Legal
Privacy Policy
Draft for completion — not yet a published legal document
The factual descriptions of what we collect and why are accurate to how the platform is built. Everything marked [OPERATOR TO COMPLETE] is a legal fact — an entity name, an address, a lawful basis, a retention period, a supervisory authority — that we will not invent. This document must be completed and reviewed by a qualified lawyer before it is relied on. No claim of compliance with any particular data-protection regime is made here.
1. Who this policy is about
This policy describes how [OPERATOR TO COMPLETE: full legal entity name] of [OPERATOR TO COMPLETE: registered address] ("we", "us") handles personal data about our customers — the people and organisations who buy and operate a deployment — and about visitors to investmentcms.com.
It is not the privacy policy your members read. That is the policy you publish on your own platform, and writing it is your responsibility.
2. The important distinction: your data and your members' data
Two quite different bodies of data exist, and confusing them is the most common mistake in this area.
| Your customer data | Your members' data | |
|---|---|---|
| Where it lives | Our control-plane database. | The dedicated database created for your deployment, and nowhere else. |
| Who decides what happens to it | We do, as described in this policy. | You do. You choose what your platform collects, what it does with it, and what you tell your members. |
| Our role | We are responsible for it. | We provision and operate the infrastructure it sits on, on your instruction. |
| Who answers a member's request about it | — | You do. We have no relationship with your members and cannot answer for you. |
The formal characterisation of these roles under any particular data-protection law, and whether a separate data processing agreement is required between us, is [OPERATOR TO COMPLETE: confirm with counsel for each jurisdiction where customers or their members are located].
We do not read your members' records, mine them, aggregate them, sell them, or use them to train anything. We access your deployment's resources only where necessary to provision, operate, secure, repair or delete them, or where required by law.
3. What we collect about you
| Category | What it is | Where it comes from |
|---|---|---|
| Account | Your email address, an optional name, and a cryptographic hash of your password. We never store the password itself. | You, at registration or checkout. |
| Sessions | An opaque session token, stored only as a hash, with its expiry. | Created when you sign in. |
| Verification and reset tokens | Short-lived tokens for email verification and password reset. | Generated when you request them. |
| Orders and invoices | Order code, what was bought, the amount in US dollars, the status, timestamps, and the payment provider's invoice and payment identifiers and reported status. | You, and our payment provider. |
| Deployment details | The subdomain and site name you chose, the administrator email you set for your site, and the identifiers of the resources created for you. The administrator password you set is used to create your site's account and the field carrying it is cleared when provisioning completes. | You, at checkout. |
| Custom domain | Any domain you ask us to attach, and its status. | You, in the panel. |
| Payment notifications | The raw notifications our payment provider sends us about your payments, kept as an append-only record. | Our payment provider. |
| Email records | A log of which notices we sent you and when, an idempotency key so you are not emailed twice, and a suppression list if you unsubscribe or an address bounces. | Generated by us. |
| Security and operations | IP addresses and request metadata associated with sign-in attempts, rate-limit counters, security events, provisioning logs, and an audit record of administrative actions. | Generated by us as you use the Service. |
4. What we do not collect
- No card details. There are no cards in this service at all. Payment is in cryptocurrency through our provider's hosted checkout.
- No wallet keys, seed phrases or private keys. Ever. We would have no use for them and no way to protect them.
- No identity documents from you. The identity-verification tooling in the product is for your members and runs on your deployment, under your provider account.
- No behavioural tracking on this website. No analytics, no advertising, no third-party scripts, no third-party fonts, no tracking pixels and no cross-site identifiers. This site loads nothing from any other host.
- No purchase or use of data from data brokers, and no enrichment of your record from third-party sources.
5. Why we process it
- To provide the Service: to create and hold your account, to provision your deployment, to run it, and to give you a customer panel.
- To bill you: to issue invoices, to take and verify payment, and to keep the records that show what was paid.
- To communicate about your account: invoice, reminder, suspension, cancellation and deletion notices, plus replies to your support requests. These are service messages, not marketing.
- To secure the Service: to rate-limit sign-in attempts, to detect and investigate abuse, and to keep an audit trail of administrative actions.
- To meet legal and accounting obligations.
The lawful basis for each purpose above is [OPERATOR TO COMPLETE: state the lawful basis per purpose under the applicable regime(s), with counsel].
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
6. Who else processes it
| Provider | What they do | What reaches them |
|---|---|---|
| Cloudflare | Hosts the platform and every deployment — compute, database, file storage, session storage — and delivers our outbound email. | Everything held by the Service, including the contents of your deployment. |
| NOWPayments | Processes your payments to us. | The order identifier and the amount. Payment is made on their hosted checkout, so what you enter there is governed by their policy. |
Those are the only two. There is no analytics provider, no advertising network, no customer-data platform, no chat widget and no email-marketing platform in this picture.
We may also disclose data where we are legally required to, where necessary to establish or defend a legal claim, or to a successor in a merger or sale of assets, on notice to you.
The current list of sub-processors, and how changes to it are notified, is [OPERATOR TO COMPLETE: publish a sub-processor list and a change-notification commitment if required by the applicable regime].
7. How long we keep it
- Sessions: up to 30 days, and destroyed when you sign out.
- Verification and reset tokens: short-lived, and invalidated once used.
- Your deployment's contents: for as long as your deployment exists. If it reaches 180 days past due it is permanently and irreversibly destroyed, along with its database, storage, session store, workers and subdomain — see the lifecycle.
- Billing, order and audit records: retained after a deployment is deleted, for accounting and legal purposes, for [OPERATOR TO COMPLETE: retention period, per the applicable statutory requirement].
- Security and email logs: [OPERATOR TO COMPLETE: retention period].
8. Cookies and this website
The public pages of investmentcms.com — this one included — set no cookies at all and load no resources from any other host. There are no fonts, scripts, images or beacons from a third party anywhere on this site.
When you sign in to your customer panel, a single essential cookie carries your session so the panel knows who you are. It is not used for tracking, it is not shared, and it expires. There is no non-essential cookie to consent to, which is why this site shows no cookie banner.
Your own deployment is separate: what it sets, and whether it shows a consent banner, is configured by you.
9. How we protect it
- Passwords are stored as salted PBKDF2-SHA256 hashes with a high iteration count, never in plain text and never in a recoverable form.
- Session tokens are random values stored only as hashes, so the stored form cannot be replayed.
- Provider API keys are held as secrets, shown masked in the operator interface, never echoed back, and redacted from exports.
- Sign-in and other sensitive endpoints are rate-limited on two independent budgets — per IP address and per account — and money-related paths fail closed rather than open when the limiter is unavailable.
- Payment notifications are signature-verified in constant time, then independently re-checked against the provider's API, and cross-checked against our own stored order before anything is acted on.
- Each deployment is isolated by construction: its own database, storage and session store, bound to its own workers. There is no shared table separating one customer from another by a column value.
- Administrative actions are written to an audit trail.
We do not claim any certification, and we have not commissioned a published security audit or penetration test. If we ever do, we will say so here with the report date — and not before.
10. Your rights
Depending on where you are, you may have rights to access, correct, delete, restrict or object to the processing of your personal data, to portability, and to complain to a supervisory authority.
The precise rights that apply to you, how to exercise them, our response time, any verification step, and the identity of the relevant supervisory authority are [OPERATOR TO COMPLETE: enumerate per applicable regime, with counsel, and state the response deadline actually offered].
Practically: you can change your account details and your password in the customer panel, you can unsubscribe from non-essential email, and you can ask us about your data using the contact below. Note that service notices about invoices, suspension and deletion cannot be unsubscribed from while you hold a deployment, because they are how the lifecycle is communicated to you.
11. International transfers
The Service runs on globally distributed infrastructure, so data may be processed outside the country where you are located. The transfer mechanism relied on, and the safeguards in place, are [OPERATOR TO COMPLETE: state the transfer mechanism and safeguards with counsel].
12. Changes and contact
If we change this policy we will post the new version here and, for a material change, email your account address [OPERATOR TO COMPLETE: notice period] beforehand.
For any privacy question or request, contact [OPERATOR TO COMPLETE: privacy contact email address]. If a data protection officer or representative has been appointed, their details are [OPERATOR TO COMPLETE: DPO / representative details, if applicable].