1. Introduction

Welcome to our Privacy Policy. This document explains how we collect, use, disclose and protect information about you when you visit our website, use our platform, or otherwise interact with our services (collectively, the "Services").

By using our Services, you agree to the collection and use of information in accordance with this policy. If you do not agree with our practices, please do not use the Services.

2. Information We Collect

We collect information you provide directly, information we collect automatically when you use our Services, and information from third parties.

2.1 Information You Provide

• Account data: name, email address, password and profile picture when you register.
• Payment data: billing address and payment method details (processed securely via our payment provider).
• Communications: messages, support tickets or feedback you send us.
• Survey responses: optional information you submit when participating in research or promotions.

2.2 Automatically Collected Data

When you interact with our Services, we automatically collect technical and usage data including:

2.3 Data from Third Parties

We may receive information about you from social login providers (e.g. Google, GitHub) if you choose to sign in via those services, and from analytics or advertising partners as described in Section 7.

3. How We Use Your Information

We use the information we collect for the following purposes, each grounded in a lawful basis under applicable data protection law:

• Providing the Services — creating and managing your account, processing transactions and delivering the features you request.
• Improving & personalising — analysing usage patterns to enhance performance, fix bugs and tailor your experience.
• Communications — sending transactional emails (receipts, password resets) and, where you have opted in, marketing updates.
• Security & fraud prevention — monitoring for suspicious activity, enforcing our Terms of Service and complying with legal obligations.
• Aggregate analytics — producing anonymised statistics that cannot identify you personally.

4. Sharing Your Information

We do not sell your personal information. We may share it only in the following limited circumstances:

4.1 Service Providers

We engage trusted third-party companies to help us operate the Services — such as cloud hosting, payment processing and email delivery. These vendors are contractually bound to use your data only to perform services on our behalf.

4.2 Legal Requirements

We may disclose information when required by law, court order or governmental authority, or when we believe disclosure is necessary to protect rights, property or safety.

4.3 Business Transfers

If we are involved in a merger, acquisition or asset sale, your information may be transferred. We will notify you via email and/or a prominent notice on our website before any transfer takes place.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Services. Specific retention periods:

• Account data — retained until you delete your account, plus 30 days for recovery purposes.
• Transaction records — kept for 7 years to meet legal and tax obligations.
• Log and security data — retained for 12 months then automatically purged.
• Marketing preferences — retained until you withdraw consent or unsubscribe.

Upon expiry of the applicable retention period, data is either securely deleted or anonymised so it can no longer be linked to you.

6. Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Portability — receive your data in a structured, machine-readable format.
• Restriction — ask us to limit how we process your data in certain circumstances.
• Objection — object to processing based on our legitimate interests or for direct marketing.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any right, please use the privacy controls in your account settings or contact us at privacy@example.com. We will respond within 30 days.

7. Cookies & Tracking Technologies

We use cookies and similar technologies to recognise your browser, maintain session state and measure how the Services are used.

7.1 Types of Cookies We Use

• Essential — required for the Services to function (e.g. login sessions). Cannot be disabled.
• Analytics — help us understand traffic and usage patterns (e.g. page views, bounce rate).
• Preferences — remember your settings such as language and theme.
• Marketing — used to deliver relevant advertisements. Only activated with your consent.

7.2 Managing Cookies

You can manage or disable non-essential cookies at any time via the Cookie Preferences panel available in the footer of every page, or by adjusting your browser settings. Note that disabling some cookies may affect functionality.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These include:

• TLS encryption for all data in transit.
• AES-256 encryption for sensitive data at rest.
• Role-based access controls limiting employee access to data.
• Regular third-party penetration testing and security audits.
• Automated anomaly detection and incident response procedures.

Despite our efforts, no security measure is perfect. In the event of a data breach that affects your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours as required by law.

9. Children's Privacy

Our Services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with their personal information, please contact us immediately and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. When we make material changes, we will:

• Update the "Last revised" date at the top of this page.
• Notify registered users via email at least 14 days before the changes take effect.
• Display a prominent banner on our website for 30 days.

Your continued use of the Services after the effective date constitutes acceptance of the updated policy.