PILOT POLICY

Not legal advice. Not a final policy.

TEMPLATE ONLY. The owner must complete and obtain legal review before enabling public registration.

Privacy notice template

Controller: [OWNER MUST INSERT LEGAL NAME AND CONTACT]. We store your email, profile, campaign/application records, content uploads, session tokens and audit activity to operate the pilot. Authentication uses a necessary HttpOnly session cookie. Sign-in tokens are stored as hashes; queued authentication emails temporarily contain the one-time link and need short retention.

Service providers include your hosting operator/PostgreSQL, Cloudflare R2 for private content and Resend for transactional email. The operator must verify contracts, processing regions and transfer requirements. Files are private but collaborators and moderators can download them. Download links expire after 60 seconds; recipients may still keep copies.

[OWNER MUST DECIDE: retention periods, deletion and export procedures, rights-request contact, breach response, international transfer safeguards and legal basis. No ad tracking is implemented.]