Privacy notice

Who we are

This website and our services are operated by Holdout Labs, a Texas limited liability company in formation, operated by its founder, Raghuram Vadapally (“Holdout Labs”, “we”), 5900 Balcones Dr, Suite 100, Austin, TX 78731, United States. We decide how and why the personal information described here is used. Contact: [email protected] or [email protected].

What we collect

• Intake-form submissions: your email address, optional name, the market and timeframe, and the high-level description and notes you type. The form asks you not to enter exact rules, code, data, credentials or trade files.
• Audit requests (the public request-an-audit form): the indicator or strategy you name, the market, where it comes from, whether you have a backtest, and, only if you choose to give it and tick the consent box, your email address. We also record the country your request came from, as reported by Cloudflare.
• Newsletter subscriptions (Out of Sample): if you subscribe, you enter your email on our newsletter page, which is hosted by Beehiiv. Our own pages link to that page; they do not collect the address.
• Correspondence you send us by email.
• Engagement materials: returns, positions, trades or code you send for an audit, only after we have confirmed scope (and signed an NDA if you asked for one), by the method on how to send data. These are business data; most audits need only a returns series, which you can send anonymised. See confidentiality & data handling.
• Payment records: once card payments are enabled, processed by Stripe. We receive confirmation of payment and billing details, never your full card number. Until then, we invoice you directly.
• Site analytics: our own first-party, cookieless analytics (described below) records which pages are viewed, how long and how far down each is read, where the visit came from, your approximate location and the name of the network you browse from. We also use Cloudflare Web Analytics, which counts page views in aggregate without cookies.

How we use it

Only to reply to you, to scope, deliver and bill for the service you asked for, to keep business and tax records, and to meet legal obligations. We do not use your strategy or data for our own trading, research or products.

An audit-request email is used for one thing only: to tell you when that audit is published. A newsletter subscription is used only to send you Out of Sample, until you unsubscribe (every issue has an unsubscribe link). Neither is used for anything else, and giving an email on the request form does not subscribe you to the newsletter.

We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.

Where intake submissions go

When you submit the intake form, your submission is stored in a Cloudflare D1 database located in the United States (Western North America region), and a notification is emailed through Cloudflare’s email-sending service to our Zoho Mail inbox. Nothing else is done with it.

Audit requests and the newsletter

These are the only two places this site asks for an email outside the intake form, and both are optional. None of our published research is behind a sign-up: every audit, report and case study stays free to read without one.

• Request an audit. Your request is stored in the same Cloudflare D1 database (US) and a notification is emailed to our Zoho Mail inbox, so we can choose what to audit next. The email address, if you gave one, is used only for the publication notice you asked for. It is removed automatically after 365 days by a daily job; the rest of the request (indicator, market, source) is kept without it, to count what readers ask for. Ask us any time to delete the whole request.
• Out of Sample newsletter. Subscribing happens on Beehiiv’s page for our newsletter (newsletter.holdoutlabs.io), so Beehiiv holds your subscription and its privacy policy also applies. We keep you on the list until you unsubscribe, then Beehiiv marks you unsubscribed and we send nothing more.

Site analytics

To learn which pages are useful and where readers come from, this site runs its own analytics. It sets no cookies and stores no IP addresses. For each page you view we record:

• the page, the time (UTC), how long it was open in the foreground, and how far down you scrolled;
• the site that referred you (its domain and page, never its query string) and any campaign tags in the link (utm_source, utm_medium, utm_campaign);
• your approximate location (country, region and city) and the name and number of the network you connect from (for example your internet provider, or a company’s office network), as reported by Cloudflare for the connection;
• the kind of device (mobile, tablet or desktop) and the browser family. Your full browser identification string is not stored;
• clicks on a few links (requesting or ordering an audit, the newsletter, our X and LinkedIn pages, reports and downloads, and links to other sites) and form submissions (which form, not what you typed).

Page views in one browser tab are linked by a random identifier kept in that tab’s session storage. It is not a cookie, is never shared with anyone, and is discarded when you close the tab. Your IP address is used only momentarily to limit abusive traffic and is never stored. If your browser sends a Do Not Track signal, nothing is recorded. The records are kept in the same Cloudflare D1 database (US), are seen only by us, are not used for advertising or to identify you, and are deleted automatically after 13 months by a daily job.

Who processes it for us

Each provider processes data only to provide its service to us. Client data is never stored in code repositories. What each provider can see is set out on the confidentiality page. If you subscribe to our newsletter, Beehiiv’s own privacy policy also applies to that subscription.

How long we keep it

Security

The website and its forms use TLS (HTTPS). Engagement files are kept on an encrypted drive, seen only by the founder, and never stored in code repositories. The details are on the confidentiality page.

Your rights and requests

You can ask us to tell you what personal information we hold about you, to correct it, to delete it, or for a copy of it, by emailing [email protected]. We reply within 30 days and may ask you to confirm your identity from the email address we hold. We will not treat you differently for making a request. Where state privacy laws (for example in California or Texas) give you further rights, we honour them. We will confirm deletion in writing on request.

Cookies

This site sets no tracking or advertising cookies. A single local setting in your own browser remembers your light or dark theme choice, and our analytics keeps a random per-tab identifier in session storage, cleared when you close the tab. The newsletter page at newsletter.holdoutlabs.io is run by Beehiiv, not by this site, and may set its own cookies under Beehiiv’s policy.

Children

Our services are for businesses and professionals. We do not knowingly collect information from anyone under 18.

Changes

We will post any change here and update the date at the top. If a change materially affects how we use information you have already given us, we will tell you by email first.

27 September 2026: added the site analytics section and the related rows above, describing our first-party, cookieless analytics from that date. The effective date of the rest of this notice (26 September 2026) is unchanged.