← Back to Hatch Labs

Effective Date: March 6, 2026 | Last Updated: March 6, 2026

1. Information We Collect

1.1 Information You Provide Directly

Account Registration Information:

• Full legal name
• Email address
• Phone number
• Date of birth
• Gender identity
• Location (city, state)
• Profile photos

Professional Information:

• Educational background and degrees
• Current employer and job title
• Industry and work experience
• Professional achievements
• Career aspirations

1.2 Information Collected Automatically

Usage Information:

• App usage patterns and feature interactions
• Time spent on different sections
• Profile views and connection activities
• Search queries and filters used
• Device information (type, operating system, browser)

Technical Information:

• IP address and location data
• Device identifiers
• Log files and error reports
• Cookies and similar tracking technologies
• Session information

2. How We Use Your Information

2.1 Primary Service Functions

Membership Verification and Approval:

• Verify your identity and professional status
• Confirm income and asset information for membership eligibility
• Maintain platform quality and exclusivity
• Prevent fraud and ensure community safety

Platform Operation and Matching:

• Create and maintain your profile
• Provide matching and connection services
• Facilitate communication between members
• Personalize your experience and recommendations

3. Plaid Integration and Financial Data

3.1 Plaid Partnership

Hatch Labs uses Plaid, Inc. to verify your identity and financial information as a requirement for membership. Plaid is a trusted financial technology company that enables secure connections to your financial institutions.

What Plaid Collects:

• Account information (account numbers, routing numbers, balances)
• Identity information (name, address, phone number, email)
• Transaction data (limited to verification purposes)
• Income and employment information

How Plaid Protects Your Data:

• Bank-level security with 256-bit encryption
• Multi-factor authentication required
• SOC 2 Type II compliance
• Regular security audits and monitoring

4. How We Share Your Information

4.1 We Do Not Sell Your Information

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. Your data is valuable to us because it helps us provide better services to you, not because we profit from sharing it with others.

4.2 Service Providers and Business Partners

We share information with trusted service providers who help us operate our platform:

Infrastructure and Technical Services:

• Supabase: Database hosting and management (SOC 2 compliant)
• Plaid: Identity and financial verification services
• Cloudflare: Content delivery and security services
• GitHub: Code repository and deployment services

5. Data Retention and Deletion

5.1 Retention Periods

Active Account Data:
We retain your personal information for as long as your account is active and you continue to use our services.

Financial Verification Data:
We retain financial verification data for a minimum period required by financial service regulations, typically:

• Identity verification records: 5 years after account closure
• Income verification records: 3 years after account closure
• Anti-fraud data: 7 years after account closure

5.2 Account Deletion

You can delete your account at any time by contacting us at [email protected]. Upon account deletion:

• Profile information deleted within 30 days
• Financial verification data deleted within 30 days (subject to legal requirements)
• Messages and communications deleted within 30 days
• Anonymous usage analytics may be retained

6. Your Privacy Rights

6.1 Access and Portability

You have the right to request information about what personal data we have collected about you, including categories of information, sources, and purposes for collection.

6.2 California Consumer Privacy Act (CCPA) Rights

If you are a California resident, you have additional rights under the CCPA:

• Right to Know: Request specific information about how we collect, use, and share your personal information
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of the sale of your personal information (Note: We do not sell personal information)
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights

7. Security Measures

7.1 Technical Safeguards

Data Encryption:

• All data encrypted at rest using AES-256 encryption via Supabase
• All data in transit protected with TLS 1.2 or higher encryption
• Database-level row security to limit data access
• Encryption key management through secure cloud infrastructure

Access Controls:

• Multi-factor authentication required for all critical system access
• Role-based access control with principle of least privilege
• Regular access reviews and immediate deactivation upon termination
• Administrative access logging and monitoring

8. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, business practices, or applicable laws. For significant changes:

• Email notification to active users at least 30 days before changes take effect
• Prominent notice on our website and platform
• Clear explanation of what has changed and why
• Opportunity to review and accept new terms