Privacy Policy

Last Updated: 6 October 2026

Welcome to Hotshot. We are committed to protecting your privacy and ensuring the security of any personal information you may share with us. This Privacy Policy explains what personal data we collect, why we collect it, how it’s used and shared, and the rights available to you depending on where you live.

1. Information We Collect

• Analytics data: IP address, device type, browser, approximate location, pages viewed, referral source, and on-site behavior, collected via Google Analytics (GA4).
• Security/anti-spam data: behavioral and device signals collected by Google reCAPTCHA when you submit a form.
• Comments: name, email address, comment text, and an optional “remember me” cookie if you comment on a post.
• Newsletter subscription: your email address, if you subscribe to updates.
• Technical/infrastructure data: your IP address is processed by Cloudflare for content delivery, security, and bot mitigation.

We do not intentionally collect sensitive personal data (health, biometric, precise geolocation, racial/ethnic origin, sexual orientation, immigration status, or similar categories) and do not knowingly collect data from children under 13.

2. How We Use Your Information

We use the data above to: operate and secure the Site; understand traffic and content performance; respond to messages submitted through our contact form; prevent spam and abuse; and, where applicable, send newsletter updates you have subscribed to.

3. Cookies

Security cookies: Our spam-prevention tools may set cookies and use device or behavioral signals to help distinguish human visitors from bots.

Your cookie choices: When you first visit the Site, a cookie banner asks you to accept or reject non-essential cookies. Your choice is remembered and can be changed at any time through the banner or your browser settings.

4. How We Share Your Information

We share or make personal data available to service providers and website technologies that help us operate, maintain, secure, and provide functionality on the Site. The data processed depends on how each service or feature is configured.

Do We Sell Your Personal Data?

We do not sell personal data in exchange for money. However, certain disclosures or uses of personal data may be treated as a “sale,” “sharing,” or targeted advertising under some U.S. state privacy laws even when no money is exchanged.

Whether any technology, analytics service, or other data disclosure used on the Site falls within these definitions depends on how the relevant services are configured and used.

We do not knowingly sell personal data to data brokers or disclose personal data to third parties for their own unrelated direct marketing purposes.

5. Data Retention

We retain analytics data, contact form submissions, newsletter subscription data, and comment data, if applicable, for as long as reasonably necessary for the purposes described above, or as required by law, after which it is deleted or anonymized.

6. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal data, including CDN-level security and bot mitigation through Cloudflare. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Children’s Privacy

This Site is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If we learn we have collected such data, we will delete it.

8. Your U.S. Privacy Rights

Roughly twenty U.S. states now have their own comprehensive privacy laws, each with its own applicability threshold based on revenue, traffic volume, or data-sale activity.

We extend the rights below to all U.S. residents as a matter of company policy, regardless of which state’s law technically reaches us. Where a specific state imposes a stricter or additional requirement, we’ve called it out separately below so the baseline doesn’t quietly fall short of the strictest applicable standard.

Rights we provide to all U.S. residents:

• Access — Confirm whether we process your personal data, and access it.
• Correction — Request correction of inaccurate personal data.
• Deletion — Request deletion of personal data we’ve collected.
• Portability — Request a copy of your personal data in a portable format.
• Opt-out — Opt out of the sale or share of your personal data, targeted advertising, and profiling used for decisions with legal or similarly significant effects.
• Non-discrimination — We will not deny service, charge different prices, or provide a different quality of service because you exercised any of these rights.

Sensitive data. We will not process sensitive personal data without your opt-in consent, and — matching Maryland’s stricter standard — we do not sell sensitive personal data under any circumstances, opt-in or not.

How to Exercise Your Rights. Submit a request by emailing [email protected]. We will verify your identity before fulfilling a request. We will respond within 45 days of receipt, with one 45-day extension where reasonably necessary. If we decline your request, you may appeal by writing an email to [email protected], and we will respond to your appeal within 60 days.

9. Additional Rights for California Residents

The California Consumer Privacy Act, as amended by the CPRA (the “CCPA”), gives California residents rights beyond the nationwide baseline above.

Note on applicability: this section is provided regardless of whether we’ve independently confirmed that the CCPA’s statutory thresholds apply to us.

• Right to know the specific categories and sources of personal data we collect, and our purposes for collecting it.
• Right to opt out of the sale or sharing of personal data, including for cross-context behavioral advertising, and out of automated decision-making technology (ADMT) that produces legal or similarly significant effects.
• Right to limit the use of sensitive personal information.

Enforcement context (informational, not a promise on our part): California is the only state on this list with a private right of action allowing consumers to sue directly over certain data breaches, and it has a dedicated regulator — the California Privacy Protection Agency (CPPA) — that has actively pursued businesses over non-functional opt-out mechanisms.

10. Multi-State Privacy Rights

Residents of certain U.S. states may have additional rights regarding their personal data under applicable state consumer privacy laws.

This section applies, where and when the relevant law applies to us, to residents of Alabama, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Louisiana, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, Vermont, and Virginia (collectively, the “Covered States”).

Privacy laws differ by state, and not every right described below is available in every Covered State. The applicability of a particular state law may also depend on factors such as the number of residents whose personal data we process, our annual revenue, the amount of revenue derived from the sale of personal data, the nature of our business, and statutory exemptions.

Inclusion of a state in this section does not mean that its law necessarily applies to Hotshot.

Depending on your state of residence and applicable law, you may have one or more of the following rights:

• Right to Confirm and Access Personal Data. You may have the right to confirm whether we process personal data about you and to access personal data we maintain about you.
• Right to Correction. Where provided by applicable law, you may request that we correct inaccurate personal data, taking into account the nature of the data and the purposes for which it is processed.
• Right to Deletion. You may request deletion of personal data that we have collected from or about you, subject to exceptions permitted by applicable law. Some state laws provide a narrower deletion right covering only personal data that you provided directly to us.
• Right to Data Portability. You may have the right to obtain a copy of certain personal data in a portable and, where technically feasible, readily usable format that allows you to transmit the information to another entity.
• Right to Opt Out of Targeted Advertising. Where provided by applicable law, you may opt out of processing of your personal data for targeted advertising based on activity across nonaffiliated websites, applications, or services. This generally does not include advertising based only on your activity on our own Site or advertising based on the context of the page you are currently viewing.
• Right to Opt Out of Certain Profiling. Where applicable, you may opt out of profiling performed in furtherance of decisions that produce legal or similarly significant effects concerning you, such as certain decisions involving financial services, housing, education, employment, health care, insurance, or access to essential services.
• Rights Concerning Sensitive Personal Data. Certain state laws provide additional protection for information considered sensitive, which may include precise geolocation information, racial or ethnic origin, religious beliefs, health information, sexual orientation, citizenship or immigration status, genetic or biometric information used for identification, or personal data concerning children. Where required, we will obtain consent before processing sensitive personal data or provide the opportunity to opt out of such processing. We do not intentionally collect the sensitive categories described elsewhere in this Policy.
• Right to Information About Data Recipients. In states that provide this right, you may request information about the categories of third parties, or in some cases the specific third parties, to whom we have disclosed personal data.
• Right to Withdraw Consent. Where our processing relies on consent and applicable law provides this right, you may withdraw your consent. Withdrawal will not affect processing that lawfully occurred before your consent was withdrawn.
• Right to Appeal. If we decline to take action on an eligible privacy request, residents of states that provide an appeal right may appeal our decision by emailing [email protected] with the subject line “Privacy Request Appeal.”
• Right to Non-Discrimination. We will not unlawfully discriminate against you because you exercised a privacy right. This means we will not deny services, charge a different price, or provide a materially different level or quality of service solely because you exercised a right protected by applicable privacy law. This does not prevent differences permitted by law, including certain voluntary loyalty, rewards, or incentive programs.
• Authorized Agents and Preference Signals. Where permitted by applicable law, you may authorize another person to submit certain privacy requests on your behalf. Where applicable law requires recognition of a qualifying universal opt-out mechanism or opt-out preference signal, we will process such signals as required by that law.

Privacy requests will be processed without charge to the extent required by law. We may charge a reasonable fee or decline to act on requests that are manifestly unfounded, excessive, repetitive, technically infeasible, or otherwise subject to an exception under applicable law.

Sensitive Personal Data

We do not intentionally collect the sensitive personal data categories described in this Policy. If our practices change and we process sensitive personal data, we will obtain consent or provide another legally required choice before processing it when applicable. We will not sell sensitive personal data where prohibited by applicable law.

Children and Teenagers

We do not knowingly collect personal data from children under 13 as described in the Children’s Privacy section of this Policy. Where an applicable state privacy law provides additional protections for the personal data of children or teenagers, including consent requirements or restrictions concerning sale, targeted advertising, profiling, or sensitive personal data, we will apply those requirements when they apply to our processing.

State-Specific Differences

The rights provided by U.S. state privacy laws are not identical. For example, some laws provide correction rights while others do not; some require recognition of qualifying universal opt-out mechanisms while others do not; definitions of sale and targeted advertising vary; and requirements governing sensitive data, minors, profiling, appeals, and authorized agents differ. We therefore apply the requirements of the law governing your request rather than assuming that every provision described above applies in every state.

11. International Data Transfers

Our servers and service providers (including Google and Cloudflare) may process personal data in the United States and other countries outside your home country.

Where required, we rely on Standard Contractual Clauses (for EEA-originating transfers) and the UK International Data Transfer Agreement (IDTA) as the legal mechanism for transferring personal data internationally.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated “Last Updated” date at the top of this page.

13. Contact Us

Questions about this Policy or requests to exercise the rights described above can be sent to: [email protected].