Privacy notice

0pon, LLC ("0pon", "we") is a District of Columbia company based in Washington, DC. We are the controller for personal data collected through this website. Reach us at mike@0pon.com.

This notice covers personal data collected through this website and its contact form, our client portals, and the ordinary course of our business. It does not govern protected health information (PHI) we process on behalf of healthcare clients. That is governed by the applicable Business Associate Agreement (BAA) and HIPAA, described below. Please do not submit PHI through the public website.

Information you send us. When you use the contact form, we collect the name, email address, message, and inquiry type you provide.

Client and portal users. For engagements, we hold account details (name, work email), billing contact information, and support communications.

Technical information. Like any website, our host records standard server logs, including your IP address. Your IP is not attached to your contact-form submission and is not sent on to anyone else.

We use personal data to read and respond to inquiries, to take steps you request before an engagement, to provide and administer our services and client portals, to process payments for engagements, to communicate about projects and support, to protect our systems from abuse, and to comply with legal obligations.

We do not sell personal information, and we do not use client or end-user data to train AI models.

Where a law such as the GDPR applies, we process personal data on these bases: performance of a contract; our legitimate interests in operating and securing our business; consent, where required; and compliance with legal obligations.

For healthcare clients, 0pon acts as a Business Associate. PHI is processed only under a signed BAA, used solely to perform the contracted services, never sold, and handled under HIPAA's Privacy and Security Rules. The BAA, not this notice, governs PHI, and no PHI is processed unless and until the BAA chain (client, plus our subprocessors) is in place.

This site sets no cookies and runs no analytics, advertising, or third-party tracking. Fonts are served from our own domain, so viewing the site does not send your IP address to a font provider. Because we set no non-essential cookies, no consent banner is required.

This website. We share personal data collected through the site only with service providers that process it on our behalf:

• Vercel: Website hosting and serverless functions. Processes standard request logs, including IP address, for delivery, security, and abuse prevention.
• Resend: Email delivery. Transmits your contact-form submission (name, email, message, inquiry type) to our inbox. We hold no separate copy in a database.
• Cloudflare: Bot protection on the contact form (Turnstile), and hosting for our authenticated internal documentation. Receives your IP address and browser signals to tell a person from a script. It sets no tracking cookie and is not used to profile you across sites.
• Sentry: Server-side error monitoring. Receives diagnostic data on failures, with personal data scrubbed before transmission.

Client engagements and products. Client applications we build and operate run on a separate, contracted set of providers, under BAAs where PHI is involved:

• Supabase: Database and system of record for client applications. SOC 2 Type 2; HIPAA BAA in place before any PHI.
• Anthropic: AI features in client applications, and structuring documents sent to us directly, including resumes. BAA before any PHI; does not train models on our or our clients' data.
• Stripe: Payment processing for client billing. PCI-DSS Level 1.
• Pipedream: Workflow automation for non-PHI data only.

We do not sell or share your personal information, and we do not use it for cross-context behavioral advertising. We may disclose information where required to comply with law or to protect rights, safety, and security.

Consistent with our ephemeral-by-design posture, we retain contact data only as long as needed to handle your inquiry and any resulting relationship, then delete it. For engagements, we keep personal data for the duration of the engagement and as the applicable MSA or BAA requires, then delete or de-identify it. Server logs are kept for a limited period by our host for security and diagnostics.

We protect personal data with encryption in transit and at rest, least-privilege access, audit logging, and managed-secret storage. Our security and compliance overview describes this in detail. No method of transmission or storage is 100% secure.

Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal data, and to object to processing. California residents have rights under the CCPA/CPRA to know, delete, and correct their information and to opt out of sale or sharing; as noted, we do not sell or share personal information. If the GDPR applies to you, you also have the right to complain to your supervisory authority.

For PHI, direct requests to your healthcare provider, the covered entity. We support them as their Business Associate.

To exercise any of these rights, email mike@0pon.com. We will respond within the timeframe the applicable law requires.

Our services are directed at businesses and professionals, not children under 18, and we do not knowingly collect their information.

We are based in the United States. If you contact us from elsewhere, your information will be transferred to and processed in the U.S.

We may update this notice as the site evolves. Material changes will be reflected in the "last updated" date above.