Privacy Policy

Effective Date: April 28, 2026
Last Updated: April 28, 2026

1. Introduction

HYDR8 (“HYDR8,” “we,” “us,” or “our”) respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy describes how we collect, use, disclose, and protect personal information in connection with:

Our public-facing website at https://www.hydr8.us and its public-facing subdomains: shop.hydr8.us, water.hydr8.us, and sustainability.hydr8.us.
Our products and services, including bottleless water filtration equipment, coffee program equipment, e-commerce products, water quality and sustainability reporting tools, and related services (collectively, the “Services”).
Our marketing communications and business operations.

This Privacy Policy applies to personal information about prospective customers, current customers, website visitors, event attendees, job applicants, and others who interact with HYDR8 through the public-facing Services listed above.

This Privacy Policy does not govern HYDR8 internal subdomains that are access-restricted to HYDR8 personnel, nor does it govern single-tenant customer portals operated under separate commercial arrangements.

HYDR8 is headquartered at 329 38th Street, 2nd Floor, Brooklyn, NY 11232.

2. Information We Collect

We collect the following categories of information:

(a) Information You Provide Directly

Identity and contact data: name, business title, company name, business email address, phone number, mailing address, billing address.
Commercial data: products or services requested, order history, payment information (processed by our payment processors; we do not store full card numbers), lease and subscription preferences.
Support and service requests: communications you send to us, service ticket details, equipment serial numbers, installation locations.
Water quality information: zip code and email provided to our water quality reporting tool at water.hydr8.us.
Marketing preferences: email subscription preferences, content interests.
Employment data: if you apply for a job with us, resume, employment history, references, and related information.

(b) Information Collected Automatically

Device and usage data: IP address, browser type and version, operating system, device identifiers, referring URL, pages viewed, time spent on pages, click events, date and time of visits.
Location data: approximate location derived from IP address. We do not collect precise geolocation data.
Cookies and similar technologies: See Section 7 below.

(c) Information from Third Parties

Business partners: when an account executive, channel partner, or referral source shares your contact information with us in connection with a potential business relationship.
Lead aggregation services: we receive prospect contact information from services such as 360Connect.
Publicly available sources: business directories, LinkedIn profiles, and publicly available business information for B2B prospecting.
CRM migration: historical customer records transferred from our prior CRM (WaterDesk) to our current CRM (HubSpot).

(d) Inferences

We may derive inferences from the above data to understand your preferences and match you with relevant services (for example, inferring that a facility manager is interested in filtered water based on engagement with our content).

3. How We Use Your Information

We use personal information for the following purposes and with the following lawful bases where GDPR applies:

Purpose	Lawful Basis (GDPR, if applicable)
Providing and delivering the Services	Contract performance (Art. 6(1)(b))
Processing orders, subscriptions, and payments	Contract performance (Art. 6(1)(b))
Customer support and service	Contract performance; legitimate interest (Art. 6(1)(b), (f))
Marketing and promotional communications	Consent; legitimate interest (Art. 6(1)(a), (f))
Website analytics and performance improvement	Legitimate interest (Art. 6(1)(f))
Lead qualification and sales outreach	Legitimate interest (Art. 6(1)(f))
Legal compliance, fraud prevention, dispute resolution	Legal obligation; legitimate interest (Art. 6(1)(c), (f))
Recruiting and employment evaluation	Consent; pre-contractual steps (Art. 6(1)(a), (b))

4. Third-Party Service Providers (Subprocessors)

We share personal information with trusted third-party service providers who process data on our behalf. Each operates under contractual obligations restricting their use of your information to the services they provide to us. Categories include:

(a) Customer Relationship Management

HubSpot, Inc.: CRM, marketing automation, contact forms, lead management, sales pipeline, email marketing (migration in progress).
WaterDesk: legacy CRM used for existing customer records and service operations during transition to HubSpot.

(b) Email Marketing and Communications

Klaviyo, Inc.: email marketing platform (being phased out in favor of HubSpot).
Google LLC: Google Workspace (Gmail, Calendar, Drive, Workspace administration) for business communications.

(c) Analytics and Advertising

Google LLC: Google Analytics, Google Ads, Google Tag Manager for website analytics, advertising, and conversion tracking.
DataForSEO: SEO analytics and competitive keyword monitoring (no personal information processed).

(d) Hosting and Infrastructure

Vercel Inc.: website and application hosting.
Cloudflare, Inc.: DNS management and edge network services.
WordPress.com / Automattic: blog content management.
Google Cloud Platform: backend services, cloud functions, and Firestore data storage.

(e) E-Commerce

Shopify Inc.: e-commerce platform at shop.hydr8.us.
Payment processors engaged by Shopify: credit card processing. HYDR8 does not directly store full payment card numbers.

(f) Workflow, Project Management, and Internal Operations

Airtable, Inc.: project tracking, product catalog, content calendar.
Slack Technologies: internal team communication, including inbound lead routing.
N8N (hydr8us.app.n8n.cloud): workflow automation.
Google Drive / Google Sheets: document and data storage.

(g) Communication Services

Zoom Video Communications: webinars and video meetings (registrant information from Zoom flows into our email marketing systems).

(h) AI Processing

Anthropic, PBC: Claude AI models used for internal content processing, lead classification, and marketing analytics. Personal information processed through Anthropic is processed transiently and is not retained for model training under Anthropic’s enterprise terms.

(i) Legal, Tax, and Professional Advisors

Accountants, auditors, attorneys, and other professional advisors when needed for legal or business purposes.

(j) Law Enforcement and Regulatory Authorities

As required to comply with applicable laws, regulations, legal process, or governmental requests.

We do not sell personal information to third parties. We may “share” personal information with advertising partners for cross-context behavioral advertising as defined under CPRA; California residents have the right to opt out of such sharing (see Section 10).

5. Disclosures in Business Transactions

If HYDR8 is involved in a merger, acquisition, sale of assets, financing, or similar transaction, personal information may be transferred as part of that transaction. We will notify you of any such change in ownership or transfer by email or a prominent notice on our website.

6. How We Protect Your Information

We implement reasonable administrative, technical, and physical security measures designed to protect personal information from unauthorized access, use, alteration, or disclosure. These measures include:

Encryption of data in transit (TLS/HTTPS) and at rest where applicable.
Access controls limiting employee and contractor access to personal information.
Credential management using runtime-injected secrets and Google Cloud Secret Manager.
Annual review of security practices and third-party subprocessor agreements.

Despite these measures, no method of transmission or storage is completely secure. We cannot guarantee absolute security of your information.

7. Cookies and Tracking Technologies

We use cookies, web beacons, pixel tags, and similar technologies to:

Recognize your browser or device when you return to our website.
Remember your preferences and settings.
Understand how you use our website and measure its performance.
Deliver and measure advertising.

Cookie Categories

Strictly necessary cookies: required for website functionality (authentication, session management). Cannot be disabled.
Analytics cookies: Google Analytics and similar, used to understand usage patterns.
Advertising cookies: Google Ads and similar, used to deliver and measure advertising.
Functionality cookies: remember preferences and improve user experience.

You can control cookies through your browser settings. Disabling cookies may affect your ability to use parts of our website. Additional cookie controls for advertising are available at the Digital Advertising Alliance (aboutads.info/choices) and Network Advertising Initiative (networkadvertising.org/choices).

Do Not Track

Some browsers transmit “Do Not Track” signals. At this time, our website does not respond to “Do Not Track” signals, as no common standard for interpreting them has been established. California residents may exercise opt-out rights under Section 10 below.

8. Data Retention

We retain personal information only as long as necessary for the purposes described in this Privacy Policy or as required by law:

Data Category	Retention Period
Customer account and transaction records	Duration of business relationship plus 7 years (tax and accounting purposes)
Sales leads not converted to customers	Up to 3 years from last engagement
Marketing subscriber data	Until you unsubscribe, plus up to 6 months for suppression list purposes
Website analytics data	26 months (Google Analytics default)
Service tickets and support communications	7 years
Job applicant data	1 year from application, unless you consent to longer retention
Anonymized and aggregated data	Indefinitely

When retention periods expire, we delete or anonymize the information.

9. International Data Transfers

HYDR8 operates in the United States. If you are located outside the United States (including in the European Economic Area, United Kingdom, or Switzerland), your personal information will be transferred to and processed in the United States.

Where such transfers involve EEA, UK, or Swiss personal data, we rely on appropriate safeguards including:

Standard Contractual Clauses (SCCs) adopted by the European Commission.
Any other transfer mechanism permitted under applicable law.

For inquiries about our international data transfer practices, contact info@hydr8.us.

10. Your Privacy Rights

(a) California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

Know: request information about the personal information we have collected about you in the past 12 months.
Delete: request deletion of your personal information, subject to certain exceptions.
Correct: request correction of inaccurate personal information.
Opt-out of sale or sharing: direct us not to sell or share your personal information for cross-context behavioral advertising.
Limit use of sensitive personal information: direct us to limit the use of sensitive personal information to specified permitted purposes.
Non-discrimination: we will not discriminate against you for exercising your rights.

We do not sell personal information. To the extent we “share” personal information for cross-context behavioral advertising (for example, audience matching through Google advertising products), you may opt out by contacting info@hydr8.us or by setting a Global Privacy Control signal in a supporting browser.

To exercise your rights, email info@hydr8.us or mail a request to the address in Section 13. We will verify your identity before responding.

(b) EEA, UK, and Swiss Residents (GDPR / UK-GDPR / Swiss DPA)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the right to:

Access: obtain confirmation of whether we process your personal information and a copy of that information.
Rectification: request correction of inaccurate information.
Erasure: request deletion of your personal information in specified circumstances.
Restriction: request restriction of processing in specified circumstances.
Data portability: receive your personal information in a structured, machine-readable format.
Object: object to processing based on legitimate interests or for direct marketing.
Withdraw consent: where we rely on consent, withdraw it at any time.
Lodge a complaint: with your local data protection authority.

To exercise these rights, email info@hydr8.us.

(c) All Other Residents

Even if you are not in California, the EEA, the UK, or Switzerland, you may contact us at info@hydr8.us to request access to or deletion of your personal information. We will respond to reasonable requests consistent with applicable law.

11. Children’s Privacy

Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected personal information from a child under 13, we will delete that information promptly. If you believe a child has provided us with personal information, contact info@hydr8.us.

12. Data Breach Notification

In the event of a personal data breach affecting you, we will notify you and applicable regulatory authorities as required by applicable law (including CCPA, state breach notification laws, and GDPR Articles 33 and 34).

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically. When we do, we will post the updated policy on this page and update the “Last Updated” date at the top. For material changes, we will provide additional notice (such as email notification or a prominent notice on the website).

14. Contact Us

For questions or concerns about this Privacy Policy or our privacy practices, or to exercise any of the rights described above, contact us:

HYDR8
Attn: Privacy
329 38th Street, 2nd Floor
Brooklyn, NY 11232
Email: info@hydr8.us
Phone: 718-313-0113