Privacy Policy

Information you give us

• Account: your name, email address, password and time zone. We never store your password itself, only a salted, one-way hash of it. If you sign in with Google, Google shares your name, email address, profile photo, Google account ID and whether Google has verified your email address. We also record how you can sign in (password, Google or both) and whether you’ve confirmed your email address.
• Consultant profile: photo, headline, bio, years of experience, industries, skills, languages, work history, education, LinkedIn URL, services, prices and availability.
• Bookings: the service, date and time, both time zones, any note you add for the consultant, and the booking’s status (confirmed, cancelled, completed).
• Posts and activity: posts, replies, images you upload, and the consultants you follow.
• Ratings and reviews: the stars and text you give a session, when you wrote or changed them, and any reply the consultant posts. We also note which review emails we sent you.
• Meeting link (consultants): the Google Meet, Zoom or similar link you add. Only clients who have booked you see it.
• Résumé or LinkedIn text (consultants, optional): if you use “Fill from your résumé or LinkedIn”, the PDF or text you give us is read once by an AI model to suggest your profile, then deleted. We keep only what you choose to save on your profile.
• Reports: when you report a post, reply, profile or service, we keep what you reported, the reason, your note and that the report came from you.
• Messages to us: anything you send when you email us.

Information about how our rules are enforced

If we warn an account, remove content, take down a service, or suspend or close an account, we keep a record of what was done, when, by which overhops administrator and why, along with reports about the account and how they were resolved. Removed content is hidden but kept so it can be restored or reviewed.

Payment information

Payments go through Stripe’s secure checkout. Your card number goes straight to Stripe; overhops never sees or stores it. From Stripe we receive the payment’s status, amount, processing fee and reference numbers, and the details of any refund.

Consultants who set up payouts give their identity, tax and bank details directly to Stripe. We only receive the Stripe account’s reference number and whether payouts are active, not the details themselves.

Information collected automatically

• Sign-in sessions: the IP address and browser type used for each signed-in session, to keep your account secure.
• One-time email links: when we email you a link to reset your password, confirm your email address or connect Google, we store only a scrambled (hashed) form of it, so the link itself can’t be read from our database. Each link works once and expires after an hour.
• Abuse prevention: short-lived counters keyed to your IP address or account, which limit how often sign-in, search, booking and posting can be used.
• Searches: the text you search for. We process it to find matching consultants (see “AI-powered search” below) and cache results for about an hour so repeat searches are fast. We don’t keep a search history tied to your account.
• Video sessions: for sessions held in an overhops video room, our video provider tells us when each participant joined and left. We use this only to handle problems such as a missed session or a refund request. Calls are never recorded; we don’t see or store what is said or shown.
• Server logs: our hosting provider, Cloudflare, briefly records technical data about requests (such as IP address, time and page) to run and protect the site.

We only use cookies and storage that overhops needs to work. We don’t use advertising cookies or third-party analytics trackers.

• Sign-in cookies keep you logged in (up to 30 days unless you log out).
• Free-search cookie: visitors who aren’t signed in get one free search per day; a cookie remembers that for a day.
• Theme setting: your light/dark choice is saved in your browser’s local storage.
• Stripe sets its own cookies on its checkout pages to process payments and prevent fraud.

• To create and secure your account and sign you in.
• To show consultant profiles, services and availability, and to match searches with consultants.
• To book sessions, take payments, issue refunds and pay consultants.
• To send you emails about your bookings: confirmations, reminders, cancellations and refunds.
• To send you account and security emails: confirming your email address, password resets, and notices when your password or sign-in methods change.
• To prevent fraud, spam and abuse, to review reports, and to enforce our Terms of Service, including warnings, content removal, suspensions and bans, and the emails that go with them.
• To keep records required for accounting, tax and legal purposes.
• To fix problems and improve overhops.

When you search, an AI model reads your query to understand what you’re looking for (such as a skill, industry, language or time), and ranks public consultant profiles against it. The models run on Cloudflare’s infrastructure as part of our hosting; your searches are not used to train them. Public profile text is also turned into search data so consultants can be found by meaning, not just exact words. If a consultant fills their profile from a résumé or LinkedIn text, an open-source AI model on the same Cloudflare infrastructure reads it once to suggest the profile fields; it isn’t stored or used for training, and nothing is published until the consultant saves.

• Public to everyone, including search engines: consultant profiles, services, prices, availability, posts, replies, follower counts, and the name and photo on any post or reply.
• Reviews: your stars and review text, your first name and last initial (never your full name or email), your profile photo, the month of the session and the service you booked, shown on the consultant’s profile with any reply they post.
• Shared with the consultant you book: your name, the booking details and any note you add. We don’t show your email address to consultants.
• Shared with a client who books you (consultants): your name, the booking details and your public profile.
• Reports: the person or content you report is never told who reported it, unless the law requires it. Only overhops administrators see reports.
• Removed content: if we remove something you posted, other people see only that it was removed by overhops, not the content or our reason.

We don’t sell your personal information, and we don’t share it for targeted advertising. We share it only as follows:

• Service providers that run overhops for us, under contracts that limit how they may use it:
  • Cloudflare: hosting, database, file storage, AI search and security;
  • Stripe: payments, refunds, payouts and identity checks for consultants;
  • Resend: sending booking, account and security emails;
  • Daily.co: the video rooms for sessions held on overhops (the call itself streams through them, but isn’t recorded);
  • Google: only if you choose to sign in with Google.
• Other users, as described in “What other people can see”.
• Legal reasons: when the law requires it, or to protect the rights, safety and property of our users, the public or overhops.
• Business changes: if overhops is merged, acquired or sells its assets, information may transfer to the new owner, who must honor this policy.

• Account and profile information: until you close your account.
• Reviews and replies: until you delete them or you close your account. A review removed by overhops is hidden but kept until the account is closed, so it can be restored or reviewed.
• Posts, replies and images: until you delete them or you close your account. Content removed by overhops is hidden but kept until the account is closed, so it can be restored or reviewed. Unused uploaded images are deleted after a day.
• Bookings and payment records: as long as needed for accounting, tax and legal requirements (typically up to 7 years), even after an account is closed.
• Sign-in sessions: until they expire or you log out (up to 30 days). Resetting or changing your password, or being suspended, ends your other sessions straight away.
• One-time email links: deleted after they are used or expire (one hour).
• Reports, warnings and our record of enforcement actions: kept for as long as needed to keep overhops safe, prevent repeat abuse and handle legal claims, including after an account is closed.
• Abuse-prevention counters: about a day. Payment event records from Stripe: 30 days. Records of emails we sent: 90 days.
• Video-room join and leave times: one year.

You can:

• see and edit your profile and services in your dashboard at any time;
• choose how you sign in (password, Google or both) in your dashboard settings;
• delete your posts and replies, and unfollow consultants;
• change or delete your review of a session for 30 days after it (consultants: edit or delete your replies);
• ask us for a copy of your personal information, or to correct or delete it;
• close your account by emailing us.

To make a request, email contact@overhops.ai from the address on your account. We’ll confirm it’s you and reply within 30 days. We may keep some information where the law requires it (such as payment records) or to resolve disputes. We won’t treat you differently for using your privacy rights.

We send only emails about your own bookings, your account and its security, reports you sent, and actions we take on your account. We don’t send marketing email, so there is nothing to opt out of; if that changes, every marketing email will include an unsubscribe link.

Depending on where you live (for example, California, Colorado, Connecticut, Virginia, Oregon or Texas), you may have the right to know what personal information we collect and how we use it, to get a copy of it, to have it corrected or deleted, and to opt out of its sale, targeted advertising or certain profiling. You can use these rights by emailing contact@overhops.ai, or through an authorized agent with your written permission.

California: in the last 12 months we collected the categories described in “Information we collect” (identifiers, account and profile information, commercial information about bookings and payments, internet activity such as searches, and professional information on consultant profiles), for the purposes in “How we use information”, and disclosed them only to the parties in “Who we share information with”. We have not sold or shared personal information for cross-context behavioral advertising, and we don’t knowingly collect information from anyone under 16.

Nevada: we don’t sell covered information as defined by Nevada law. You may still send a request to contact@overhops.ai.

We protect information with encryption in transit (HTTPS), hashed passwords, secure HTTP-only sign-in cookies, access controls and rate limits. Card and bank details are handled by Stripe, which is certified to the highest payment-industry security level (PCI DSS Level 1). No system is perfectly secure; if a breach affects your information, we’ll notify you as the law requires.

overhops is for people 18 and older. We don’t knowingly collect information from children. If you believe a child has given us personal information, email contact@overhops.ai and we’ll delete it.

overhops is run from the United States. Our providers may process information in the United States and other countries where they operate. By using overhops, you understand your information may be processed outside the country where you live.

We’ll update this policy as overhops changes and change the date at the top. For significant changes, we’ll let you know by email or in the app before they take effect.

Questions or requests about your privacy: email contact@overhops.ai.