Privacy Policy

Draft notice: This template is not legal advice. The Provider must verify every data flow, retention period, processor, transfer, and legal basis; complete the bracketed fields; and obtain qualified privacy/legal review for each applicable jurisdiction.

Effective date: [DATE]   Controller / business: [LEGAL ENTITY NAME], [ADDRESS], [JURISDICTION]. Privacy contact: [PRIVACY EMAIL / DATA PROTECTION OFFICER CONTACT].

1. Scope and responsibility

This policy covers personal information processed through the Darax IoT public website, account sign-in, IoT dashboard, and related support. The Provider's legal entity and contact details must be completed above. For customer telemetry uploaded by a workspace, the customer may determine why individuals' data is collected; the Provider may process it to provide the Service under the applicable customer agreement. Define the parties' roles and processing terms in a signed data-processing agreement where required.

2. Information processed

• Account and identity: name, email, phone number if supplied, identity-provider subject and role/workspace claims, and account status.
• Workspace and service data: workspace name, branding settings, verified custom-domain and DNS verification status, device identifiers, names, types, locations, telemetry, commands, acknowledgements, and activity records submitted through the Service.
• Billing records: plan, payment reference, buyer-submitted billing country, pre-tax subtotal, VAT rate and amount where applicable, tax-inclusive amount, currency, status, and provider transaction identifier. Payment details are handled by the selected payment provider; verify exactly what the Provider receives and stores before publishing this statement.
• Support and communications: information included in support requests and operational notices.
• Technical data: request and security logs, IP address, browser/device information, and timestamps to the extent collected by the app, hosting provider, reverse proxy, identity provider, or security systems. Document actual log fields and retention here: [COMPLETE].

3. Purposes and legal bases

Information may be used to authenticate users, provide tenant-scoped device operations, store telemetry, deliver commands and configured notifications, administer subscriptions and verify payments, secure and troubleshoot the Service, respond to support requests, and comply with legal obligations. Specify the legal basis for each purpose under the laws that apply to the Provider and user: [COMPLETE JURISDICTION-SPECIFIC LEGAL BASES]. Do not use customer telemetry or personal information for unrelated advertising.

4. Cookies and local storage

The site uses an essential Flask session cookie for security/session state and authenticated sign-in. It cannot be disabled while using sign-in and protected features; blocking it may prevent those features from working. The cookie notice offers "Essential only" and "Allow optional cookies." At present, this project does not configure analytics or advertising cookies. The choice is saved in browser local storage; it does not create an additional consent cookie, and is not evidence that an optional tracking tool is active. If optional cookies or trackers are added later, describe each tool, purpose, duration, and provider here and ensure the choice actually blocks them until consent where required. Users can revisit "Cookie settings" in the site footer. Browser settings can also clear or block storage, subject to service functionality.

5. Sharing and service providers

Information may be shared with infrastructure and database operators, Keycloak or another configured identity provider, email/SMS/push providers when enabled, and Paystack or Flutterwave when a payment is initiated, as well as professional advisers or authorities where legally required. The website also loads some resources from third-party CDNs/font providers and may load externally hosted images; those providers may receive technical request data such as IP address. Verify the exact production configuration, providers, locations, contracts, and any international transfers before publishing: [LIST PROVIDERS, COUNTRIES, AND SAFEGUARDS]. We do not sell personal information for advertising based on the current project design.

6. Retention and deletion

Account, payment, activity, device, and telemetry records may be retained while a workspace is active and as needed for service, security, accounting, or legal purposes. The application has plan-based telemetry-retention settings, but actual automated deletion and backup retention must be confirmed before making a specific promise. Complete actual retention periods, backup schedules, deletion triggers, and post-termination export/deletion process here: [COMPLETE]. Workspace admins should not submit data longer than needed for their purposes.

7. Security

The project uses tenant-scoped application records, authenticated access, and protected device credentials. No internet-connected service can guarantee absolute security. The operator must maintain access controls, secure deployment and backups, patch dependencies, protect secrets, restrict server access, and maintain an incident response process. Complete any commitments and breach notification timelines required by law or contract: [COMPLETE].

8. Individual rights and choices

Depending on applicable law, individuals may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal information, and to withdraw consent where processing relies on consent. Explain how to submit requests, identity verification, response timelines, complaint authority, and appeal process here: [PRIVACY CONTACT AND JURISDICTION-SPECIFIC RIGHTS]. A workspace user should also contact their workspace administrator about data controlled by their organization.

9. Children and sensitive data

The Service is intended for business and operational use, not for children. Do not submit sensitive personal information unless explicitly agreed and protected under a suitable written agreement. Add age restrictions and jurisdiction-specific requirements after legal review: [COMPLETE].

10. International transfers

Service providers may process information in countries other than the user's country. List actual processing locations and the safeguards used for each transfer: [COMPLETE].

11. Updates and contact

We may update this policy and will publish the new effective date and any notice required by law. Contact [PRIVACY EMAIL / ADDRESS] for privacy requests. This draft must not be treated as final until all placeholders and operational facts have been reviewed.