The short version is below. If you want the longer version with the section headers and the lawyer-grade specificity, scroll. Either way, the same thing is true: we don't sell your data, and we don't try to be clever about collecting it.
“42degrees” means the software studio operating at 42degrees.tech, based in Austin, Texas, USA. The legal entity name and full mailing address are available on request — email us if you need them for a vendor questionnaire.
Only what you hand us:
What we don't collect: your precise location, your browsing history outside this site, any fingerprinting data, anything from anyone under 13, and any data tied to advertising IDs. We don't buy data lists. We don't enrich what you give us with third-party data.
For exactly four things:
We do not use your data to train any AI model. We do not pipe it into a marketing automation funnel. We do not sell, lend, trade, or barter it. Period.
Contact submissions live in our email and CRM. Server logs are kept per Vercel's standard retention. We don't hoard.
If you ask us to delete what we have on you, we delete it within 30 days unless we're legally required to keep it (e.g., signed contracts and invoices have to live for tax purposes).
Security: we use TLS for everything in transit, sensible password hygiene, hardware-key MFA for any account that touches client data, and we keep a written incident-response plan. We've had zero reportable incidents to date.
We work with healthcare organizations, but no Protected Health Information (PHI) ever lives on this marketing site. The contact form is for sales conversations only — please don't paste patient data into it.
When we engage with a healthcare client and the work involves PHI, we sign a Business Associate Agreement (BAA) before any PHI touches our systems. PHI is then handled inside isolated, audit-logged environments specifically provisioned for that engagement — separate from the systems that run this website.
We're aligned with HIPAA, hold a SOC 2 Type II posture, map controls to HITRUST CSF, and follow ISO 27001 practices. Compliance details are here.
No matter where you live, you can:
If you're in the EU, UK, or California, you have additional statutory rights under GDPR, UK GDPR, and the CCPA / CPRA. We honor all of them. We don't sell or share personal information for cross-context behavioral advertising as those terms are defined in the CCPA.
Our servers are in the United States. If you're writing to us from outside the US, your data is transferred to and processed in the US. We use the standard contractual clauses where they apply.
We update the date at the top of this page when we change it. For material changes, we'll add a notice on the homepage for 30 days. We don't silently rewrite policies and pretend nothing happened.
For data-rights requests, please put “Privacy Request” in the subject line so we route it correctly.
No discovery deck. No 47-page proposal. Tell us what you're building and we'll come back within 48 hours with a real technical read.
