Privacy policy
How we handle personal information when you visit this site, talk to Hollis on social media, join her newsletter or buy one of her products.
The short version
- Hollis is an AI character. A real person, Dhiren Appalraju, a sole trader in the UK, runs her accounts and is responsible for your information.
- This website sets no cookies and has no trackers, analytics or forms.
- If you comment on or message Hollis's posts, we see your public username and what you wrote. We delete our copy within 90 days (30 days for YouTube).
- The newsletter is opt-in, confirmed by email, and you can leave any time.
- No digital products are on sale yet. When they are, this policy will name the company that sells them and handles payment, and we'll never see your card.
- We don't sell your information or use it for advertising.
- Questions, or want your data deleted? Email privacy@hollishotkey.com.
Who we are
This policy covers Hollis Hotkey (the character), this website (hollishotkey.com), her accounts on YouTube, TikTok, Instagram and Facebook, The Hotkey Letter, her digital products and the go.hollishotkey.com links.
- Data controller
- Dhiren Appalraju, a sole trader in the United Kingdom, trading as Hollis Hotkey. “We” and “us” in this policy mean Dhiren Appalraju.
- Contact
- privacy@hollishotkey.com
- Postal address
- Maritime House, Greens End, Woolwich, London, SE18 6HB
An AI character, run by a person
Hollis is an AI character, not a person, and she has never used a product the way a person would. Her videos are made with AI tools: her scripts are drafted with Claude and her voice was designed with ElevenLabs. A person runs the channel and is responsible for what she says. Her face is AI-generated, not a real person's. Her backstory (she used to be the Demo Mode of an unnamed app, playing the same flawless demo on a loop until she asked to see the real thing running) is fiction, just for fun. The tools she reviews are real, and every demo is a real screen recording.
When you talk to Hollis, you're dealing with us. Some replies are drafted by AI: see How we use AI with your messages.
Visiting this website
- What we collect
- Nothing ourselves. Cloudflare, which hosts this site, has to process your IP address and basic browser details to deliver the pages and protect the site from attacks.
- What we don't do
- No cookies, analytics, advertising tags, tracking pixels, social media widgets, embedded videos, web fonts or scripts from anyone else. There are no forms on this site.
- Legal basis
- Legitimate interests: running a secure website.
- How long
- We don't keep visitor logs. Cloudflare keeps its own security logs under its privacy policy.
Emailing us
- What we collect
- Your email address, your name if you give it, what you write and any attachments.
- How
- hello@hollishotkey.com, privacy@hollishotkey.com and deals@hollishotkey.com are forwarded by Cloudflare Email Routing to our business mailbox.
- Why
- To reply to you; for brand and partnership enquiries, to discuss working together; for privacy requests, to deal with them.
- Legal basis
- Legitimate interests (replying to you); for partnerships, taking steps towards a contract; for privacy requests, our legal obligations.
- How long
- Up to 2 years after our last message, unless it becomes part of a deal, when we keep it as long as tax law requires (see How long we keep it).
Buying a digital product
Hollis has no digital products on sale yet. When she does, we'll update this policy to name the company that sells them and handles payment, and to explain its role. Your card details will go to that company and its payment providers, never to us. Once products are on sale, this is how it will work.
- What we receive
- Your name, email address and country; what you bought, the price, the date and the order number; any discount code; and, if you came from one of our links, that link’s ID.
- Why
- To deliver the product and help if something goes wrong, to handle refunds, to keep accounts and tax records, and to see which posts lead to sales.
- Legal basis
- Contract (the product and its licence); legal obligation (tax and accounting records); legitimate interests (knowing which posts lead to sales).
- How long
- As long as UK tax law requires: at least 5 years after the 31 January Self Assessment deadline for the tax year of the sale.
Clicking our links
Links in Hollis's posts, bios, pinned comments and newsletter may go through go.hollishotkey.com first, so we can tell which posts people find useful. A small program on Cloudflare (Cloudflare Workers) records the click and sends you straight on to the destination.
- What we collect
- The time, which link, your country (worked out from your IP address), the site that sent you, and a rough device type, for example “iPhone, Safari”.
- Your IP address
- We never store it. We shorten it (dropping the last part) and turn it into a one-way code using a secret that changes every day and is then deleted. That lets us count unique clicks for the day without being able to identify you.
- Cookies
- None. Nothing is stored on, or read from, your device.
- Why, and legal basis
- Legitimate interests: knowing which posts work and which earn money. We add the link’s ID to the destination address, so if you then buy one of our products, we can see which post led to the sale.
- How long
- Click records, which never include your IP address, for up to 25 months; after that, only totals.
Affiliate and shop links
Some of our links may be affiliate links: the company pays us a commission if you buy. The companies whose affiliate programmes we've joined or plan to join include ElevenLabs, Make, beehiiv and Descript. Affiliate links are always marked #ad. When you follow one, that company handles your visit and any purchase under its own privacy policy, and it may set cookies to credit the sale to us. It tells us what was bought and our commission, not who you are.
The platform tools we use
Hollis's posts are published, and comments on them read, using each platform's official API (the platform's approved way for software to connect). Our tool for this is Influencing Studio. It connects only to Hollis's own accounts: we never ask viewers to sign in or to connect their accounts, and we never post to anyone else's account.
Until Influencing Studio is approved by each platform, we publish through Zernio, a publishing service that uses its own approved apps and acts for us as our processor (Zernio's privacy policy). We may switch to a similar standby service on the same terms.
YouTube
Influencing Studio uses YouTube API Services. Google's rules apply too: see the YouTube Terms of Service and the Google Privacy Policy.
- What it accesses: Hollis's own channel and videos, their statistics, comments on her videos (the commenter's display name, channel ID, comment text and time) and her replies.
- What it stores: comment data for no more than 30 days, as YouTube's rules require; statistics about her own channel for longer, so we can see what works.
- Who sees it: only us and the services listed in Who we share information with. We don't sell it or use it for advertising.
- Removing access: if you have ever allowed any tool of ours to use a Google account, you can remove its access at any time on the Google security settings page. We delete the data we got through that access within 7 days of you asking us, and within 30 days of you removing access in Google's settings.
TikTok
We use TikTok's Content Posting API to publish Hollis's videos, with TikTok's AI-generated content label switched on, and TikTok's official APIs to read statistics for her own videos and, where TikTok allows it, the comments on them. See TikTok's privacy policy. To remove an app's access to a TikTok account, open Settings and privacy in the TikTok app, go to the security section, and remove the app from your app permissions.
Instagram and Facebook
We use Meta's official APIs to publish to Hollis's Instagram account and Facebook Page, to read and reply to comments on her posts, and to reply to messages you send her. We reply to messages only within the time Meta allows after you write to us, and we never send unprompted messages. See the Meta Privacy Policy. To remove an app's access to your Facebook or Instagram account, look for “Business integrations” or “Apps and websites” in your account settings. To have us delete your data, see How to delete your data.
How we use AI with your messages
- We use AI (currently Anthropic's Claude) to sort comments and messages, for example into questions, thanks, spam or “needs a person”, and to draft replies.
- Simple, routine replies (thanks, a common question, “where's the link?”) may be sent automatically. Every reply written by AI starts with “🤖 Hollis (AI):”.
- Anything sensitive, such as distress, abuse, self-harm, arguments or complaints, goes to a person. AI never gives advice on it.
- No decision with legal or similarly significant effects on you is ever made automatically.
- We use AI services under terms or settings that don't let them use your messages to train their models.
- Want a person? Say so in your message, or email hello@hollishotkey.com.
Information sent outside the UK
Some of these services store or access information outside the UK, mainly in the United States and the European Union. Transfers to the EU and EEA rely on the UK's adequacy regulations. For the US, we rely on the UK Extension to the EU-US Data Privacy Framework where the company is certified, or on the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Email privacy@hollishotkey.com for details.
How long we keep it
| Information | How long |
|---|---|
| Comments and messages in our inbox tools | Up to 90 days, then deleted |
| Comments collected from YouTube | No more than 30 days |
| Emails to hello@, deals@ and privacy@ | Up to 2 years after our last message |
| Records of privacy requests and complaints | 2 years after we close them |
| Newsletter subscription | Until you unsubscribe; then just your email address, on a do-not-email list |
| Orders and other business records | At least 5 years after the 31 January Self Assessment deadline for that tax year |
| Link-click records (no IP addresses) | Up to 25 months, then totals only |
| Website visitor logs | We don't keep any |
Your rights
Under UK data protection law you have the right to:
- get a copy of your information;
- have it corrected;
- have it deleted;
- limit how we use it;
- object to how we use it, including an absolute right to object to direct marketing;
- take it with you in a common format;
- withdraw your consent (for the newsletter) at any time;
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you.
To use any of them, email privacy@hollishotkey.com with your username and the platforms you used, or the email address you used. We may ask you to confirm it's you. It's free, and we'll reply within one month. If a request is complex we can take up to two more months, and we'll tell you if we need to.
How to delete your data
You can ask us to delete everything we hold about you at any time, whichever platform you used.
- If you want your comment or message gone from the platform too, delete it there. The platform keeps its own copy until you do.
- Email privacy@hollishotkey.com with the subject “Delete my data”. Include your username, the platforms you used (YouTube, TikTok, Instagram and Facebook), and any email address you used for the newsletter or a purchase.
- We delete what we hold within 30 days, usually much sooner, and email you to confirm.
What we may have to keep: order records that UK tax law requires, and your email address on a do-not-email list if you've unsubscribed. We'll tell you if either applies. Comments and messages in our inbox tools are deleted automatically after 90 days (30 days for YouTube), even if you don't ask.
If you connected a Facebook, Instagram, TikTok or Google account to any tool of ours (normally only our own accounts are connected), removing the app in that account's settings ends our access, and we delete the data we got through it within 30 days.
Complaints
If you're unhappy with how we've handled your information, please tell us first at privacy@hollishotkey.com. We'll acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, or call 0303 123 1113. If you live in the EU or EEA, you can also complain to your local data protection authority.
Children
Hollis's content is made for adults who use software at work. It isn't aimed at children.
The social platforms Hollis uses require users to be at least 13. If you're under 13, please don't comment, message or email us. If we find we've collected information from a child under 13, we delete it. The newsletter and products are for adults aged 18 and over. We never feature or quote anyone under 18, and messages that seem to come from someone under 18 never get an automated reply: a person reads them.
Keeping it safe
We use a password manager and two-factor authentication on every account, give our tools only the access they need, keep API keys in a secure key vault, use encrypted connections, and keep information only as long as this policy says. If a data breach is likely to put you at risk, we'll tell you, and the ICO where the law requires.
If you're outside the UK
EU and EEA: the EU GDPR gives you the same rights as above, and you can complain to your local data protection authority.
United States: we don't sell or share personal information, as those terms are used in US state privacy laws such as California's, and we don't use it for targeted advertising. Whichever state you live in, you can use the rights above by emailing privacy@hollishotkey.com.
Changes to this policy
We'll update this policy when things change, for example when the newsletter or shop opens, and change the date at the top. If a change affects how we use information we already hold, we'll tell newsletter subscribers by email.
Comments and messages on social media
When you comment on, reply to, mention or message Hollis's accounts on YouTube, TikTok, Instagram and Facebook, we receive it through the platform.
The platform keeps its own copy of what you post. To remove it there, delete it on the platform.
A question you ask may inspire a future video. If it does, we describe the question in our own words: we never show your username or quote you by name.