Privacy Policy

⚠️ This is a drafting starting point, not a Privacy Policy

Written by the engineering side so counsel has something concrete to mark up. It is not legal advice and must not be published as-is.

Every <<PLACEHOLDER>> must be filled and every factual claim verified against what the system actually does at the moment of publication. A privacy policy that describes behaviour the software does not have is worse than no policy — it is a misrepresentation.

Claims in here that are currently NOT true and must be fixed in the product or removed from this document before publishing:

Claim	Status as of 2026-08-04
Sub-processor list (§7)	Not yet compiled — placeholders only
Retention windows (§5)	Implemented, but the reaper's first tick is one hour after startup, so the real bound is ~25h not 24h
Right to erasure on request (§8)	No self-serve endpoint exists. Erasure is a manual operator procedure today
Backups (§6)	No automated backup exists. Do not claim backups until they do
International transfers (§9)	Depends on final hosting; unverified
Certifications (§6)	We hold none. Do not imply otherwise

Source: docs/audit-v1-production-readiness-2026-08-03.md.

1. Who we are

<<LEGAL ENTITY NAME>> ("we", "us"), <<ADDRESS>>, is the controller of personal data described in §3 (data about you as a user of xfilguard).

For the content you upload, you are the controller and we act as your processor. That relationship is governed by the Data Processing Agreement at <<DPA URL>>, which takes precedence for that data.

<<Counsel: confirm whether a Data Protection Officer or an EU/UK representative is required, and add contact details if so.>>

2. Scope

This policy covers the xfilguard web application and API at <<DOMAINS>>. It does not cover third-party sites we link to.

3. Data we collect about you as a user

We do not collect payment card details. Payments are handled by <<PAYMENT PROCESSOR>>; we store only a customer reference and subscription state.

4. The content you upload

4.1 We store the file you upload, a parsed text representation of it, the locations and text of the items our detection identified, and the processed output.

4.2 We use that content only to provide the Service to you. We do not sell it, use it for advertising, or use it to train models.

4.3 Our staff do not access your content except where you explicitly ask us to for support, or where required by law. <<Counsel: confirm whether you want to commit to this in writing — it is a strong commitment and it must be technically and organisationally enforced.>>

5. Retention and deletion

5.1 Original uploads. By default the original is purged within <<RETENTION WINDOW>> hours of upload. Where you choose the anonymisation procedure, the original is deleted as soon as the processed output is produced.

Engineering note for counsel: the reaper runs hourly and its first pass is one hour after a process restart, so the true upper bound is the configured window plus up to one hour. State the number you can actually honour.

5.2 Parsed text. A cached parse of the document is held to avoid re-processing and is deleted with the original.

5.3 Detected item text. The text of each detected item is nulled when the original is purged. Where you chose the reversible (pseudonymisation) procedure, an encrypted copy is retained so you can reverse the mapping; that copy is deleted when the processed output expires (30 days after it was produced) or when the document is deleted, whichever comes first.

5.4 Processed output. The obfuscated file is deleted 30 days after it was produced, or earlier when you delete the document or close your account. After 30 days the document shows that the file expired; if the original is still stored you can obfuscate it again, which starts a new 30 days.

5.5 Deleting a document removes the original, the processed output, the cached parse and the detected item text.

5.6 Account and workspace data is retained while your account is active and deleted within <<N>> days of account closure, except where we must keep records longer for tax, accounting or legal reasons — in which case we keep the minimum required for the minimum period.

5.7 Activity logs are retained for <<N>> months.

6. Security

We protect data with, among other measures: encryption in transit (TLS); encryption of reversible mappings at rest; hashed passwords; per-workspace access control with per-uploader document isolation; short-lived access tokens; rate limiting; and structured audit logging.

We hold no third-party security certification at this time. <<Do not add SOC 2, ISO 27001 or HIPAA claims here until they are real and current.>>

<<Backups: describe them here once they exist. Until then this section must not imply that data is backed up.>>

7. Sub-processors

We use the following third parties to provide the Service. Each is bound by contract to process data only on our instructions.

We will give notice at <<SUB-PROCESSOR PAGE URL>> before adding or replacing a sub-processor, so you can object as provided in the DPA.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent. You may also complain to your supervisory authority.

You can export your own account data yourself in the application (Settings > Preferences > Export my data), and workspace owners and admins can export the workspace and its activity log (Settings > Team, and Reports > Activity).

To exercise these rights, contact <<PRIVACY EMAIL>>. We will respond within the period required by applicable law (generally one month under the GDPR).

Where the request concerns content you uploaded, you are the controller: you can delete it yourself in the application, and the DPA governs our assistance.

Engineering note for counsel: there is currently no self-serve right-to-erasure endpoint. Requests are fulfilled by an operator procedure. Either build the endpoint or describe the manual process honestly here, including the response time you can actually meet.

9. International transfers

<<Describe where data is hosted and, if it leaves the UK/EEA, the transfer mechanism relied on — Standard Contractual Clauses, adequacy decision, or the UK IDTA. This section is unverifiable until hosting is final.>>

10. Cookies and analytics

We use strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. These do not require consent.

<<If product analytics are enabled, list the provider, what is collected, and add a consent mechanism. As of this draft, analytics are configured but disabled, and the pageview URL is not yet sanitised against tokens appearing in query strings — do not enable analytics until that is fixed. See P1-18 in the audit.>>

11. Children

The Service is not directed at children and we do not knowingly collect data from anyone under 18. If you believe we have, contact <<PRIVACY EMAIL>>.

12. Changes

We will post changes here and update the date above. For material changes affecting your rights we will notify you by email or in-product at least <<NOTICE PERIOD>> days in advance.

13. Contact

<<LEGAL ENTITY NAME>>, <<ADDRESS>> Privacy: <<PRIVACY EMAIL>> · Security: <<SECURITY EMAIL>>

PRIVACY.md at the repository root is the engineering view of the same subject: what the code actually stores and deletes. Keep the two consistent — when they disagree, the code is the fact and this document is the claim.