Legal
Privacy Policy
How we collect, use, secure, and store your data — in plain terms. All data stays on US soil, and we never sell personal data.
Last updated: July 19, 2026
All data is stored and processed in the United States. No data is stored outside the US. We do not sell personal data.
Who we are
Hitt Desk is operated by Extant 2000 LLC, the company behind the Hitt Hosting suite. This policy explains how we handle personal data for the Hitt Desk product. If you have questions about it, contact us at privacy@hitthosting.com.
Information we collect
We collect only what we need to provide and operate the service:
Account & contact details
The name, email address, and organization details you provide when you create an account or contact us.
Billing information
Payments are handled by Stripe. We do not store full card numbers.
Usage & log data
Technical records such as IP address, pages viewed, and timestamps generated as you use the service.
Content you put into the product
The tickets, messages, attachments, and other content you and your customers submit into Hitt Desk.
How we use it
We use the information above to:
- Provide, operate, and maintain the Hitt Desk service.
- Process payments and manage your subscription.
- Secure the service, prevent abuse, and troubleshoot problems.
- Communicate with you about your account and support requests.
- Meet our legal and regulatory obligations.
We do not sell personal data.
Where your data is hosted
All data is stored and processed in the United States. No data is stored outside the US.
- Application, web, and mail servers run on infrastructure we operate in Warrenton, Virginia (OVH US).
- Our primary application database runs on managed PostgreSQL (Supabase) in a US region (AWS US West, Oregon).
How we secure it
We take reasonable technical and organizational measures to protect your data, including:
- TLS/HTTPS encryption for data in transit.
- Application database encrypted at rest.
- PostgreSQL row-level security isolating each organization's data.
- Audit logging of access to and changes of sensitive data.
- Web application firewall (ModSecurity) with intrusion detection (CrowdSec).
- Regular vulnerability scanning.
- Restricted administrative access.
- Stripe (PCI-DSS Level 1) for card payments; full card numbers are never stored.
- Regular backups and production error monitoring.
We do not hold SOC 2, ISO 27001, HIPAA, ITAR, FedRAMP, or PCI certification. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
Service providers
We rely on a small set of trusted providers to run the service. Email is self-hosted and is not handled by a third-party provider.
| Provider | Purpose | Location |
|---|---|---|
| Stripe | Payment processing | United States |
| Supabase | Application database & authentication | United States |
| OVH US | Server hosting | Warrenton, Virginia |
| Cloudflare | DNS | United States |
| Sentry | Production error monitoring | United States |
| Anthropic | AI-assisted features | United States |
Data retention
We keep your data while your account is active and for as long as needed to provide the service and meet our legal obligations. When it is no longer needed, we delete or anonymize it. You can request an export or deletion of your data at any time.
Your rights
You have the right to access, correct, delete, and export your personal data. To exercise any of these rights, contact us at privacy@hitthosting.com.
Your US state privacy rights
If you live in California, Virginia, Colorado, Connecticut, Texas, Oregon, or another US state with a consumer-privacy law, you have the right to know what personal data we hold about you, to request its correction or deletion, and to receive a copy of it.
We do not sell your personal data, and we do not share it for cross-context behavioral advertising. Exercising these rights will not result in worse treatment. To make a request, email privacy@hitthosting.com — we may need to verify your identity first.
Changes
We may update this policy from time to time. When we do, we will revise the "last updated" date at the top of this page. Material changes will be communicated as appropriate.
Contact
Questions about this policy or your data? Email us at privacy@hitthosting.com.
By mail: Extant 2000 LLC, 7051 Brookfield Plz, PO Box 41, Springfield, VA 22150, USA