Privacy Policy

Information required before approval

• Legal notice address and confirmed assumed-name/DBA status
• Business and privacy contact details
• Actual analytics, email, hosting, storage, authentication, and payment vendors
• Applicable state privacy-law analysis and consumer-request process
• Retention schedule and international transfer practices

Scope

This technical template describes the categories of information a software-services website and client portal may process. Counsel must align it with the deployed product, contracts, and actual business practices.

It is intended to cover public pages, contact and project-brief forms, client accounts, project collaboration, invoices, support, and related communications.

Information collected

Depending on the features a person uses, the service may collect contact and account details, organization information, project-brief responses, messages, support requests, files submitted for a project, invoice references, and technical security records.

Payment card and Apple Pay credentials should be collected by Stripe’s hosted or tokenized interfaces. The application should retain provider identifiers, payment status, amount, currency, and audit information—not full card numbers or wallet credentials.

• Information provided through forms and account settings
• Project, support, file, and collaboration information
• Invoice and payment-status information received from the payment provider
• Device, request, authentication, fraud-prevention, and security logs
• Analytics or preference data only when the deployed configuration actually uses it

Purposes of processing

Information may be used to respond to inquiries, evaluate project requests, provide and secure accounts, deliver contracted services, manage projects and support, issue and reconcile invoices, send transactional messages, prevent abuse, and meet recordkeeping obligations.

Counsel must identify the legal bases, notices, and consent requirements that apply to each actual use.

Service providers and disclosures

Information may be handled by infrastructure, database, private storage, authentication, email, monitoring, analytics, and payment providers used to operate the service. The final policy must name or accurately categorize actual providers and explain material disclosures.

Information may also be disclosed when required by valid legal process, to protect rights and system integrity, or in connection with a properly governed business transaction. Counsel must approve these circumstances.

Files and project information

Client files should remain private and be accessible only to authorized members of the relevant organization and authorized personnel. Access links should be time-limited, and file events should be logged where appropriate.

Clients should be instructed not to upload regulated, highly sensitive, or third-party information unless the applicable agreement and system controls expressly permit it.

Retention and deletion

Information should be retained only for documented operational, contractual, security, backup, and legal needs. Retention periods must be established by data category and reconciled with backup and dispute-preservation requirements.

Deletion requests may be limited by contractual, fraud-prevention, accounting, legal-hold, and other lawful requirements. Counsel must specify the applicable process and exceptions.

Security

Administrative, technical, and organizational safeguards should be selected according to risk. No website or storage system can promise absolute security, and this policy must not make that claim.

U.S. privacy choices

The final policy must explain any rights available under applicable U.S. federal or state law, how identity is verified, how authorized-agent requests are handled, and how to appeal where required.

Do not claim that a law is inapplicable or that data is not sold or shared until counsel verifies the company’s practices, advertising technology, and statutory definitions.

Children, changes, and contact

The service is intended for business use and should not be directed to children. Counsel must set the appropriate age statement and response process.

Material changes should be communicated through an updated effective date and any additional notice legally required. The production version must provide a monitored privacy contact.