staging environment — not production
# Privacy Policy

**STATUS — NOT YET REVIEWED BY COUNSEL. Version `{privacy_version}`.**

This document was drafted from the product specification, not by a lawyer.
Gate R-141 §1 requires review and sign-off by counsel before publication, and
that has not happened. Values in `{braces}` are configuration placeholders and
must be replaced with real values before this document is published. Until both
are done, this text is a draft for review.

---

## 1. Who we are, and what we are not

`{legal_entity}` ("we", "us") operates `{Brand}` — software and programme
operations for businesses that want to offer payment cards to their own
customers under their own brand.

We want to be exact about our role, because a privacy policy that is silent on
this reads as a claim we are not making:

| We do not | Who does |
|---|---|
| We do not issue cards | a licensed issuing platform or its partner bank |
| We do not hold, move or touch cardholder funds | the issuer |
| We do not make final KYC or onboarding decisions about cardholders | the issuer |
| We do not authorise transactions, resolve disputes, or freeze funds | the issuer |
| We do not receive or store card numbers or CVV — they never pass through our systems and never appear in our logs | the issuer and its hosted flows |

**We hold no payment, banking or e-money licence and make no claim to one.** We
are not a bank, not an electronic money institution, and not the issuer of any
card. The issuer of record for any live programme is named in that programme's
agreement and is disclosed to every cardholder in the application.

## 2. What this service currently is

At this stage `{Brand}` is a **demonstration sandbox**. The cards shown in it
are not real, the transactions are produced by a generator, and the card details
displayed are mock data. No real payment instrument is created and no real money
moves.

This policy therefore describes the personal data of the **people who sign up to
evaluate the product** — not the personal data of cardholders of a live card
programme, because no such programme exists here.

## 3. What personal data we collect

### 3.1 Your account

Email address, name, country, a password hash (argon2id), a TOTP secret and
recovery codes if you enable two-factor authentication, and a counter of failed
sign-in attempts.

### 3.2 Your registration record

Company name, job title, country, an indicator of whether the email address is
a work address, how you found us, the versions of these Terms and this Privacy
Policy you accepted together with the moments of acceptance, your marketing
consent with the moments it was given and withdrawn, evidence of that consent,
a free-text note made by our staff during manual review, and flags recording the
outcome of sanctions and watchlist screening.

### 3.3 Your IP address

Used at sign-up to determine your country. **This determination is made
offline.** A city-level geolocation database is compiled into our application
image; no request leaves our systems to determine your location, and no
geolocation vendor receives your IP address. This is a deliberate design choice
and it is the reason no geolocation provider appears in section 6.

If your location cannot be determined, registration is still permitted, but the
record is flagged and placed in a manual review queue.

### 3.4 Product telemetry

Events describing how the product is used — which screens were opened, which
steps of the evaluation were completed, and similar. The full list of event
types is fixed in our internal specification.

### 3.5 Email log

A record of which messages were sent to you and when. The **content** of those
messages is not stored.

### 3.6 Files you upload

If you upload a logo for a demonstration programme, we store the file and a
record describing it.

## 4. Why we process it, and on what basis

| Purpose | Basis |
|---|---|
| Creating and securing your account, providing the sandbox | performance of a contract |
| Screening residency and sanctions before granting access | compliance with a legal obligation |
| Manual review of registrations | legitimate interest in preventing misuse, and legal obligation where screening applies |
| Product telemetry and aggregate reporting | legitimate interest in understanding and improving the product |
| Marketing email | your consent, withdrawable at any time |
| Audit trail of actions taken in the system | legal obligation and legitimate interest in accountability |

## 5. Who we do not serve

**We do not serve residents of the Russian Federation.** This follows from
Council Regulation (EU) 833/2014 Article 5b. We also do not serve residents of
countries and regions under embargo.

The check happens at the door: country is determined from your IP address and
from the details you declare. A match against the restricted list results in
refusal of registration — not a flag for later.

## 6. Who else receives your data

| Recipient | Purpose | Location |
|---|---|---|
| Amazon Web Services | hosting, database, file storage | Frankfurt, Germany (`eu-central-1`) |
| Resend | delivery of transactional and marketing email | — |
| Cal.com | booking a call slot, if you book one | — |
| Plausible | privacy-focused analytics on our public website | — |

Two absences are deliberate and worth stating:

- **No geolocation provider.** See section 3.3 — the database is offline and
  inside our own image.
- **No AI provider.** Our configuration includes credentials for an AI service,
  but it is not used at this stage and receives no personal data.

## 7. How long we keep it

| Data | Retention | What happens |
|---|---|---|
| End-user, KYC session, card and transaction records of a demonstration programme | 90 days of tenant inactivity | deleted |
| Support cases of a demonstration programme | 90 days | deleted, except as noted below |
| Product telemetry tied to a programme | 90 days | deleted |
| Uploaded logo and the stored file | 90 days | file and record deleted |
| A demonstration programme itself | 90 days | closed, branding cleared, the record retained |
| Your registration record and account | 12 months from last activity | **anonymised, not deleted**: the email address is replaced with a salted hash and the record is retained without identifying you |
| Product telemetry not tied to a programme | 12 months | deleted |
| Email log | 12 months | deleted |
| Sign-in links, sessions, rate-limit counters | 30 days | deleted |
| **Audit trail of actions** | **5 years** | actors pseudonymised and moved to an archive; **never deleted** |

### Two exceptions you should know about

**Sanctions matches and records under legal hold are not deleted.** Where a
support case records a sanctions match, or where a record is subject to a legal
hold, that record is detached from the programme it belonged to and retained for
five years. The right to erasure does not extend to these records.

**The audit trail is never deleted.** Every action taken by a person or by an
automated agent in the system is written to an append-only audit log. Actor
identities are pseudonymised after five years, but the entries themselves
remain.

## 8. Your rights

Subject to the exceptions in section 7, you may request access to your personal
data, correction of it, erasure of it, restriction of processing, portability of
it, and you may object to processing based on our legitimate interests.

You may withdraw marketing consent at any time — every marketing email carries
an unsubscribe link, and using it takes effect without any further action by us.
Withdrawal does not affect the lawfulness of processing before it.

You may complain to your national data protection authority.

To exercise any of these rights, write to `{contact_email}`.

## 9. International transfers

Our infrastructure is in the European Union. Where a recipient in section 6
processes data outside the European Economic Area, that transfer relies on the
safeguards in that recipient's own data processing terms.

## 10. Security

Passwords are hashed with argon2id. Two-factor authentication is available and
required for staff accounts. Accounts lock after repeated failed sign-in
attempts. Logs are filtered so that card numbers cannot appear in them and email
addresses appear only as hashes. Access to production data is restricted and
audited.

## 11. Cookies

We use cookies that are necessary for the service to work — keeping you signed
in and protecting forms against cross-site request forgery. Our public website
uses analytics that do not set identifying cookies and do not track you across
sites.

## 12. Changes to this policy

When this document changes, its version changes with it, and the version you
accepted is recorded against your registration. That means your acceptance is
always tied to the text you actually saw, and never to a later revision.

The current version of this document is `{privacy_version}`.

## 13. Contact

`{legal_entity}`, `{address}`
Email: `{contact_email}`