Privacy Policy
What this website collects, why, who sees it, and the rights you have over it.
This Privacy Policy explains how HDC Brands LLC, a New Jersey limited liability company doing business as Carbon Grey Labs (“we,” “us,” “our”), collects, uses, shares and protects personal information in connection with carbongreylabs.com (the “Site”).
HDC Brands LLC is the controller of the personal information described here.
Scope. This Policy covers this website only. Our products — VinPilot, HomiPilot, BoatPilot, PilotMarket and BidderPilot — are separate services, each with its own privacy policy covering accounts, uploads, payments and generated content. Studio client engagements are governed by the engagement agreement and our Data Processing Agreement. This Policy does not cover third-party sites we link to.
1. Notice at collection
The table below is the notice required at or before collection under California law, and doubles as the Article 13 GDPR summary.
| Category | Examples | Why we collect it | Legal basis (GDPR) | Kept for |
|---|---|---|---|---|
| Identifiers | Name, email address, company name | Respond to inquiries; evaluate engagements | Pre-contractual steps at your request; legitimate interests | Life of the relationship + 24 months |
| Commercial information | Content of your message, the nature of your inquiry | Understand and respond to what you asked | Pre-contractual steps; legitimate interests | Life of the relationship + 24 months |
| Internet or network activity | IP address, browser and device type, operating system, referring page, pages viewed, timestamps | Security, abuse prevention, performance, aggregate traffic understanding | Legitimate interests in operating and securing the Site | Rolling 30 days in provider logs |
| Inferences | None | — | — | — |
We do not collect Social Security numbers, government identifiers, precise geolocation, biometric information, health information, financial account details, or any other sensitive personal information through this Site. We do not knowingly collect information from children (Section 11).
We do not sell or share personal information, as “sell” and “share” are defined by the California Consumer Privacy Act as amended by the CPRA. We have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes requiring a right to limit.
2. How the Site actually works
Two facts about this Site are worth stating plainly, because they mean we hold less about you than most sites do:
- The intake form does not transmit to us. It composes a message in your own email client. Nothing you type is stored by the Site or sent to a server until you choose to send that email yourself.
- The Site makes no third-party requests. Fonts, imagery and code are served directly from our own hosting. There are no advertising pixels, no analytics scripts, no social-media trackers, and no external font service. Your IP address is not disclosed to any third party by loading this Site, beyond our hosting and content-delivery provider.
If either of those changes, we will update this Policy and, where required, ask for your consent before the change takes effect.
3. Where information comes from
We collect information from you when you contact us, and automatically through our hosting and content-delivery provider’s technical logs. We do not buy personal information, and we do not obtain it from data brokers.
4. How we use information
We use personal information to: respond to inquiries and evaluate potential engagements; operate, secure, debug and improve the Site; detect and prevent fraud, abuse and security incidents; comply with legal obligations; establish, exercise or defend legal claims; enforce our terms; and — with your consent where required — send communications you have requested.
We do not use personal information collected through this Site to train artificial-intelligence models. See our AI Policy.
No automated decision-making. We do not use the Site to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 GDPR.
5. Legal bases (EEA, UK and Switzerland)
Where the GDPR or UK GDPR applies, we rely on:
- Steps taken at your request prior to entering a contract — responding to your inquiry (Art. 6(1)(b));
- Legitimate interests — operating, securing and improving the Site, preventing abuse, and developing our business, balanced against your rights (Art. 6(1)(f));
- Consent — optional communications, which you may withdraw at any time without affecting prior processing (Art. 6(1)(a));
- Legal obligation — where the law requires retention or disclosure (Art. 6(1)(c)).
You may object at any time to processing based on legitimate interests, on grounds relating to your particular situation, by emailing privacy@carbongreylabs.com.
6. Who we share it with
We do not sell or rent personal information. We disclose it only to:
- Service providers processing on our behalf under written contracts limiting their use — web hosting and content delivery (Vercel Inc.), domain and DNS, and email. Our current list is at /subprocessors.
- Professional advisers — lawyers, accountants and insurers, where necessary and under a duty of confidentiality.
- Authorities — where required by law, and only after satisfying ourselves the request is valid and lawful. Where we are legally permitted, we will notify you before disclosing.
- A successor entity in a merger, acquisition, financing or asset sale, subject to this Policy and with notice to you.
We have disclosed the categories in Section 1 to service providers for the business purposes stated, in the preceding 12 months.
7. International transfers
We are based in the United States, and personal information is processed there. Where we transfer personal information out of the EEA, the UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with transfer-impact assessments and supplementary technical measures including encryption in transit.
You may request a copy of the relevant safeguards by emailing privacy@carbongreylabs.com.
8. Retention
We keep personal information only as long as needed for the purposes in Section 1, per the retention periods in that table. When a period ends, we delete the information or irreversibly anonymise it. We may retain information longer where required by law or where it is necessary to establish, exercise or defend legal claims — and only for that purpose.
9. Security
We use administrative, technical and organisational measures appropriate to the nature of the data, including encryption in transit (HTTPS with HSTS), access controls on the systems that hold correspondence, least-privilege administration, and a Site architecture that avoids collecting what it does not need.
No method of transmission or storage is completely secure and we cannot guarantee absolute security.
Breach notification. If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and within 72 hours where feasible (Art. 33 GDPR), and notify you without undue delay where the risk is high (Art. 34), and as otherwise required by applicable US state law.
10. Your rights
Everyone. You may ask us to provide access to, correct, delete, or export the personal information we hold about you; object to or ask us to restrict certain processing; and withdraw consent you have given.
EEA, UK and Switzerland. You have the rights in Articles 15–22 GDPR, including access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with your supervisory authority — in the UK, the Information Commissioner’s Office; in the EEA, the authority for your country of residence, place of work or the place of the alleged infringement.
California. You have the right to know, delete, and correct; to know the categories collected, the sources, the purposes and the categories of recipients; to opt out of sale or sharing (we do neither); to limit use of sensitive personal information (we collect none); and to non-discrimination for exercising any right. You may use an authorised agent with written permission. We honour Global Privacy Control browser signals as an opt-out request.
Other US states. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland and other states with comprehensive privacy laws in force have comparable rights to access, delete, correct and port their information, and to opt out of targeted advertising, sale and profiling — none of which we perform on this Site. Where those laws provide an appeal of a refused request, you may appeal by replying to our decision; we will respond within the statutory period, and if we deny the appeal we will tell you how to contact your state Attorney General.
How to exercise them. Email privacy@carbongreylabs.com. We will verify your identity proportionately to the sensitivity of the request — usually by confirming control of the email address involved — and respond within the period required by applicable law: one month under GDPR (extendable by two months for complex requests, with notice) and 45 days under US state laws (extendable once by 45 days, with notice). We do not charge a fee unless a request is manifestly unfounded or excessive.
11. Children
The Site is intended for a business audience and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided personal information, contact privacy@carbongreylabs.com and we will delete it promptly.
12. EU and UK representatives
[To be completed — see note below.] As a controller established outside the EEA and UK that offers services to individuals there, we are required to designate representatives under Article 27 GDPR and Article 27 UK GDPR. Their names and contact details will be published here once appointed, and you may contact them on all matters relating to processing.
13. Changes
We may update this Policy. The “Last updated” date reflects the current version. For material changes we will post a prominent notice on the Site at least 30 days before they take effect, and where the law requires consent for the change, we will ask for it. Previous versions are available on request.
14. Contact
HDC Brands LLC d/b/a Carbon Grey Labs — New Jersey, USA Privacy requests: privacy@carbongreylabs.com · Legal: legal@carbongreylabs.com