Privacy Policy

Effective date: October 12, 2026
Last updated: October 12, 2026

1. Who we are and what this policy covers

Hudson House LLC ("Hudson House," "we," "us," "our") is a California limited liability company. We set up Passpoint (Hotspot 2.0) Wi-Fi networks on the existing Wi-Fi equipment of host venues, such as restaurant chains, entertainment venues, campuses and other businesses. Mobile network operators and roaming partners then use those networks to carry ("offload") their subscribers' mobile data traffic over Wi-Fi.

This policy explains what information we collect, why, who we share it with, and the choices and rights you have. It applies to:

Website visitors: people who visit hudsonhouse.io and its pages (the "Site").
Business contacts: venue owners, operators and IT staff, referral and channel partners, and other people who contact us, fill out our forms, or work with us.
Wi-Fi end users: people whose phones or other devices connect to a Passpoint network we have set up at a host venue (the "Services").

This policy does not cover:

your mobile carrier's handling of your information. Your carrier authenticates your device and has its own privacy policy;
the host venue's own networks, such as its guest Wi-Fi, captive portal, or any marketing or presence-analytics tools it runs. Those belong to the venue, not to us; or
third-party websites we link to.

2. The short version

On the Site, we collect what you type into our forms and standard technical information, such as your IP address and the pages you view. We use Google Analytics to understand how the Site is used.
When your device connects to a Passpoint network we set up, your mobile carrier authenticates it directly. We do not receive your name, phone number, account details, SIM credentials, device identifiers (such as MAC addresses), browsing history, or the content of your communications. We receive only aggregate usage data for each venue, such as connection counts and the amount of data carried.
We do not sell personal information. We do not share it for cross-context behavioral advertising.
If you are a California resident, you can ask to know, delete or correct your personal information, and you can opt out of sale or sharing. Email team@hudsonhouse.io.

3. Information we collect from business contacts

When you submit our network audit or onboarding form, email or call us, or work with us as a venue or partner, we may collect:

Contact details: email address (required on our onboarding form); your name, phone number and job title if you give them to us; and the name of your business or organization.
Location details: location name, street address, city, state, ZIP code and site type (for example restaurant, campus or retail).
Network and equipment details: Wi-Fi controller make and model, controller NAS-ID or hardware (MAC) address, access point count, make, model and indoor/outdoor placement, and any internet-connection details you choose to share. These identify your equipment, not the people who use your Wi-Fi. We use them to assess compatibility, configure the service and perform our agreement.
Relationship records: emails, proposals, qualification and audit results, support requests, and signed agreements.
Payment and tax information (venue and channel partners only): information needed to pay you and meet tax rules, such as a Form W-9 and bank or payment instructions. A W-9 can include a Social Security number or other taxpayer ID. We collect this information only after a master services agreement or partner contract has been signed, never at the inquiry stage. We use it only to make payments and for tax and accounting. Section 9 treats a Social Security number or taxpayer ID as sensitive personal information.

Sources. We collect this information from you directly. We also get it from the person or company that referred you, such as a channel partner, and from public business sources.

4. Information we collect from website visitors

What you give us. Anything you enter into a form on the Site, as listed in Section 3. Our forms run on our website platform (WordPress, using the Contact Form 7 plugin). Submissions are sent to us by email. We keep form submissions for 6 months unless they lead to an agreement (see Section 11).

What is collected automatically. When you visit the Site, our hosting provider and our analytics tools may record:

your IP address and the general region it points to;
browser type, device type and operating system;
the pages you view, the page that referred you, and the date and time of your visit.

Cookies and analytics. The Site uses cookies and similar technologies to deliver and cache pages, keep the Site secure, handle forms, and measure how the Site is used. We use Google Analytics, installed through Google Site Kit, to measure Site visits. We use it for analytics only. We do not use Google Ads, remarketing, or ad personalization, and we do not use advertising or social-media pixels. You can block or delete cookies in your browser settings. You can also use Google's opt-out browser add-on for Google Analytics. Some parts of the Site may not work properly without cookies.

Browser privacy signals. We honor Global Privacy Control (GPC). We treat a GPC signal from your browser as a request to opt out of the sale or sharing of personal information linked to that browser. We do not respond to "Do Not Track" signals.

5. Wi-Fi end users: what happens when your device connects

This section is for people whose devices connect to a Passpoint network at a venue we work with.

How it works. If your mobile carrier takes part, your device can join the venue's Passpoint network automatically. Your device then authenticates with your carrier's authentication systems (AAA servers) using the credentials on your SIM. Industry-standard protocols handle this (EAP-SIM, EAP-AKA or EAP-AKA'). Authentication traffic between the venue and the carrier side travels over RadSec (RADIUS over TLS), encrypted with TLS 1.2 or higher. The authentication service is run by our roaming partners and your carrier, not by Hudson House. We do not issue, hold or see subscriber credentials.

What we do not receive or collect:

your name, phone number, email address or carrier account number;
your billing or payment information;
your SIM credentials or the contents of the authentication exchange;
device-level records or device identifiers, such as your device's hardware (MAC) address;
individual connection or session records;
your browsing history, or the content of your messages, calls or files. We do not inspect or log the content of your traffic;
location tracking or movement history of individuals.

What we do receive. We receive only aggregate usage data for each venue. Mobile network operators and roaming partners provide it for settlement and reporting. Examples are the number of connections or sessions, device counts, and the volume of data carried at a venue over a period, broken down by participating network.

Technical records. Your carrier, our roaming partners and the venue's own Wi-Fi equipment may create technical records as part of running the network. These can include device identifiers such as a hardware (MAC) address. Those records stay with the parties that create them. Hudson House never receives or stores device-level or MAC address records. We do not attempt to identify individual users, and we do not use network data for advertising.

Why we use this aggregate data: to confirm the network works, troubleshoot problems, keep the network secure, calculate amounts owed to venues and partners, and report results to venues.

Your carrier's role. Your carrier decides whether your device can use the network. It also handles your subscriber information under its own privacy policy. To turn off automatic Wi-Fi offload, change the Wi-Fi or Passpoint settings on your device, or contact your carrier.

6. How we use information

We use the information described above to:

respond to inquiries and check whether a location qualifies, technically and commercially;
prepare network audits, estimates and proposals;
register locations with mobile network operators and roaming partners and get them approved;
help venue IT teams configure, monitor, troubleshoot and support the Passpoint network;
calculate and pay amounts owed to venues and partners, and provide performance reports;
communicate with you about your inquiry, your agreement and our Services;
send occasional updates about our services where the law allows. You can opt out at any time;
measure and improve the Site;
protect against fraud, abuse and security incidents; and
meet our legal, tax, accounting, audit and insurance obligations.

We do not use personal information for automated decisions that have legal or similarly significant effects on people. We do not use personal information we receive through the Services to train artificial intelligence models.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only as follows:

Mobile network operators and roaming partners. To register, approve and settle each venue, we share venue information with them. This includes the venue name, address and map coordinates, equipment and network identifiers, and access point inventories. It also includes the names and business contact details of the venue's owners, operators, managers and authorized contacts. These partners may create aggregated or de-identified statistics from this information. We do not give them information about Wi-Fi end users.
Host venues. We give each venue reports on its own locations, built from aggregate usage data. These reports do not include personal information about Wi-Fi end users, device identifiers, or individual session records.
Channel and referral partners. If a partner introduced a venue to us, we share the venue-level information and reporting needed to support that relationship.
Service providers. Companies that work on our behalf receive information only so they can provide their services to us. They include: website hosting (Hostinger); email, documents and file storage (Google Workspace); website analytics (Google Analytics); cloud hosting and infrastructure (Amazon Web Services); accounting and bookkeeping (Xero); internal documentation (Notion); and banking and payment providers. We do not use a CRM, email-marketing, e-signature or scheduling vendor.
Professional advisors: our lawyers, accountants, auditors and insurers, who must keep it confidential.
Legal and safety reasons: when the law, a court order or a valid government request requires it, or when we need to protect rights, safety, or the security of our Services.
Business transfers: as part of a merger, acquisition, financing or sale of assets, subject to this policy or notice to you.

8. Your choices

Marketing emails: use the unsubscribe link, or email team@hudsonhouse.io. We may still send messages about an active agreement.
Cookies: use your browser settings or GPC (see Section 4).
Wi-Fi offload: change your device's Wi-Fi or Passpoint settings, or contact your carrier.

9. California privacy rights (CCPA/CPRA)

This section applies to California residents, including business contacts.

Categories of personal information we have collected in the past 12 months:

Category (CCPA)	Examples	Sources	Purposes	Disclosed to	Retention
Identifiers	Name, email, phone, business address, IP address	You; referral partners; your browser	Sections 3-6	Service providers; roaming partners (venue contacts only); advisors	See Section 11
Customer records (Cal. Civ. Code 1798.80)	Signature, payment and tax details (partners only)	You	Payments, tax, legal	Service providers (accounting, banking); advisors	See Section 11
Commercial information	Services you asked about or agreed to; your agreements; venue network and equipment information	You	Providing the Services	Service providers; advisors	See Section 11
Internet or network activity	Site pages viewed, referrer, browser and device information	Your browser; analytics	Site operation, analytics, security	Service providers (hosting, analytics)	See Section 11
Geolocation	Approximate region from IP; venue (business) address. We do not collect precise geolocation of individuals.	Your browser; you	Analytics; registering venues	Service providers; roaming partners (venue address)	See Section 11
Professional information	Job title, employer	You	Communicating with you	Service providers	See Section 11
Sensitive personal information	Social Security or taxpayer ID on a W-9, from individual or sole-proprietor partners, collected only after a signed agreement	You	Tax and payments only	Accounting service provider; tax advisors; tax authorities	See Section 11

We do not collect biometric, health, precise-geolocation, or communications-content information. We do not use sensitive personal information to infer characteristics about you. We use it only for purposes the CCPA allows, so the "right to limit" does not apply.

Network data. We receive only aggregate venue usage data, which is not personal information. We never receive or store device-level or MAC address records (see Section 5).

Your rights. Subject to legal exceptions, you have the right to:

Know and access: what personal information we collect, use and disclose about you, and get a copy of it;
Delete personal information we collected from you;
Correct inaccurate personal information;
Opt out of sale or sharing. We do not sell or share personal information. If that changes, we will add a "Do Not Sell or Share My Personal Information" link and honor GPC signals;
Not be discriminated against for using these rights.

How to submit a request. Email team@hudsonhouse.io with "Privacy Request" in the subject line, or call 323-447-9494. Tell us which right you want to use and how to reach you. We will confirm we received your request within 10 business days. We will respond within 45 days, or tell you if we need up to 45 more days.

Verification. To protect you, we verify requests by matching the information you give us to the information in our records, such as your email address. We ask only for information we need to verify you.

Authorized agents. Someone can submit a request for you with your signed permission. We may still need to verify your identity directly.

Retention. See Section 11.

10. Other U.S. states

Residents of other states with consumer privacy laws may have similar rights, such as the right to access, correct, delete or get a portable copy of their personal information, and the right to appeal if we deny a request. Use the contact details above. To appeal a decision, reply to our response with "Appeal" in the subject line.

11. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, unless the law, a dispute, or an audit requires us to keep it longer. Then we delete it or de-identify it.

Inquiries that do not lead to an agreement: 6 months after our last contact, then deleted.
Contract, venue and partner records: for the length of the relationship, and afterward as long as required by law and for our legitimate business needs.
Payment and tax records (including W-9s): as long as required by law and for our legitimate business needs.
Aggregate venue usage and settlement data: as long as required by law and for our legitimate business needs.
Website form submissions: 6 months, then deleted, unless the inquiry leads to an agreement.
Website analytics data: Google Analytics' default retention (currently 2 months for event-level data).
Server logs kept by our hosting provider: as long as required by law and for our legitimate business needs.

12. How we protect information

We use administrative, technical and physical safeguards that fit our size and the information we handle, including:

Network design: the Passpoint network runs on its own SSID and VLAN, separate from the venue's business and guest networks. It uses client isolation and internet-only firewall rules, which the venue's IT contact confirms at setup.
Encryption: WPA2-Enterprise or WPA3-Enterprise on the Passpoint network, RadSec encrypted with TLS 1.2 or higher for authentication traffic, and HTTPS (TLS 1.2 or higher) on the Site.
Limited access: we do not hold administrator credentials for any venue, and we have no standing remote access to any venue network. Venue IT makes configuration changes using our specifications.
Account security: multi-factor authentication is enforced on our Google Workspace, Xero, Notion and Hostinger (website hosting) accounts. We also use least-privilege access and email authentication (SPF, DKIM and DMARC).
Devices: company laptops use full-disk encryption and endpoint protection.
Vendors: we use established service providers and limit what we share with them.

No system is completely secure. If you think your information has been put at risk, contact us right away at team@hudsonhouse.io. If a security incident affects your personal information, we will notify you as the law requires.

13. Children's privacy

The Site and our Services are meant for businesses. They are not directed to children. We do not knowingly collect personal information from children under 16, and we do not sell or share the personal information of anyone under 16. If you think a child has given us personal information, contact us and we will delete it.

Some host venues, such as schools, family entertainment centers and restaurants, are visited by minors. Carriers handle authentication, and we receive only aggregate venue data. So we do not knowingly collect information about any individual who connects, whatever their age.

14. International users

Hudson House is based in the United States, and our Site and Services are run from the United States. If you contact us or use the Site from outside the U.S., your information will be transferred to, stored in and processed in the United States. U.S. privacy laws may be different from those where you live. Where local law gives you rights over your personal information (for example, in Canada), contact us and we will help.

15. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top. If we make a material change, we will give more notice, such as a notice on the Site or an email to active partners, before the change takes effect.

16. Contact us

Questions, requests or complaints about this policy or our privacy practices:

Hudson House LLC Email: team@hudsonhouse.io Phone: 323-447-9494 Mail: 1128 Dulzura Drive, Montecito, CA 93108

This policy is governed by the laws of the State of California. Any dispute about it will be heard in the state or federal courts located in Santa Barbara County, California, unless applicable law or a separate written agreement with you says otherwise.