Privacy policy

Method V1 — Method HQ

Version 1.1 · Effective 2026-08-20

The English text is the authoritative and legally binding version. Translations are informational only.

1. WHO IS RESPONSIBLE FOR YOUR DATA

The controller is Method HQ ("Method HQ", "we", "us"), a business established in the Republic of Panama, trading address Calle 80 Este, Panama City, Provincia de Panamá 0801, Republic of Panama.

Role — Contact
General privacy contact — methodhq2@gmail.com
Representative in the EU (Art. 27 GDPR) — Not yet appointed — we have not yet begun offering the Software to customers in this region. This will be designated before our first sale there.
Representative in the UK (Art. 27 UK GDPR) — Not yet appointed — we have not yet begun offering the Software to customers in this region. This will be designated before our first sale there.
Data protection officer / encarregado (Brazil, LGPD Art. 41) — Not appointed. We do not carry out large-scale processing; contact us at methodhq2@gmail.com for any request.

If you are in the EEA or the UK you may contact our representative there instead of us, in your own language, on any matter relating to your data.

2. THE SHORT VERSION

• Your business data — contacts, deals, flows and the records you create in Method — is held on our servers, so that it is there from whichever device you sign in from. It is separated from every other customer's, backed up daily, and deleted if you ask us to.
• Beyond that we hold only what is needed to sell you a licence and let you use it: your name, email, order and licence record.
• Method HQ does not sell or share your personal information, and never has. Shopify carries out its own processing as the platform hosting our storefront; that is described in Part B below.
• Our website sets no advertising or analytics storage of its own and makes no third-party requests.
• The assistant sends what you give it to Anthropic, under your own key and nobody else's. That is explained in §5.

3. WHAT WE COLLECT, WHY, AND ON WHAT LEGAL BASIS

Data — Why — Legal basis (GDPR / UK GDPR) — Kept for
Name, email, billing country — To sell you the licence, deliver access and support you — Art. 6(1)(b) — performance of a contract — Life of the licence, then 24 months after your licence ends
Order record, licence key, delivery and first-access timestamps — To administer your licence, handle refunds, and respond to payment disputes — Art. 6(1)(b); and Art. 6(1)(f) — our legitimate interest in defending payment disputes and preventing fraud — 7 years, as tax law requires
Payment confirmation (not card details) — To confirm payment and issue refunds — Art. 6(1)(b); Art. 6(1)(c) — legal obligation (accounting) — As tax law requires
Support correspondence — To answer you — Art. 6(1)(b); Art. 6(1)(f) — running a support function — 24 months after your licence ends
The contacts, deals, notes and activity you enter in Method — To provide the product — it is what Method stores and shows back to you — Art. 6(1)(b) — performance of a contract — Life of the licence, then deleted; present in backups for up to 90 further days
Marketing email address, if you opt in — To send you product news — Art. 6(1)(a) — consent — Until you unsubscribe

We do not collect special-category data, and we do not knowingly collect data from children under 16. Where we rely on legitimate interests you may object at any time (§8).

4. WHERE YOUR BUSINESS DATA LIVES

The data you create in Method — contacts, deals, flows, notes, activity — is stored in Method's database, hosted by Supabase in the United States. That is what lets your workspace be there from any device you sign in from, rather than only the one you first used.

It is yours. We do not sell it, rent it, or use it to train anything, and we do not look at it except where you ask us to in support, or where we must in order to keep the service running or to comply with the law.

Four things follow, and you should know all of them:

• Each workspace is walled off from every other at the database level, so one customer cannot read another's records.
• We take a full backup daily and keep it for 90 days. If something goes wrong on our side, your work is recoverable — which also means a copy of your data exists in those backups until they age out.
• Because we hold it, it is within reach of a breach of our systems. §10 sets out what we do about that. We would rather say so plainly than claim an immunity we do not have.
• You can ask us to delete it at any time and we will, under §8.

5. THE AI ASSISTANT, AND WHERE YOUR CONTENT GOES

The assistant runs on your own Anthropic API key (BYOK).

When you invoke an assistant feature, the content you submit is transmitted to Anthropic under your key.

Your key is held encrypted. The content you submit to an assistant feature, and the response returned to you, are used only to answer that request: we do not use them to train any model, we do not sell or share them, and we do not use them for any purpose of our own. If you would like the precise technical path a request takes, write to methodhq2@gmail.com and we will tell you.

Anthropic's own processing of that content is governed by Anthropic's terms and privacy policy, not by ours. If you disconnect your key, nothing is sent for AI processing at all — the assistant features simply stop, and the rest of Method keeps working.

6. WHO ELSE TOUCHES YOUR DATA

Recipient — What for — Where
Shopify — Storefront, checkout, order records — Canada and the United States
PayPal — Payment processing — Global
Supabase — The database holding your workspace, and your sign-in account — United States
Vercel — Hosting app.methodhq.store — United States
Resend — Sending your access credentials and transactional email — United States
GitHub — Storing the daily backups described in §4 — United States
Anthropic — AI processing under your key — see §5 — United States

Payment providers act as independent controllers for their own compliance purposes. Our other suppliers act as processors under written terms meeting Art. 28 GDPR.

We disclose data to a public authority only where legally required, and we will tell you unless prohibited from doing so.

Method HQ does not sell personal information, and does not share it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act. Shopify's own processing as our platform, including any advertising features it operates, is described in Part B below and is governed by Shopify's own privacy policy.

7. INTERNATIONAL TRANSFERS

We are established in Panama, which is not the subject of a European Commission adequacy decision.

Where you provide data to us directly from the EEA or the UK, that collection is not itself a restricted transfer under Chapter V of the GDPR. Where we pass your data to a processor outside your region, we do so under the Standard Contractual Clauses approved by the European Commission (and, for the UK, the UK International Data Transfer Addendum), together with a transfer risk assessment and any supplementary measures it identifies.

You may request a copy of the safeguards in place by writing to methodhq2@gmail.com.

8. YOUR RIGHTS

Wherever you are, you may ask us to: access your data; correct it; delete it; restrict or object to our use of it; port it to another provider; and withdraw consent at any time where we rely on it. You will never be treated less favourably for exercising a right.

Write to methodhq2@gmail.com, or to our EU or UK representative. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension. We do not charge for this unless a request is manifestly unfounded or excessive.

EEA / UK. You may complain to your national supervisory authority, or to the UK Information Commissioner's Office (https://ico.org.uk). You are welcome to raise it with us first, but you do not have to.

California. You have the rights to know, delete, correct, and to opt out of sale or sharing — and because we do neither, there is nothing to opt out of. We do not discriminate against you for exercising a right.

Brazil. You have the rights set out in Art. 18 LGPD, including confirmation, access, correction, anonymisation, portability and deletion.

Panama. You have the rights of access, rectification, cancellation, opposition and portability under Ley 81 de 2019 and its implementing regulations.

9. STORAGE ON YOUR DEVICE, AND COOKIES

Our website and the Method interface set no advertising or analytics storage, and make no third-party requests. What we do set is:

Item — Type — Purpose — Lifetime
method:lang — localStorage — Remembers your chosen language — Until you clear it
method:ignited — sessionStorage — Prevents the intro animation replaying in one session — End of session
sb-… session cookies — Cookie — Keeps you signed in to your workspace — Until you sign out or they expire

These are strictly necessary to provide a service you have explicitly requested and are therefore exempt from the consent requirement under Article 5(3) of the ePrivacy Directive. We do not show a cookie banner because we do not need one.

Shopify sets its own cookies on our storefront, including for analytics, under Shopify's own controls. Consent for those is managed through the consent banner Shopify provides to visitors in regions that require it.

10. SECURITY

We apply measures appropriate to the risk, including encryption in transit, access control on the data we hold, and least-privilege administration.

Because your workspace is held on our servers, it is within reach of a breach of them. We do not claim otherwise. What stands between the two is row-level isolation enforced by the database rather than by application code, encryption in transit, keys held encrypted at rest, and administrative access limited to what a task actually requires.

If a breach of the data we hold is likely to result in a risk to you, we will notify the competent supervisory authority within 72 hours where required, and notify you without undue delay where the risk is high.

11. CHANGES TO THIS POLICY

We will post any change here and update the version and date. Where a change materially affects your rights, we will notify you at the email address on your order at least 30 days before it takes effect.

PART B — THE STOREFRONT, AND SHOPIFY'S OWN PROCESSING

Sections 1 to 11 describe Method HQ's processing. This Part describes the processing carried out by Shopify, which hosts our storefront and runs our checkout. It is included because you are entitled to one complete picture, not because we control it.

What Shopify processes. When you browse or buy on methodhq.store, Shopify collects and processes contact details, payment and transaction information, account information, communications with us, device information (including IP address and identifiers) and usage information about how you navigate the store. It does so to operate the storefront, process payments, prevent fraud, and to provide and improve its services.

Shopify's role. For its own operation of the platform, and for any platform-level features it offers merchants, Shopify determines the purposes and means of that processing and is responsible for it, including for responding to requests you make about it. Shopify's own disclosures are at https://www.shopify.com/legal/privacy/app-users, and you can exercise rights against Shopify directly at https://privacy.shopify.com/en.

Advertising and analytics. Shopify sets analytics cookies on the storefront and may operate advertising features. Where the law where you live requires consent for that, it is collected through the consent banner Shopify presents to you, and you may change your choice at any time. Method HQ does not itself run advertising, retargeting or analytics on the storefront, and the Method website's own code makes no third-party requests at all.

Payments. Card and account credentials are handled by Shopify and by the payment providers, including PayPal, as independent controllers. Method HQ never receives them.

International transfers. Shopify processes data outside your country and relies on the European Commission's Standard Contractual Clauses, or the UK equivalent, where required.

If you are unsure which of us to approach about something, write to methodhq2@gmail.com and we will route it or tell you who can answer.

12. CONTACT

Method HQ Calle 80 Este, Panama City, Provincia de Panamá 0801, Republic of Panama methodhq2@gmail.com

EU representative: Not yet appointed — we have not yet begun offering the Software to customers in this region. This will be designated before our first sale there. UK representative: Not yet appointed — we have not yet begun offering the Software to customers in this region. This will be designated before our first sale there.