Privacy Policy

HOLDOUT (holdoutos.com) is a product of Leda Agency Oy, a limited company registered in Finland (Business ID 3348510-4), with its registered office in Helsinki, Finland. Leda Agency Oy is the data controller for the personal data described in this policy.

Contact, for anything in this policy: management@ledaagency.com.

This site is a pre-launch page for HOLDOUT. It does one thing: it lets you join the founding list. This policy covers the data processed to make that work — nothing here describes the HOLDOUT product itself, which is not yet launched and will carry its own terms and privacy documentation.

Founding-list signup. Your email address, an optional monthly-sessions range you may choose to share, and the time and page of your signup. That is the complete record.

Anti-abuse. When you submit the form, our server briefly processes your IP address to rate-limit submissions and filter automated spam. It is not stored with your signup record and is retained in security logs for at most 30 days.

Analytics. We use Plausible, a cookieless, EU-based analytics service, to count page views and aggregate interactions. It sets no cookies, stores no persistent identifiers, and builds no individual profiles. We cannot identify you from it.

Google Analytics — only as permitted. When Google Analytics is permitted on your visit, it counts pages and aggregate interactions using cookies (named in section 07). In the EEA, the UK, and Switzerland it stays off unless you choose Allow on the analytics card; elsewhere it runs after clear notice, and you can turn it off at any time via “Analytics choices” in the footer of every page. We disable Google signals and ads personalization: it is a visit counter, not an advertising instrument.

What we do not do: no advertising trackers, no cross-site tracking, no sale of data, no profiling, no automated decision-making. The only cookies on this site are Google Analytics’, and they exist only under the consent and opt-out controls above — decline, and this site sets no cookies at all.

The form says: one email when your cohort opens · nothing else, ever. That is the scope of your consent, and this policy does not enlarge it. If we ever want to send you anything beyond founding-list and launch communications, we will ask you first, separately. You can withdraw at any time — every email we send contains an unsubscribe link, and a message to management@ledaagency.com does the same thing.

We use four service providers, under data-processing agreements:

Where data is transferred outside the EEA (Vercel, Resend, Google), transfers rely on the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses. We do not sell or share your personal data with anyone else, and no one buys it.

Plausible sets no cookies. Google Analytics — only when permitted per section 03 — sets these:

Withdraw at any time: “Analytics choices” in the footer of every page. Withdrawal stops collection immediately and clears these cookies on our domain. Your choice is stored on your device, not on our servers. None of this touches the founding-list promise in section 05.

Founding-list records: until the launch-notification purpose is complete or you withdraw, whichever comes first — and at most 24 months after collection unless you become a HOLDOUT customer, at which point the product’s own documentation takes over. Security logs: at most 30 days. When you withdraw, we delete the record from our own systems and instruct our email provider to erase it; we action this within 30 days of the request. Provider-side backup rotation is outside our control, and we do not promise a deadline we cannot enforce.

You have the right to access, rectify, and erase your personal data; to restrict or object to processing; to data portability; and to withdraw consent at any time without affecting prior processing. Write to management@ledaagency.com and we will respond within one month.

You also have the right to lodge a complaint with a supervisory authority — in Finland, the Office of the Data Protection Ombudsman (tietosuoja.fi), or the authority in your own EU member state.

Depending on your state, you may have rights to know what personal information we hold, to access or correct it, to delete it, and to opt out of its sale or sharing. Our position is simpler than the statutes: we collect an email address and an optional range, we do not sell or share personal information as those terms are defined in the California Consumer Privacy Act or any similar state law, and we honor access, correction, and deletion requests from anyone, in any state, without discrimination. Email management@ledaagency.com.

This site is a business service for e-commerce operators. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. That is a data-protection floor and it is not the same limit as the 18 in the Terms, which is the age at which someone can enter into the agreement: the lower number governs what we may process, the higher one governs who may contract. If you believe a minor has joined the list, tell us and we will delete the record.

The site is served over TLS. Signup records are stored with our providers under encryption at rest. We collect the minimum the purpose needs — the shortest path to security is having little to protect.

If this policy changes, the new version appears here with a new effective date. If a change would affect how we use founding-list data, we will not apply it to you without asking first — consistent with section 05.

Leda Agency Oy · Business ID 3348510-4 · Helsinki, Finland

management@ledaagency.com