ACCOUNT DOCUMENTS
Privacy,
by design.
DRAFT DOCUMENT — registration remains disabled until the operator confirms the controller, applicable jurisdiction and final text.
1. Information used for account access
The account service is designed to process first and last name, email address, country or region, a password hash, email-confirmation and password-reset token hashes, session records, policy-version consent records and limited security-event details. Passwords and raw one-time tokens are not stored in the account tables.
2. Purposes and service providers
The information supports account creation, email confirmation, sign-in, session security, password recovery, abuse prevention and security review. A configured SMTP provider receives email addresses and account messages. The operator must identify actual service providers, hosting locations, international transfers and applicable legal bases before public release.
3. Retention and security
Security-event records containing an IP address are configured for deletion after 30 days by default. Expired or used authentication tokens and old sessions are removed by the scheduled cleanup command. Database backups may retain deleted records until the backup retention period ends; the operator must document and configure that period. Access uses password hashing, short-lived one-time tokens, and server-side revocable sessions.
4. Your rights and contact
The operator must add the controller's legal name, privacy contact, applicable rights-request process, complaint authority, legal bases, retention schedule and effective date. Those details depend on the operator and the jurisdictions in which the service is offered.