Privacy policy

This policy explains how HFG Holdings LLC, doing business as HiON Franchise Group (“HiON”, “we”, “us”), collects, uses, stores, and shares information in HiON OS, the operations platform at app.hionev.com. It covers the franchisees, host partners, and HiON staff who sign in to the platform.

HiON OS is a business tool, not a consumer service. Almost everything in it is entered by a business on its own behalf. We do not sell personal information, and we do not use it for advertising.

Information we collect

Account and identity. When you are invited to HiON OS and sign in, we store your email address and an authentication record. If you sign in with Google we also receive your name and profile picture. If you sign in with a password, we store only a cryptographic hash of it, never the password itself.

Business and operational data. Information you or your organization enter into the platform — site and station records, project and construction status, financial and performance figures, documents, notes, and support requests. This data belongs to your organization.

Performance measurement. We collect anonymous page-performance metrics (load and responsiveness timings) from browsers using the platform, through Vercel Speed Insights and our own metrics endpoint. These records contain a normalized route template, a metric name, and a number. They do not contain your IP address, your browser user-agent, or any content from the page.

Marketing attribution. On our public marketing pages only, a first-touch cookie named hion_attr records how you first arrived — campaign parameters in the link you followed, the external site that referred you, and the page you landed on. It is set once, never overwritten, and expires after 90 days. It holds no name, email, or other identifier.

Server logs. Our hosting and database providers keep standard operational logs, which can include IP addresses and request metadata, for security and troubleshooting.

How we use information

• To authenticate you and enforce which organization’s data you may see.
• To operate, support, and troubleshoot the platform.
• To send transactional messages such as sign-in links, password resets, and account notices.
• To measure and improve reliability and page performance.
• To understand which marketing channels bring qualified franchise inquiries.
• To meet legal, franchise-disclosure, and record-keeping obligations.

We do not sell personal information, share it with data brokers, use it to build advertising profiles, or use it to train machine-learning models.

Google user data

If you choose “Continue with Google”, we request only the basic sign-in scopes: your email address, basic profile information (name and profile picture), and the OpenID identifier. We request no access to Gmail, Drive, Calendar, Contacts, or any other Google service.

We use that data for one purpose: to identify your account and sign you in. We store your email, name, and profile-picture URL alongside your HiON OS account. We do not transfer Google user data to third parties except the infrastructure providers listed below that operate the platform on our behalf, and we never use it for advertising. HiON OS’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect HiON OS at any time from your Google account permissions page.

How your data is separated

HiON OS is multi-tenant. Every record is scoped to an organization, and access is enforced in the database itself through row-level security, not only in the application. Signing in does not by itself grant access to any organization’s data — access requires a membership granted by an administrator. A signed-in account with no membership can see nothing.

Service providers we share with

• Supabase — database, authentication, and file storage. Data is hosted in the United States (US West).
• Vercel — application hosting, content delivery, and performance measurement.
• Google — only if you choose Google sign-in, and only to verify your identity.

These providers process data on our instructions to run the platform. We may also disclose information when required by law, to enforce our agreements, or to protect the rights and safety of HiON, our franchisees, or the public.

Retention

We keep account and business records for as long as your organization uses HiON OS, and afterwards for as long as needed to meet legal, tax, franchise-disclosure, and dispute-resolution obligations. Performance metrics are anonymous and kept in aggregate. The attribution cookie expires after 90 days.

Security

Traffic is encrypted in transit. Data is encrypted at rest by our providers. Access is limited to the people who need it to operate the platform, database access is governed by row-level security, and sensitive credentials are held in managed secret storage. No system is perfectly secure, and we cannot guarantee absolute security.

Your choices and rights

You can review and update your account details in the platform, and ask us to correct or delete information about you. Because much of what HiON OS holds is your organization’s business record — and some of it we are required to retain — a deletion request may be limited by those obligations. Depending on where you live, you may have additional rights to access, correct, delete, or port your information, and to appeal a refusal. Contact us at privacy@hionev.com and we will respond.

We do not respond to browser Do Not Track signals. The only cookies we set are the ones needed to keep you signed in and the marketing attribution cookie described above.

Children

HiON OS is a business platform and is not directed to anyone under 18. We do not knowingly collect information from children.

Changes

If we make a material change to this policy we will update the date at the top of this page and, for changes that meaningfully affect you, notify account holders directly.

Contact

HFG Holdings LLC, d/b/a HiON Franchise Group
11101 Johnson Drive, Shawnee, Kansas 66203
privacy@hionev.com