Privacy Policy

Who we are (the controller)

Houtos Labs ("we," "us," "our") is the data controller for personal data processed through houtoslabs.com and The Grader. We build and operate from Oregon and California in the United States. You can reach us at hello@houtoslabs.com. Where this policy refers to the "GDPR," it includes the EU General Data Protection Regulation and the UK GDPR.

What we collect

We practise data minimization, and today that is easy: this site has no account system, no database, and no application behind it to receive and process what you submit. The pages are files. Here is everything that happens:

• The URL you type into The Grader. The grade is worked out by an engine that runs inside the page, on your own device. The address is not sent to an application of ours (there isn't one), and it is not written to any database. No account is needed, because there is no account. One caveat: on some pages, submitting the form navigates your browser to grader.html?url=…, which puts the address you typed into the page's own web address. That is an ordinary page request, so it can appear in standard hosting access logs the way any page address does. We do not mine those logs, and we would rather flag this than tell you the address never leaves your device.
• Anything you type into a form goes to your own email app. Every form on this site (project enquiries, report reservations, monitoring waitlists) assembles a message and hands it to your device's mail client. You see the text before it goes, you can edit or delete it, and nothing reaches us until you press send yourself. If you do send it, we receive an ordinary email containing whatever you chose to include.
• Preferences kept in your own browser. Two small values live in your browser's localStorage: houtos-theme (light or dark) and houtos-reports (grades you have run, so the page can show them to you again). They stay on your device, they are never transmitted anywhere, and clearing your site data deletes them.
• Your IP address, seen by two font services. Loading any page here makes your browser fetch typefaces from api.fontshare.com and Google Fonts. Those requests come from your browser directly, so those two providers see your IP address and standard request headers. We do not receive that data. Section 4 has the detail.
• Ordinary hosting logs. Whoever serves these files may keep standard web-server access logs as a normal part of delivering a website. We do not run analytics on top of them and we do not use them to build a profile of you.

What is not here. No analytics tool, no advertising pixel, and no tracking cookie (in fact, no cookie of any kind). No session recording, no heatmap, no mouse-movement or keystroke capture, no behavioural profiling, no A/B testing tool, no third-party chat widget, no social embeds. There is no API, no backend and no application server behind this site, so nothing here quietly posts your data anywhere in the background.

We do not knowingly collect data from children, and the Service is intended for business use by adults.

How we use it & our lawful bases

There are only two real processing activities on this site today, so the list is short. Under the GDPR we rely on:

• Answering your email: contract and pre-contract steps (Art. 6(1)(b)). If you email us, we use your address and what you wrote to reply and to take the steps you asked for before any contract. Apart from the ordinary hosting logs described in section 2, that is the only route by which your personal data reaches us at all.
• Serving the pages: legitimate interests (Art. 6(1)(f)). Delivering the site and the typefaces it is set in. This is the basis on which the two font providers see your IP address. The interest is simply rendering a legible page; we have weighed it against your rights and consider it proportionate, and section 8 explains how to opt out of it at the browser level.
• Legal obligation (Art. 6(1)(c)). Where law requires us to keep records (for example tax and accounting records, if you go on to become a client).
• Consent (Art. 6(1)(a)). Not currently relied on, because nothing here needs it: no marketing list, no non-essential cookies, no optional trackers. If that changes we will ask first, through a clear, unbundled, unchecked opt-in you can withdraw at any time.

The browser storage described in section 2 is strictly necessary for a preference you chose, so it does not require consent under the ePrivacy rules, and because it never leaves your device, we are not processing it at all.

We do not sell your personal data and we do not use it to train AI models. To be exact about it: there is no AI model in the loop anywhere on this site. The grade you see is produced by a deterministic engine running in your browser, the "Ask this report" box on the sample report is a non-functional demonstration, and no text from this site is sent to a language model.

Processors we share data with

This list is short, and it is the real one. Exactly two things load from outside houtoslabs.com when you open a page, and both of them are typefaces. Your browser requests those files directly from the provider, which is how webfonts work, and it means the provider sees your IP address whether or not you interact with anything:

• Fontshare (Indian Type Foundry) serves the Satoshi typeface from api.fontshare.com. Receives your IP address and standard request headers (browser version, referring page) on every page load. Purpose: delivering the font files the page is set in.
• Google Fonts serves the IBM Plex Mono typeface from fonts.googleapis.com and fonts.gstatic.com. Same picture: your IP address and standard request headers, on every page load. Purpose: delivering the monospaced font used for labels and figures. Google is a US company; see section 8.

Two more parties are involved only if you choose to write to us. The company that hosts these files serves the pages and may keep ordinary access logs, and the provider behind our hello@houtoslabs.com mailbox holds any email you send. Your own email provider handles the message first, because the message is composed and sent in your mail client, not ours.

That is the complete list of third parties this site involves. There is no payment processor, no analytics provider, no error-monitoring service, no customer-data platform, no advertising network, no data-collection vendor, and no AI provider in the path, not because we removed them but because none of them were ever wired into this site. An earlier version of this page named several of them. That was wrong, and this is the correction. Section 9 sets out what would join the list when paid products launch.

We may also disclose data where required by law, to protect our rights or the safety of others, or in connection with a business transfer (with this policy continuing to apply).

How long we keep it

Mostly, we do not keep it, because there is nowhere to keep it:

• Grades, URLs and site snapshots: nothing to retain. We keep no copy of the addresses you grade or the results, because they are produced and held on your device. The only exception is any address that appears in an ordinary hosting access log, which is kept by the host under its own policy and is not something we collect or use. Anything stored under houtos-reports stays in your browser until you clear it, and you control that, not us.
• Email you send us: kept in our mailbox for as long as the conversation and any resulting work needs, then deleted. Ask us to delete it sooner and we will, unless we are required to keep it.
• Records the law requires: if you become a client, tax and accounting records are kept for the period the relevant law sets, even after a deletion request, with personal data in them kept to a minimum.
• Font-provider and hosting logs: held by those providers under their own retention policies. We have no access to them, so we cannot read them, export them, or delete them on your behalf.

Your rights (GDPR/UK GDPR)

Subject to the conditions in the law, you have the right to:

• Access the personal data we hold about you (Art. 15);
• Rectify inaccurate or incomplete data (Art. 16);
• Erase your data, the "right to be forgotten" (Art. 17), subject to records we must keep by law;
• Export / data portability: receive your data in a portable format (Art. 20);
• Restrict or object to certain processing (Art. 18, Art. 21);
• Withdraw consent at any time where processing is based on consent (Art. 7(3)), without affecting prior processing; and
• Complain to a supervisory authority (Art. 77), your national data-protection regulator, whether or not you come to us first. Section 10 says where.

To exercise any right (including access, export, or deletion), contact us using the details in section 10. We will respond within the timeframe the law requires (generally one month). Exercising your rights is free, and we will not penalize you for it.

A word on expectations: because we hold so little, an access request today will usually return the emails you have sent us and not much else. If we hold nothing about you, we will tell you that plainly rather than pad the answer.

Cookies, browser storage & bot protection

This site sets no cookies. Not one: not for analytics, not for advertising, not for sessions. What it does use is a small amount of storage on your own device: houtos-theme remembers whether you chose light or dark, and houtos-reports keeps the grades you have run so a page can show them to you again. Both live in your browser's localStorage, both are strictly necessary for a preference you asked for, and neither is sent anywhere. Clearing your site data removes them.

The grader page used to show a "Verify you are human" checkbox. We removed it on 5 September 2026. It was drawn by the page itself: it called no bot-check service, set no cookie, and scored nothing about you. That is why it had to go. A control that looks like a security check but performs none is theatre, and this site should not be running any. This policy has now been corrected twice about that control: an earlier version described it as a Cloudflare Turnstile check, which it never was, and now it is gone entirely. Bot protection belongs on the server that runs the scan, where a rate limit can actually be enforced; when that is live it will process IP addresses and request metadata, and this section will say so plainly before it does.

There is no advertising tracker, no behavioural-profiling cookie, and no analytics on this site at all. If we ever add non-essential analytics, we will ask for consent first, say so on this page, and keep it minimal: aggregated metrics, a stated retention period, and no mouse-movement capture.

International transfers & security

Transfers. Houtos Labs operates from the United States, so email you send us is read there. Beyond that, the two font providers may serve or process requests outside the UK and EU: Google is a US company, and Fontshare is run by the Indian Type Foundry. If you are in the UK or EU, that font request is the only transfer of your personal data this site causes, and the only personal data in it is your IP address and standard request headers. Both providers publish their own transfer safeguards (standard contractual clauses or an adequacy decision) in their privacy documentation. You can avoid the transfer entirely by blocking third-party font loading in your browser or with an extension; the site is built with system-font fallbacks and stays perfectly readable without them.

On security: the site is served over HTTPS, so what you read travels encrypted. There is not much else to say, because there is not much to attack: no login, no database, no payment path, no user records. The one place your data actually rests is an ordinary email inbox, which we protect with the usual account controls and access discipline. No system is beyond compromise, and we would rather tell you that than dress it up.

When paid products launch Not live yet

Everything above describes the site as it stands today. This section describes the future. We keep it separate on purpose, so that nothing in it can be mistaken for a description of what is running now. None of the following applies yet.

The paid side of Houtos Labs (the $50 Deep Report and consultation refills) is not wired up here. There is no checkout on this site and no page on it can take a payment. Development work is arranged over email and invoiced directly. When paid products do launch, we will update this policy before the first transaction, and then the following would apply:

• Payments. A hosted checkout would collect your email and card details. We would receive your email and the payment metadata (amount, status, reference) and would never see or store your full card number. The payment provider would be named in section 4 first.
• Your email, used transactionally. To send your receipt and deliver your report, not to add you to a marketing list.
• Marketing, only if you opt in. A single, clearly-labelled, unchecked box, kept separate from the purchase. Never pre-ticked, never bundled into the transaction.
• Report storage and retention. Paid reports and site snapshots would be stored so you could return to them, on a stated retention window; the working intent is roughly 90 days, deletable sooner on request. That means a database, which would be named before it held anything of yours.
• Operational and security data. A real bot check, rate-limiting and error diagnostics would mean processing IP addresses and request metadata to keep the service available.
• AI in the report. A paid report would be drafted with help from a language model. If that happens, the provider will be named on this page before launch, your email would not be placed into a model prompt, and your data would not be used to train anyone's model.
• New sub-processors. Any payment, database, hosting, monitoring or AI provider we take on will appear in section 4 before it starts receiving data, not after.

Until an item above is actually live and listed in section 4, treat it as a plan rather than a description. If you ever find this policy claiming something the site does not do, tell us. That is a defect, and we grade other people on it.

Contact & complaints

For any privacy question, or to exercise any of the rights in section 6, email hello@houtoslabs.com or use our contact page, which, like every form here, opens the message in your own mail client. We will reply within the time the law allows, generally one month. Our registered entity name and postal address are the outstanding items flagged in section 1; ask and we will send them to you.

Complaints to a regulator. If you are in the UK and think we have handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk. If you are in the EU, you can complain to the data-protection authority for your country; the European Data Protection Board lists them at edpb.europa.eu. You do not have to come to us first, though we would rather have the chance to put it right.

See also our Terms of Service and Refund & Credits policy.