Requests for assistance
When you send a project or community request, we collect your name, email, organization or project name, country if provided, the work requested and an existing website address if relevant. A community request also includes nonprofit status, the organization’s mission and whether it needs a new website or a revamp. We use this information to review the request, contact you and discuss the work. Please do not include sensitive personal information, passwords or payment details.
Requests are stored privately in Supabase and organized in the HMD Operations CRM. Authorized administrators can add internal notes, assign responsibility, record the next action and set a follow-up date. Workflow changes retain a private history. Access is restricted to separately authorized HMD Operations administrators. Sending a form does not create a customer account, guarantee acceptance or commit either party to an engagement. The form shows a reference only after the request has been saved.
Security & technical information
The request service uses validation and submission limits to reduce abuse. It stores a one-way, keyed fingerprint derived from the network address for this purpose; the application does not store the raw network address with the request. Supabase and Vercel may process technical information needed to provide and protect their services.
Accounts
Client and administrator sign-in use Supabase. Passwords are sent directly to Supabase over HTTPS. They are not stored in website source or browser storage. Sessions are held in the current page and cleared on sign-out or when the page closes. Client access and administrator access are separate memberships; signing in does not grant access to other clients’ information or the administrator inbox.
Customer workspaces
When workspace access is arranged, we store the projects, tasks and decisions you enter, including outcomes, requirements, statuses and due dates. Workspace access requires an active, explicit membership for that organization. Owners and editors can create or update work; viewers can read it. Changes record the signed-in actor and a private history. HMD administrator status alone does not grant access to a customer organization’s workspace. Please do not enter passwords, payment details or sensitive personal information in project notes. Workspace activity is excluded from website analytics.
Use & retention
Request information is used to handle the inquiry and any resulting relationship. It is not published on the website. Contact HMD through the request form if you need to correct or remove a request, quoting the reference where available. Requests for removal are reviewed against any obligations connected with an active engagement.
Country, language & analytics
Your country choice may be saved in your browser so it remains available on your next visit. You can change it to Global in the country menu. The choice is used to frame your inquiry; it does not track your location. The hosting provider processes the page, image and video requests needed to display the site.
Public website measurement
Public pages use Google Analytics automatically in cookieless mode to measure page visits and confirmed requests. Our integration does not grant permission for analytics or advertising storage, does not set Analytics cookies and does not enable Google signals or advertising personalization. It removes Analytics cookies left by the previous optional-cookie configuration. There is no analytics pop-up.
Google receives limited measurement signals and technical information, such as browser and network information, to process these visits. Cookieless measurement is not the same as sending no data. Google may process data on servers outside your country. See how Google uses information from sites that use its services.
Client and administrator areas, password recovery, request contents and contact details are excluded. Page addresses sent by our integration exclude query strings and fragments; referrers are omitted. Public journal measurement applies only to published pages. A completed-request event carries no form contents or request reference.
We keep measurement disabled when this browser sends Global Privacy Control or has an existing saved decline from our previous analytics controls. Browser privacy tools and blockers may also prevent measurement. Cookieless signals have reporting and modeling limits and do not provide a persistent cross-page visitor identity.
Illustrative media & links
Stock photography and film are illustrative. They do not represent HMD employees, facilities, clients or past engagements unless expressly stated. Third-party links are subject to their own privacy practices.
Notice version: 7 November 2026.