TRUST & SUPPORT

privacy

[DRAFT — OPERATOR REVIEW REQUIRED] Data controller: [BUSINESS NAME / CONTACT]. Applicable jurisdiction and legal basis: [COMPLETE].

The application processes email for verification and billing, hashed API credentials, short-lived verification/session tokens, purchase records, keyed request fingerprints and response results. API responses are retained for 24-hour replay and may contain customer data. Policy findings and duplicate fingerprints are retained for 90 days; project rules and supplied baselines persist until deletion. Request bodies and email are excluded from application logs. IP-derived keyed rate counters are temporary. Stripe handles payment information; the configured email provider delivers links; Cloudflare hosts the Worker and D1.

Financial/idempotency retention, deletion exceptions, subprocessors, international transfers, backup retention and rights request procedures: [OPERATOR TO COMPLETE]. Do not submit data you are not authorized to process.

Support: [OPERATOR MUST SET SUPPORT_EMAIL]