Draft — not for public publication

Omote Privacy Notice

Effective date: [PLACEHOLDER: effective date]

Controller: [PLACEHOLDER: legal entity, registered address, privacy email, and representative/DPO where required]

1. Information we process

For the private product loop, Omote processes your email address, authentication and session records, project documents and metadata, uploaded source files, generated previews, service logs, and account or deletion requests. [PLACEHOLDER: final field inventory and data-classification review.]

2. Why we process it

We process this information to authenticate you, store and reopen your projects, protect the service, respond to requests, and meet legal obligations. [PLACEHOLDER: jurisdiction-specific legal bases and legitimate-interest assessment.]

3. Analytics

Analytics are disabled for the initial milestone. Omote does not intentionally load product analytics or advertising trackers in this release. [PLACEHOLDER: update this section and obtain any required consent before analytics are enabled.]

4. Service providers and transfers

The planned service uses Supabase for authentication and database services and Cloudflare R2 for private object storage. [PLACEHOLDER: final subprocessors, regions, international-transfer safeguards, and links to provider notices.]

5. Retention and deletion

Account controls support project export and deletion. Account deletion removes application data and then the authentication identity, while asynchronous storage cleanup may continue after the request. [PLACEHOLDER: exact retention periods for logs, backups, upload staging, deletion queues, and legal holds.]

6. Security

Omote uses private storage, least-privilege service credentials, access controls, and encrypted network transport. No system can guarantee absolute security. [PLACEHOLDER: incident contact and final security-control summary.]

7. Your rights

[PLACEHOLDER: access, correction, deletion, portability, objection, restriction, withdrawal, complaint rights, identity verification, and jurisdiction-specific disclosures.]

8. Children

[PLACEHOLDER: age threshold and children's privacy position.]

9. Contact and changes

[PLACEHOLDER: privacy contact, regulator details, and notice process for material changes.]