Privacy Policy

Effective September 6, 2026 · Last updated September 6, 2026

This Privacy Policy describes how Edha & Co. ("Edha," "we," "us," or "our") collects, uses, discloses, and safeguards personal information in connection with the website located at this domain (the "Site"), our communications, and the services we provide (collectively, the "Services").

By accessing the Site, submitting a form, joining our email list, or engaging us for Services, you acknowledge that you've read and understood this Policy. If you don't agree with it, please don't use the Site or submit information to us.

1. Who we are

Edha & Co. is a business operating from Chicago, Illinois, United States. For the purposes of applicable data protection law, Edha & Co. is the controller of personal information collected through the Site and through our direct communications with you. Where we process information on behalf of a client in the course of delivering the Services, we act as that client's processor or service provider, and the client's own privacy notice governs that information as to the client's end customers.

You can reach us at any time at hello@edhaco.com.

2. Information we collect

2.1 Information you give us directly

• Identifiers. First and last name, email address, telephone number, business name, business address, and job title or role.
• Commercial and business information. Information you provide in an application, intake form, questionnaire, survey, or vote, which may include your monthly revenue range, staffing model, pay structure, average ticket, booking method, review counts, marketing spend, tools in use, capacity, timing, budget set aside, and free-text descriptions of your business situation.
• Correspondence. The contents of emails, text messages, form submissions, comments, and any other communications you send us, together with our replies.
• Engagement information. If you become a client, the information reasonably necessary to deliver the Services, including scope documents, schedules, service menus, pricing, staffing information, and operational records you choose to share with us.

2.2 Information collected automatically

• Device and connection data. IP address, browser type and version, operating system, device type, screen dimensions, language preference, and referring URL.
• Usage data. Pages viewed, time on page, scroll depth, links and buttons clicked, form starts and completions, and the dates and times of your visits.
• Cookie and similar identifiers. See Section 8.

2.3 Information we receive from third parties

• Service providers. Our website platform, form provider, email platform, scheduling tool, and analytics providers each transmit to us the information described above, in the ordinary course of providing their services to us.
• Publicly available sources. We may review publicly available information about a business that applies to work with us, such as a public website, a public business profile, or public reviews, solely to evaluate fit.

2.4 Information we don't intentionally collect

We don't ask for, and request that you don't submit, government identification numbers, payment card numbers, financial account numbers, health information, biometric identifiers, precise geolocation, or any information about a person's race, ethnicity, religion, sexual orientation, political affiliation, union membership, or immigration status. If you submit such information anyway, you do so voluntarily and at your own initiative, and we'll delete it when we identify it.

3. How we collect it

We collect information when you visit the Site, submit a form hosted by us or by our form provider, join our email list, book or attend a call, exchange emails or text messages with us, enter into an engagement with us, or otherwise interact with our Services.

4. How we use it

We use personal information for the following purposes:

• To evaluate an application and determine whether an engagement is a fit, and to respond to you either way.
• To schedule, prepare for, and conduct calls and meetings.
• To deliver, support, and improve the Services, including performing the work described in a signed scope.
• To send transactional and service messages, including confirmations, scheduling notices, deliverables, invoices, and notices about changes to the Services.
• To send marketing communications to people who've asked to receive them, including newsletters, updates, and offers.
• To operate, secure, monitor, and improve the Site, including diagnosing technical problems and analyzing aggregate usage.
• To enforce our terms, protect our rights and the rights of others, prevent fraud and abuse, and pursue available remedies.
• To comply with legal obligations and respond to lawful requests from public authorities.
• For any other purpose disclosed to you at the point of collection or to which you consent.

5. Legal bases for processing

Where the General Data Protection Regulation or the UK GDPR applies to our processing, we rely on the following legal bases: performance of a contract with you or steps taken at your request prior to entering a contract; our legitimate interests in operating, securing, marketing, and improving our business, provided those interests aren't overridden by your rights; your consent, where consent is required, which you may withdraw at any time; and compliance with legal obligations to which we're subject.

6. How we share it

We don't sell personal information, and we don't share personal information for cross-context behavioral advertising, as those terms are defined under applicable United States state privacy laws. We disclose personal information only as described below.

• Service providers and processors. Companies that perform functions on our behalf, including website hosting, form collection, email delivery and marketing, scheduling, file storage, analytics, and payment processing. These providers are permitted to use personal information only to perform services for us and are bound by contractual confidentiality and security obligations.
• Software you engage directly. Where the Services involve setting up tools in your name, those tools are provided, billed, and controlled by their own companies under their own terms and privacy policies. We're not responsible for their practices.
• Professional advisors. Attorneys, accountants, insurers, and auditors, subject to confidentiality obligations.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of all or part of our assets, personal information may be transferred as a business asset. Any acquirer will remain bound by the commitments in this Policy or will provide notice of any material change.
• Legal and safety. Where we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request, or is reasonably necessary to enforce our agreements, investigate suspected violations, or protect the rights, property, or safety of Edha, our clients, or the public.
• With your direction. To any other party at your request or with your consent.

7. Client data and account access

You remain the controller of your own customer data. You're responsible for having a lawful basis to collect and use that data and for providing any notices and obtaining any consents your own customers are owed, including consent required for marketing communications you ask us to configure or send on your behalf.

8. Cookies and tracking

The Site uses cookies and similar technologies, which are small data files stored on your device. We use them for the following categories of purpose:

• Strictly necessary. Required to operate the Site, maintain security, and remember your preferences. These can't be switched off in our systems.
• Analytics and performance. Used to understand how visitors find and use the Site in aggregate so that we can improve it.
• Embedded content. Forms, video players, scheduling widgets, and similar embedded tools may set their own cookies when you interact with them. Those cookies are governed by the third party's policy.

You can set your browser to refuse some or all cookies or to alert you when cookies are set. If you disable cookies, portions of the Site may not function properly. We don't currently respond to browser "Do Not Track" signals, because no common standard for them has been adopted. We do honor Global Privacy Control signals where required by applicable law.

9. Email and SMS communications

Email. We send marketing email only to people who've asked to receive it. Every marketing email contains an unsubscribe link. Unsubscribing stops marketing email but doesn't stop transactional or service messages related to an active engagement.

SMS. We send text messages only where you've provided a mobile number and agreed to receive them, or where texting is a necessary part of an active engagement. Message and data rates may apply. Message frequency varies. Reply STOP to any message to opt out and HELP for assistance. Opting out of texts doesn't opt you out of email. We don't share mobile numbers or SMS consent with third parties for their own marketing.

10. Data retention

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Policy, including for the duration of any engagement and for a reasonable period afterward, and thereafter as necessary to comply with our legal, tax, accounting, and recordkeeping obligations, to resolve disputes, and to enforce our agreements. Applications that don't result in an engagement are generally retained for up to twenty-four months and then deleted or de-identified. Email list data is retained until you unsubscribe or ask us to delete it. Backup copies may persist for a limited period consistent with our providers' backup cycles.

11. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction, including access controls, encryption in transit, use of reputable service providers, and limiting access to personnel who need it. No method of transmission or storage is completely secure, and we can't guarantee absolute security. You're responsible for maintaining the confidentiality of any credentials you share with us or that we create with you, and for notifying us promptly if you believe a credential has been compromised.

12. Your rights and choices

Subject to applicable law and to verification of your identity, you may have the right to:

• Know what categories and specific pieces of personal information we've collected, the sources, the purposes, and the categories of recipients.
• Access or receive a copy of your personal information in a portable format.
• Correct inaccurate personal information.
• Delete personal information, subject to exceptions such as records we must keep by law.
• Opt out of marketing communications.
• Withdraw consent where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
• Object to or request restriction of certain processing, where applicable law provides that right.
• Appeal a denial of a request, where applicable law provides an appeal.
• Not be discriminated against for exercising any of these rights.

To make a request, email hello@edhaco.com with the subject line "Privacy Request." We'll respond within the timeframe required by applicable law, generally within forty-five days, and we'll tell you if we need more time. We may ask for information sufficient to verify your identity and, where a request is made by an authorized agent, evidence of that authority.

13. State-specific disclosures

California. Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, California residents have the rights described in Section 12. In the preceding twelve months, we've collected the categories of personal information described in Section 2, from the sources described in Section 3, for the purposes described in Section 4, and disclosed them for a business purpose to the categories of recipients described in Section 6. We haven't sold personal information or shared it for cross-context behavioral advertising, and we don't have actual knowledge of selling or sharing the personal information of consumers under sixteen years of age. We don't use or disclose sensitive personal information for purposes other than those permitted without a right to limit.

Other states. Residents of states including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others with comprehensive privacy statutes may have comparable rights of access, correction, deletion, portability, and opt-out. We honor those rights on the same terms described in Section 12.

Nevada. We don't sell personal information as defined by Nevada law. Nevada residents may nonetheless submit a request to that effect to the address above.

14. International transfers

We operate in the United States and our service providers are generally located in the United States. If you access the Site or provide information from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those of your jurisdiction. Where required, we implement appropriate safeguards for such transfers.

15. Children's privacy

The Site and Services are intended for business owners and are not directed to individuals under eighteen. We don't knowingly collect personal information from anyone under eighteen. If you believe a minor has provided us information, contact us and we'll delete it.

16. Third-party sites

The Site may link to or embed content from third-party websites and services. We don't control those parties, and this Policy doesn't apply to their practices. Review their policies before providing information to them.

17. Changes to this Policy

We may update this Policy from time to time. When we do, we'll revise the "Last updated" date above. If we make a material change, we'll provide additional notice, such as by email to subscribers or a notice on the Site. Your continued use of the Site or Services after an update constitutes acceptance of the revised Policy.

18. How to contact us

Questions, requests, and complaints about this Policy or our handling of personal information should be directed to:

Edha & Co.
Chicago, Illinois, United States
hello@edhaco.com

This Policy is provided for transparency and doesn't create rights beyond those granted by applicable law. Nothing in this Policy is legal advice. If any provision is held unenforceable, the remaining provisions stay in effect.