Privacy Policy
Last updated: 2026-10-27
Template notice: this text is a starting template, not legal advice, and is not guaranteed to be compliant in any jurisdiction. Have it reviewed by qualified counsel before operating publicly.
This policy describes, at a high level, which data AutoSecure processes and why. It is a template and must be adapted to your actual deployment, hosting region and regulatory obligations.
Data we process
Account data: email, display name, hashed password, session metadata and optional OAuth connections.
Workspace data: organizations, memberships, invitations and audit events.
Business data: licenses, orders, invoices and payment references. Full card data is never stored; it is handled by the payment provider.
Operational data: request IDs, structured logs and health metrics.
Purpose and legal basis
We process data to provide the service, secure accounts, prevent abuse and meet legal obligations.
Where required, processing relies on contract performance, legitimate interest or consent. Confirm the applicable basis for your jurisdiction.
Retention
Account and business records are retained while the account is active and for a defined period afterwards.
Audit logs are retained for integrity and compliance. Sensitive values are redacted; PII is minimised.
Session records are purged after expiry.
Your rights
Subject to applicable law, you may request access, correction, export or deletion of your personal data.
Requests can be sent to privacy@autosecure.io. Identity verification may be required.
Processors and transfers
We use infrastructure and payment processors to operate the service. List your actual sub-processors and hosting regions here.
International transfers must be documented with appropriate safeguards.