Privacy Policy

Last Updated: August 27, 2026

This Privacy Policy explains how Poth Technologies ("we," "us," or "our") collects, uses, and protects your information when you visit pothlabs.com (the "Site").

For the purposes of the General Data Protection Regulation (GDPR), the Data Controller is Matthew Wong, located at 2261 Market Street, San Francisco, CA 94114, US.

1. Information We Collect

We collect data in three ways: information you explicitly give us, technical data necessary for the site to function, and limited analytics data that helps us understand and improve the Site.

A. Information You Provide (Explicit Consent)

When you book a demo or contact us, we collect only the data fields you fill out, which may include:

  • Name
  • Email Address
  • Company Name
  • Role
  • Company Size
  • Intended Use Case
  • Referral Source

B. Job Applicant Information

When you submit an application through our Careers page, we collect the information you choose to provide, which may include:

  • Name and Email Address
  • General Location (City or Region and Country)
  • Area of Professional Interest
  • Résumé or CV, or a Link to It
  • LinkedIn, Portfolio, GitHub, or Personal Website Links
  • Descriptions of Relevant Work and Interest in Poth
  • Availability and Referral Source
  • Whether You Asked Us to Consider You for Future Opportunities

Please do not include Social Security numbers, government identification numbers, financial details, medical information, or other sensitive information that is not needed to evaluate your work. Application-accommodation requests may be sent separately to contact@pothlabs.com; you do not need to disclose medical information in the application form.

C. Technical Data (Legitimate Interest)

When you access our Site, our servers automatically process your IP address and standard server log information (e.g., browser type, operating system).

  • Limitation: This data is processed solely to establish a connection to the website and for security purposes (e.g., preventing DDoS attacks).

D. Analytics and Product Usage Data

We use PostHog to understand how visitors use the Site and to improve our website, messaging, and product experience. Depending on the Site configuration, we may also use Plausible Analytics and Google Analytics 4 for aggregate traffic measurement. These services may process information such as page views, referring pages, device and browser details, approximate location derived from network information, anonymous visitor identifiers stored through cookies or similar browser storage, and interactions such as CTA clicks, demo requests, contact submissions, and demo usage events.

If session replay is enabled, PostHog may record interaction data such as clicks, scrolling, navigation, and page content to help us diagnose usability issues. PostHog masks input fields by default, and we do not intentionally use session replay to collect the contents of contact or demo form fields.

When you submit a contact, waitlist, or account-access form, we may also send the submitted email address and limited submission metadata (such as whether a name or company was provided and the form source) to PostHog so we can associate the submission with the relevant analytics event. This is separate from session replay.

Applicant names, email addresses, résumé contents, profile links, and written application answers are not sent to our marketing analytics providers. Careers analytics are limited to anonymous interaction and success/failure events with a broad area-of-interest value.

2. How We Use Your Information

  • Demo Scheduling: To schedule and conduct the product demonstration you requested.
  • Demo Request Management: To understand your use case and tailor follow-up about your demo.
  • Communication: To answer your specific inquiries.
  • Recruiting: To evaluate an application, communicate with an applicant, manage the hiring process, keep required hiring records, and—only when requested—consider an applicant for other relevant opportunities.
  • Network Security: To maintain the technical operation and security of the Site (processing IP addresses).
  • Site Analytics and Improvement: To understand aggregate website usage, measure which pages and calls to action are effective, and debug usability issues.

3. Legal Basis for Processing (GDPR)

  • Explicit Consent (Art. 6(1)(a)): For all data submitted via forms (such as Name, Email, Company Name, Company Size, Intended Use Case, and Referral Source). We process this only after you submit the relevant form.
  • Legitimate Interests (Art. 6(1)(f)): For the processing of IP addresses and limited analytics data. Our legitimate interests are ensuring the security and technical availability of our website, understanding how the Site performs, and improving the experience for visitors.
  • Steps Prior to a Contract (Art. 6(1)(b)) and Legitimate Interests (Art. 6(1)(f)): For evaluating and administering applications for a current opportunity. Our legitimate interest is operating a fair, secure, and effective recruiting process.
  • Consent (Art. 6(1)(a)): When an applicant separately asks us to retain an application for future opportunities. This consent can be withdrawn at any time.

4. International Data Transfers

Poth Technologies is based in the United States.

  • Transfer Mechanism: By submitting your personal data, you acknowledge that it will be processed in the United States. For demo and recruiting requests, we rely on applicable contractual, pre-contractual, consent, or other lawful transfer mechanisms for the processing involved.

5. Data Retention: How Long We Keep Your Information

We only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, and whether we can achieve our purposes through other means.

Our specific retention windows include:

  • Waitlist and Marketing Data: If you sign up for our waitlist or request a demo, we retain your contact information until you withdraw your consent or ask us to delete your data. If we notice you are completely inactive (e.g., not opening emails or responding to outreach) for a period of 12 months, we will safely delete or anonymize your data.
  • Job Applicant Data: We generally retain an application and related hiring records for 12 months after submission or the relevant hiring decision, unless a longer period is required by law, needed to resolve a dispute, or subject to a legal hold. If you ask us to consider you for future opportunities, we may retain the application for up to 12 months and then delete it unless you renew that request. Résumés are stored in private file storage and are deleted with the corresponding application record under the applicable schedule.
  • Account and Services Data: If you create an account or use our services, we retain personal data for as long as needed to provide and secure the service, meet legal and accounting obligations, resolve disputes, and enforce our agreements. Deletion timing can depend on the applicable customer agreement, legal holds, and backup cycles. Contact us for the retention schedule that applies to your account.
  • Analytics and Technical Logs: Server logs and website interaction data processed through our hosting and configured analytics providers are retained according to our provider settings and only for as long as needed for analytics, security, and troubleshooting, unless a security incident requires a longer investigation.

If you request that we erase your data, we will process the request promptly, subject to legal obligations that require us to maintain certain records (including applicable employment, financial, tax, dispute, or legal-hold requirements).

6. Sharing Your Data

We use service providers for scheduling, analytics, payments, hosting, and data storage. Depending on the features you use and the Site configuration, these providers may include:

  • Calendly (Scheduling)
  • PostHog (Analytics and Session Replay)
  • Plausible Analytics (Aggregate Site Analytics, when configured)
  • Google Analytics 4 (Site Analytics, when configured)
  • Stripe (Payment Processing)
  • Supabase (Website Forms and Database Services, when configured)
  • Resend (Limited Administrative Email Notifications, when configured)
  • Netlify (Hosting and Infrastructure)

Our product may use additional subprocessors under an applicable customer agreement. Contact us for the current list relevant to your use of the service.

7. Your Data Protection Rights

Under the GDPR, you have the following specific rights regarding your data:

  1. Right to Access: You have the right to request copies of your personal data.
  2. Right to Rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
  3. Right to Erasure ("Right to be Forgotten"): You have the right to request that we erase your personal data under certain conditions.
  4. Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data under certain conditions.
  5. Right to Object to Processing: You have the right to object to our processing of your personal data (specifically regarding data processed under "Legitimate Interests").
  6. Right to Data Portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, in a structured, machine-readable format.
  7. Right to Withdraw Consent: Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time.
  8. Rights regarding Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling. (Note: We do not currently use automated decision-making or profiling).

To exercise any of these rights, please contact us at contact@pothlabs.com.

8. Right to Lodge a Complaint

If you believe we have not adequately addressed your rights, you have the right to lodge a complaint with a Data Protection Authority (DPA) in your country of residence within the EEA.

9. Contact Us

  • Email: contact@pothlabs.com
  • Address: 2261 Market Street, San Francisco, CA 94114, US