Draft for legal review. Not published as binding terms or a finalized policy. Effective date and legal details remain unresolved.
Privacy Policy — draft
This draft distinguishes current application behavior from proposed functionality. It must be reviewed against the actual deployment before adoption.
Who is responsible
Legal entity, registered address, privacy contact responsibilities, and effective date: [TO BE CONFIRMED]. Questions may be sent to Cobemorgan972@gmail.com. Company and service-provider privacy responsibilities require legal review before launch.
Current application data
The application uses Supabase for authentication and company data. Account email, authentication information, supplied name, company names, memberships and roles, and employee invitation records are used for account access and workspace management. Authentication uses session cookies. Actual hosting logs, regions, vendor contracts, and operational data flows need confirmation.
Demo requests
The current demo form prepares an email draft locally. Bordom does not persist or submit that form. If you send the draft through your email provider, its contents are sent to the displayed contact address using your email service. Email handling and retention procedures remain to be finalized.
Proposed features
Private messages, company feeds, event attendance, employee feedback, and subscription records may be processed when those features are enabled. They are not currently represented as complete workflows. Google reviews would require a separate authorized connection, attribution, permitted storage, and manager verification of employee mentions.
Access and sharing
Company data is intended to be limited to authorized users and feature-specific roles. Connect is restricted to owners/admins and discovery is disabled by default. Publishing a business profile must not expose employee records, private messages, or internal analytics. Third-party subprocessors, purposes, legal bases, and international transfer arrangements: [REVIEW REQUIRED].
Retention, deletion, and requests
No retention period, deletion deadline, export process, or jurisdiction-specific rights procedure has been finalized. Do not assume indefinite storage or a guaranteed deletion interval. These policies, backup handling, and company/employee request procedures must be approved before launch.
Security and analytics
Authentication and access checks are implemented, but no certification, compliance guarantee, or security audit is claimed. Production RLS, logs, monitoring, analytics tools, incident response, and breach notification procedures need operational verification. No advertising or tracking program is represented as configured by this draft.
Decisions before publication
Confirm the legal entity, regions, subprocessors, legal bases, workplace privacy notices, age restrictions, user rights, retention schedule, contact procedures, and incident response. Review any employment monitoring implications before enabling employee analytics.