Draft — pending legal review.
This notice has not been reviewed by a lawyer and is not in force. It describes what the system actually holds today, so that the description is accurate even while the legal text is not final.

Privacy notice (draft)

Last changed with front v0.1.0.

1. Who is responsible

The controller is legal entity TBD, at registered address TBD. A contact address for privacy questions is TBD; see about.

2. This site

These marketing pages load nothing from anyone else: no third-party scripts, no third-party fonts, no analytics, no advertising, no cookies set by us. The pages are served from Cloudflare, which handles the request and keeps its own operational logs.

3. What the product holds about you

• Your email address. It is your identity: it receives your one-time sign-in code and it identifies you as a member.
• Your membership. Which org you belong to, your role in it, and which projects are bound to that org with you as owner.
• Machine identity. A token issued to a machine you approved, valid 30 days, refreshed at the start of a session, and revoked when your member record is removed.
• What the plugin banks. For each project where you establish an estate: a map of each commit and a product-management view of the build. This is the record the dashboard shows.

4. Who can see it

Members of your org with a role that permits it — a mentor in a cohort, a manager in a team, an org owner. That is the purpose of the product, and it is the reason to be careful about which org you join. We can see it as the operator of the service. It is not sold, and it is not shared with anyone else for their own purposes.

5. Processors

Cloudflare hosts and serves both this site and the hub, and provides the sign-in that emails your one-time code. When payment opens, a payment provider will process your payment and we will not hold card details; that provider will be named here before payment opens.

6. Where it is kept, and for how long

Records are held in Cloudflare's storage. Retention periods for banked records after an account ends are TBD and will be stated here before payment opens.

7. Your rights

You can ask what is held about you, ask for it to be corrected, and ask for your member record to be removed — removal revokes your machine tokens at once. The full statement of rights under the applicable law, and how to complain to a regulator, is TBD pending the review.

8. Security

There is no password to steal: people sign in with a one-time code sent to their email address, and machines hold short-lived signed tokens that are revocable. Keep your mailbox secure, because it is the key to your account.

9. Changes

While this draft stands, it can change without notice. Once the reviewed version is in force, material changes will be announced to account holders.