Scope Vision Privacy Policy

This Privacy Policy ("Policy") is template-grade text self-attested by Scope Vision, Inc. ("Scope Vision," "we," "us," or "our"). It has NOT been reviewed by counsel. It is published in front of closed-beta V1 users under sign-off option (c) — defer with best-effort — as documented in docs/handoff/GATE_5_COMPLIANCE_DECISION.md.

1. What we collect

We collect the following categories of information:

Account information: email address, display name, workspace (tenant) name.
Authentication data: password hashes (bcrypt), magic-link codes (one-time, short-lived), session tokens, request IPs, and user-agent strings for security audit.
Content you upload: photos, videos, documents, notes, and metadata you attach to deals, claims, or jobs.
Deal / claim data: business records you create — addresses, parties, line items, notes, status transitions.
Usage telemetry (server-side only): request paths, response codes, latency — used to keep the Service healthy. We do not run client-side analytics today.

2. How we use it

We use the information we collect to:

Provide, operate, and maintain the Service.
Authenticate users and protect accounts.
Persist your work (deals, claims, photos, notes) so you can return to it.
Diagnose bugs, prevent abuse, and respond to security incidents.
Communicate with you about Service changes, security notices, and account-related matters.

We do not use your data for third-party advertising. We do not sell your data. We do not run any third-party advertising pixels on the Service.

3. Subprocessors

We rely on a small set of trusted subprocessors to operate the Service. The full list — including what data each subprocessor handles and where they process it — is published at /legal/subprocessors.

4. Cookies & tracking

We use a small number of cookies to keep you signed in and to remember your cookie preferences. The full breakdown — what each cookie does, how long it lasts, and whether it's strictly necessary — is published at /legal/cookies.

5. Data residency (US-only)

The Service is operated from the United States only. Your data is stored in US-region data centers (see /legal/subprocessors) and is not transferred to, stored in, or processed from any other jurisdiction. Our data-retention schedule is documented in docs/compliance/data-retention-policy.md.

6. Your rights

You have the right to:

Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Delete your account and the associated data (subject to the retention windows in our Data Retention Policy).
Export your data in a portable format.

To exercise any of these rights, contact us at [email protected]. We respond within thirty (30) days.

7. Breach notification (72-hour timeline)

In the event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users without undue delay and in any case within seventy-two (72) hours of becoming aware of the breach. Notification will include a description of the breach, the likely consequences, and the measures we have taken or propose to take.

8. Children

The Service is not directed to children under the age of sixteen (16). We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us with personal data, please contact us at [email protected] so we can delete it.

9. Changes to this Policy

We may revise this Policy from time to time. When we make a material change, we will notify you by email at least thirty (30) days before the change takes effect. Non-material changes (such as clarifications, typo fixes, or contact-information updates) may be made without advance notice. Your continued use of the Service after the effective date of any change constitutes your acceptance of the revised Policy.

10. Contact

Questions, complaints, or notices regarding this Policy — including data-subject requests and breach reports — should be directed to:

Email: [email protected]
Entity: Scope Vision, Inc. (a Delaware corporation)