Privacy Policy

1. What we collect

Account data you provide at registration (email, password hash), organisation and membership records, and audit log entries for actions taken in the portal. We do not collect document content in this phase — the portal does not accept file uploads.

2. Why we collect it

To operate your account and organisation, enforce access control, and maintain an append-only audit trail of security-relevant actions (membership and organisation changes).

3. Sharing

We do not sell personal data. When billing is enabled for a deployment, subscription and payment processing is handled by Stripe under its own privacy policy. See Trust for the current sub-processor status.

4. Retention

Account data is retained for as long as the account is active. Audit log entries are retained indefinitely and are never modified or deleted, by design.

5. Your rights

Contact sales@example.com for access, correction or deletion requests. Specific regional rights (GDPR, etc.) will be detailed here once this document has been reviewed by counsel.