Privacy notice

DRAFT — NOT APPROVED FOR CUSTOMER LAUNCH. This page contains unresolved setup and legal-review placeholders. No final legal policy or commercial promise is established by this draft.

Controller and contact

[LEGAL REVIEW: legal entity/controller, postal address, privacy contact, applicable jurisdictions, effective date, and DPO/representative if required.]

Data processed by the current implementation

Docs processes authenticated user IDs/emails, organization membership, file contents and metadata, audit events, recipient-bound share links, and SOP acknowledgments. Stock, Assets, Quote, and Orders currently store business records on the user’s browser. The app loads Google Fonts. The deployed hosting/authentication boundary is supplied by Sites; Docs uses D1/R2. Account-level provider settings have not been audited here.

The separate, not-yet-deployed organization service adds PostgreSQL organization profiles, employee roles/app assignments, invitation metadata, usage, uploaded resource bytes, billing identifiers and subscription events. It validates JWT identities from a provider still requiring setup. Invitation links and payment/session credentials must not be logged. [LEGAL REVIEW: identify the actual identity, database and billing providers and update this notice before use.]

Billing and vendors

Stripe is not connected to the currently deployed app. If the test-mode billing foundation is integrated after review, document the billing identifiers and subscription events processed, approved vendor/subprocessor list, data-processing agreements, transfers, and hosting regions. [LEGAL REVIEW REQUIRED.]

Purpose, rights and retention

[LEGAL REVIEW: lawful bases, purposes, retention periods by data type, access/correction/deletion/portability process, complaints, transfers, and treatment of customer-uploaded employee information.] No retention or erasure SLA is represented as implemented.

Cookies and browser storage

The first four apps use localStorage/IndexedDB. Site sign-in may use authentication storage/cookies controlled by the host. [LEGAL REVIEW: cookie inventory, consent requirements, analytics choice, and customer notice.]