Legal

Privacy Policy

Last updated: 1 May 2026

Plain-English summary: we collect what we need to run the platform (your account, your clips, your bookings) — nothing more. We never sell your data and we never share it with third-party marketers. We follow UK GDPR. You can ask for a copy of your data, or ask us to delete it, at any time.

1. Who we are

This privacy policy explains how Hodi.tv (operated by Hodi Ltd, registered in England & Wales, Company No. 13449844, registered office: International House, Churchill Way, Cardiff, Wales, CF10 2HE; referred to below as "Hodi", "we", "us") collects, uses and protects your personal data.

Hodi is the data controller for personal data collected through the hodi.tv website and any associated apps. Our ICO registration number is {ICO registration number}.

For any privacy question, contact us at contact@hodi.tv.

2. What we collect

We process the following categories of personal data about you:

Account data — name, email address, password (hashed by Clerk, our authentication provider), profile photo, surf level / Surf Score answers, home break, country.
Content you upload — surf clips, photos and any captions, comments or reviews you submit. Clips are stored on Cloudflare Stream; photos on Cloudflare R2.
Booking data — events, accelerators or coaching sessions you sign up for; tier purchased; deposit / balance amounts.
Payment data — billing email, transaction history, deposit / balance status. Card numbers are processed entirely by Stripe; we never see them.
Activity data — pages viewed, clips watched and how long, sessions, device + browser info, IP address (for security + approximate geolocation), and acquisition source (UTM tags, referring site) when you arrive via a marketing link.
Communications — emails, in-app messages and support enquiries you send to us.

3. How we collect it

Directly from you when you sign up, complete the Surf Score, upload a clip, RSVP to an event, book a session or contact us.
Automatically when you use the site (analytics events, cookies — see Section 8).
From service providers we use to run the platform, listed in Section 6.

4. Why we use it (lawful basis)

Under UK GDPR every use of your data must have a lawful basis. Ours are:

Performance of a contract with you — running your account, processing payments, fulfilling event bookings, delivering video review.
Consent — when you tick the marketing box at signup we send you news + offers from Hodi. You can withdraw consent at any time via the unsubscribe link in any email or by emailing us.
Legitimate interests — security, fraud prevention, product analytics (in aggregate), improving the service. We balance these against your rights and you can object at any time.
Legal obligation — when we have to keep records (tax, accounting, regulatory).

5. How long we keep it

Account + content — until you delete your account, then up to 30 days in backups.
Booking + payment records — 7 years (UK accounting law requires this).
Analytics events — 24 months at user-level, then anonymised + retained in aggregate.
Marketing consent records — for as long as you remain opted in, plus 2 years after withdrawal (proof of consent).
Support emails — 3 years.

6. Who we share it with

We never sell your data and we never share it with third-party marketers. We do use a small set of processors that are essential to running the platform. They each process your data only on our instructions, under a written data processing agreement.

Clerk — authentication (sign-in, password reset).
Neon — our database host (EU region).
Stripe — payment processing.
Cloudflare Stream + R2 — video and image storage + delivery.
Resend — transactional + marketing email delivery.
PostHog — product analytics. We send pseudonymous event data; PostHog does not advertise on our behalf.
Vercel — site hosting and infrastructure analytics.

We may also disclose data if required by law (e.g. a valid request from law enforcement, HMRC or the courts).

7. International transfers

Some of our processors are based outside the UK / EEA (notably in the United States). When data is transferred internationally we rely on UK International Data Transfer Agreements, the EU Standard Contractual Clauses, or the UK / EU adequacy decisions where they apply. You can ask us for a copy of the safeguards in place.

8. Cookies + similar technologies

We use a small number of cookies / browser storage:

Strictly necessary — Clerk session cookie (keeps you signed in), CSRF protection. No consent required.
Functional — remembering UI preferences, your session id for analytics deduplication, marketing attribution (UTM source / referrer / landing page kept in localStorage).
Analytics — PostHog autocapture cookies / local storage. Used to understand how the product is used in aggregate.

You can clear these from your browser at any time. We respect the Do Not Track header where set.

9. Your rights

Under UK GDPR you have the right to:

Access — get a copy of the personal data we hold about you.
Rectification — correct inaccurate or incomplete data.
Erasure — ask us to delete your account and personal data ("right to be forgotten").
Restriction — limit how we use your data while a query is resolved.
Portability — receive your data in a machine-readable format.
Object — object to processing based on legitimate interests, or to direct marketing.
Withdraw consent — at any time, where we rely on consent.
Not to be subject to solely automated decision-making with significant effects (we don't do this — the AI clip-read is informational, never determinative).

To exercise any of these, email contact@hodi.tv. We'll respond within 30 days. There's no fee unless your request is excessive or repeated.

10. Marketing

When you create a Hodi account you're agreeing to receive marketing emails from Hodi.tv only (new event drops, coach announcements, occasional product updates). We do not share your email or any personal data with third-party marketers.

Every marketing email has a one-click unsubscribe link. You can also opt out at any time by emailing contact@hodi.tv or via your account settings.

11. Security

We use industry-standard technical and organisational measures to protect your data: TLS encryption in transit, encrypted storage at rest, access controls, audit logging, and regular security review. No system is 100% secure, but if we ever experience a breach affecting your personal data we'll notify the ICO within 72 hours where required, and tell you directly if there is a high risk to your rights.

12. Children

Hodi is not directed at children under 13. If you believe a child has provided us with personal data, please contact us and we'll delete it promptly.

13. Complaints

If you have a complaint about how we handle your data, please contact us first at contact@hodi.tv — we'd love a chance to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.

14. Changes to this policy

We'll update this policy from time to time. The "Last updated" date at the top tells you when. If we make material changes that affect how we use your data we'll let you know directly via email or an in-app notice.

15. Contact us

Questions, requests, or feedback? contact@hodi.tv.

Note from Hodi: we've drafted this against UK GDPR + Data Protection Act 2018 best practice, but it is not legal advice. Run it past a solicitor before relying on it. The ICO registration number above will be filled in once Hodi Ltd has registered with the Information Commissioner's Office (required for most data controllers — typical fee £40/year).