Privacy Policy
General Scope
Applies to every instance of data interchange between users and the service, including APIs and embedded widgets. Use of any feature equals acceptance of this policy.
Minimal Data Collection
Information gathered is strictly limited to unique IDs, basic configuration settings (e.g., language preferences), and encrypted usage logs. No third-party advertising or marketing identifiers are solicited.
Used for Core Operations
Data is processed solely to:
Verify session integrity
Detect and prevent abuse or fraud
Track uptime and latency metrics
Provide contextual help aligned with user actions
User Controls and Opt-Out
All non-essential data collection mechanisms can be toggled off within the user’s privacy dashboard. Opt-out takes immediate effect without service degradation. Clear instructions and links are provided wherever optional features solicit data.
Storage and Deletion
Data records older than 12 months are automatically moved to a secure archive. After 6 additional months, archives are scrapped via irreversible methods. Exceptions exist only for data subject to statutory retention requirements, which are flagged and separately managed.
Pseudonymization Measures
Where user IDs are required for audit trails, pseudonymous tokens replace real identifiers. Mapping tables are stored under stricter access controls and pruned following incident-response needs.
Technical Safeguards
End-to-end encryption for user-generated content
Continuous vulnerability scanning of network perimeters
Enforced multi-factor authentication for administrative access
Automated anomaly detection with real-time alerts
Compliance and Audits
Independent privacy audits are conducted biennially. Compliance attestations (e.g., SOC 2) are made available to users on request. Any identified gaps are addressed via documented remediation plans.
Data Subject Rights
Individuals may exercise rights to:
Access and port their personal data
Request restriction of processing
Lodge complaints with supervisory authorities
A streamlined request process ensures fulfillment within statutory deadlines.
Breach and Remediation
A formal incident-response team is on call 24/7. Following breach identification, containment and full forensic analysis are completed within 5 business days. Affected users receive detailed guidance on protective actions.
Amendments and Notification
Policy amendments appear with a “Last Revised” timestamp at the top. Significant changes prompt user notifications via in-service banners and email, providing an opt-in reaffirmation step for newly affected processing activities.
