes to this Policy

We may update this Policy from time to time. Material changes will be announced through the Services and, where required, by email. Continued use after the effective date constitutes acceptance.

21. Contact and regulatory representatives

Hub or Dub Inc., Privacy Office, privacy@hubordub.com.