Privacy Policy (Draft)

1. Introduction & Scope

[COMPANY LEGAL NAME] ("we", "us", or "our"), having its registered address at [PHYSICAL BUSINESS ADDRESS], operates the ItzBlaze / Blazema marketing operations portal and related services (collectively, the "Platform"). This Privacy Policy explains how we collect, use, process, disclose, and safeguard personal data when you visit our website, submit business inquiries, or access our authenticated client workspaces.

This policy is designed in awareness of applicable data protection legislation, including the Digital Personal Data Protection Act, 2023 (India), the General Data Protection Regulation (EU/UK GDPR), and the California Consumer Privacy Act as amended by the CPRA (CCPA).

2. Personal Data We Collect

We adhere to the principle of data minimisation and collect only information necessary for legitimate operational purposes:

• Public Inquiries: When you submit a campaign scoping or support inquiry via our public forms, we collect your business/brand name, work email address, optional website URL, and described growth goals.
• Account & Workspace Registration: When an account is created, we collect full name, work email address, encrypted authentication credentials (password hashes), and multi-factor authentication (2FA) status.
• Client Deliverables & Communications: Briefs, campaign requests, internal comments, review decisions, and files uploaded to private workspace storage.
• Integration & Reporting Metadata: When you authorize optional integrations (e.g., Google Search Console or Google Analytics 4), we process authorization tokens and aggregated performance metrics per your explicit instruction. OAuth tokens are stored using server-side encryption.
• System & Security Audit Logs: IP address, user agent, timestamps, and action records generated during security-sensitive actions (e.g., logins, role modifications, export requests, file downloads) to ensure accountability and detect security anomalies.

3. Legal Bases for Processing

We process your data under the following legal bases:

• Consent: When you explicitly consent to inquiry communications or non-essential cookies. You may withdraw consent at any time.
• Contract Performance: To deliver agency services, maintain client workspace tenancy, process approved deliverables, and authenticate team members.
• Legitimate Interests & Legal Compliance: To maintain security audit logs, prevent unauthorized access or fraud, comply with regulatory requirements, and protect platform integrity.

4. Cookies & Tracking Technologies

We classify our cookies into the following categories:

• Strictly Necessary: Essential for session management, login security, tenant workspace isolation, and CSRF protection. These cannot be disabled.
• Optional Performance & Analytics: Used to understand site performance and visitor interactions. These are disabled by default and activate only if you explicitly choose to "Accept All" or enable them via our Cookie Settings banner.

You can modify or withdraw your cookie consent at any time by clicking the Cookie Settings link in the website footer.

5. Data Retention & Deletion Schedule

We do not keep personal data longer than necessary for the purposes for which it was collected:

• Security Audit Events: Retained for 3 years to maintain immutable security logs and legal defense records.
• Webhook Receipts: Retained for 90 days for operational debugging and idempotency verification.
• Workspace CSV Exports: Retained in temporary storage for a maximum of 60 minutes and deleted immediately following download.
• Soft-Deleted Deliverables & Files: Retained for 30 days prior to permanent disk purging.
• Public Inquiries: Retained during the scoping lifecycle or removed upon verified deletion request.

6. Third-Party Service Providers

We may share minimal data with trusted third-party processors bound by strict confidentiality and data protection terms:

• Email Delivery Infrastructure: Used to dispatch security notices, inquiry notifications, and workspace invitations (e.g., Amazon SES / Postmark).
• Cloud Hosting & Compute: Secure infrastructure providers operating within ISO 27001 / SOC 2 certified data centers.
• Analytics & Search Integrations: Google APIs (Search Console, GA4) accessed solely when an authorized workspace administrator connects their external account.

7. Your Data Protection Rights

Depending on your jurisdiction, you have specific rights regarding your personal data:

• Right of Access & Portability: You may request confirmation of processing and obtain a machine-readable export of your personal data. Workspace owners can generate this directly via the in-app privacy dashboard.
• Right to Rectification: You may request correction of inaccurate or outdated information.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your account and workspace data, subject to lawful retention requirements.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting past lawful processing.
• Right to Nominate / Grievance Redressal: In accordance with the India DPDP Act 2023, you have the right to register grievances and nominate another individual in the event of death or incapacity.

8. Data Requests & Grievance Redressal Officer

To exercise any of your data rights, submit a deletion or export request, or raise a privacy-related concern, please contact our designated Grievance / Data Protection Representative: