Draft — not yet in effect. This document has not been published yet, so nothing below is currently binding.

Privacy Policy

⚠️ DRAFT — not legal advice. This is an AI-generated starting point for CZ Data Pro's attorney to review, edit, and approve before it is published and relied upon. Bracketed `[…]` items are placeholders to fill in. Privacy law is jurisdiction-specific; have counsel confirm this reflects your actual data practices and legal obligations.

Last updated: [DATE] · Version: DRAFT

1. Who we are

CZ Data Pro ("we," "us") provides the czauth identity service and the applications built on it (the "Services"). This policy explains what personal data we collect, why, and your rights. Questions: [privacy@czdatapro.com].

2. Data we collect

Identity: your email address(es), and name and profile details you provide.
Sign-in methods: which methods you use (email code, magic link, Google, passkey). For Google we receive your basic profile and verified email. For passkeys we store a public key — never a secret. We do not store passwords.
Sessions & devices: session records, and the IP address, approximate location, and device/browser information seen when you sign in.
Consent records: which version of these documents you accepted, and when.
Security/access logs: authentication and administrative events (sign-ins, sign-in failures, registrations, and admin actions) with time, IP, approximate location, method, and result.
App data: information you enter into the applications you use (for example, financial records in a budgeting app), handled under that application's terms and this policy.

3. How we use your data

To create and secure your account; to authenticate you and keep sessions valid; to detect and prevent abuse and fraud; to operate, maintain, and improve the Services; to communicate with you about your account; and to comply with law. We do not sell your personal data.

4. Legal bases

Where required (e.g., GDPR), we rely on: performing our contract with you (providing the Services); your consent (where asked); our legitimate interests (security, preventing abuse); and legal obligations. You can withdraw consent where processing is based on it.

5. Sharing

We share personal data only with: the applications you choose to use; service providers who help us run the Services under confidentiality obligations (for example, Cloudflare for hosting/database, Resend for email, and Google for Google sign-in); and authorities where required by law or to protect rights and safety. Using Google sign-in is also subject to Google's own policies.

6. Retention

We keep your identity data while your account is active and as needed to provide the Services. Security/access logs are kept according to our configured retention setting (currently retained indefinitely unless changed) and may be purged periodically. We may retain some data longer where required by law (for example, record-keeping obligations) and delete data where required by a valid request or by law.

7. Your rights

Depending on your location, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these, contact [privacy@czdatapro.com]; we will respond as required by applicable law. Statutory rights are not overridden by our Terms of Service.

8. Security

We use passwordless authentication (email codes, magic links, and phishing-resistant passkeys), signed session tokens, encryption in transit, and access controls. No system is perfectly secure; help protect your account by keeping your email and devices secure. For email-only accounts, control of your email inbox effectively controls the account.

9. Cookies

We use strictly necessary cookies to keep you signed in and to protect the sign-in flow. We do not use advertising cookies.

10. Children

The Services are not directed to children under [16], and we do not knowingly collect their data.

11. Changes to this policy

We may update this policy. For material changes we will provide notice and, where required, ask you to accept the update before continuing. We record which version you accepted and when.

12. Contact

[privacy@czdatapro.com] · CZ Data Pro, [address].