Legal
Privacy Policy
How Hitt Books collects, uses, secures, and stores your data. All data is stored and processed in the United States. We do not sell personal data.
Last updated: July 19, 2026
1. Who we are
Hitt Books is a product operated by Extant 2000 LLC, the company behind the Hitt Hosting suite. This policy explains how we handle personal data in connection with the Hitt Books product.
For any privacy question or request, contact us at privacy@hitthosting.com.
2. Information we collect
We collect the following categories of information:
Account & contact details
Your name, email address, organization name, and the details you provide when you create and manage your account.
Billing information
Payments are processed by Stripe. We do not store full card numbers. We keep the billing records needed to manage your subscription.
Usage & log data
Technical records generated as you use the product — such as log data — used to operate, secure, and troubleshoot the service.
Content you put into the product
The financial records, documents, and other content you and your team enter into Hitt Books.
3. How we use it
We use the information we collect to provide and operate Hitt Books, to process payments and manage your subscription, to secure and troubleshoot the service, and to support you when you reach out. We do not sell personal data.
4. Where your data is hosted
All data is stored and processed in the United States. Our application, web, and mail servers are located in Warrenton, Virginia (OVH US). The primary application database runs on managed PostgreSQL (Supabase) in a US region (AWS US West, Oregon). No data is stored outside the United States.
5. How we secure it
We take a defense-in-depth approach to protecting your data:
Encryption in transit
Traffic to and from the application is protected with TLS.
Encryption at rest
The application database is encrypted at rest.
Per-organization isolation
PostgreSQL row-level security enforces isolation between organizations so each org sees only its own data.
Audit logging
Access to and changes of sensitive data are recorded in an audit log.
Network defenses
A web application firewall (ModSecurity) and intrusion detection (CrowdSec) help filter and detect malicious activity.
Vulnerability scanning
We run regular vulnerability scanning against our systems.
Restricted admin access
Administrative access to production systems is restricted.
Payment security
Payments run through Stripe, a PCI-DSS Level 1 service provider. Full card numbers are never stored by us.
Backups & monitoring
We keep regular backups and run production error monitoring.
We do not currently hold SOC 2, ISO 27001, HIPAA, ITAR, FedRAMP, or PCI certification. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
6. Service providers
We rely on a small set of service providers (subprocessors) to run Hitt Books. Email is self-hosted and not handled by a third-party provider. We do not sell personal data.
| Provider | Purpose | Location |
|---|---|---|
| Stripe | Payment processing | United States |
| Supabase | Application database & authentication | United States |
| OVH US | Server hosting | Warrenton, Virginia |
| Cloudflare | DNS | United States |
| Sentry | Production error monitoring | United States |
| Anthropic | AI-assisted features | United States |
7. Data retention
We keep your data while your account is active and for as long as legally required. After that, we delete or anonymize it. You can request an export or deletion of your data at any time.
8. Your rights
You have the right to access, correct, delete, and export your personal data. To exercise any of these rights, contact us at privacy@hitthosting.com.
Access
Request a copy of the personal data we hold about you.
Correct
Ask us to correct inaccurate or incomplete information.
Delete
Request deletion of your personal data.
Export
Request an export of your data.
9. Your US state privacy rights
If you live in California, Virginia, Colorado, Connecticut, Texas, Oregon, or another US state with a consumer-privacy law, you have the right to know what personal data we hold about you, to request its correction or deletion, and to receive a copy of it.
We do not sell your personal data, and we do not share it for cross-context behavioral advertising. Exercising these rights will not result in worse treatment. To make a request, email privacy@hitthosting.com — we may need to verify your identity first.
10. Changes
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page.
11. Contact
If you have any questions about this policy or how we handle your data, email us at privacy@hitthosting.com.
By mail: Extant 2000 LLC, 7051 Brookfield Plz, PO Box 41, Springfield, VA 22150, USA