StandardWorks

Legal / Privacy Policy

Privacy Policy

Effective [EFFECTIVE DATE] · [COMPANY LEGAL NAME]

Template: to be reviewed by a qualified lawyer and completed with the company’s details (shown in brackets) before use.

This policy explains how [COMPANY LEGAL NAME] ("StandardWorks", "we") handles personal data. For data about your own Account and Organization, we are the controller. For data about a Hosting Business's End Customers, the Hosting Business is the controller and we process it on its behalf under the Data Processing Addendum.

What we collect

  • Account data: your name, email address, a one-way hash of your password, and, if you turn on two-factor sign-in, an encrypted authenticator secret and hashed recovery codes.
  • Organization data: organization names, team members and their roles, provider application details (legal name and contact email), and payout details (a PayPal email or a connected Stripe account identifier).
  • Infrastructure data: for each connected server, its hostname, operating system, kernel, CPU model and core count, memory, disk size, virtualization support, and live metrics (CPU, memory and disk use, load).
  • Service data: service configuration, generated credentials (stored encrypted), operation history, and log output you request from the dashboard, which is kept with that operation's record.
  • Billing data: invoices, payments, refunds, chargebacks, wallet ledger entries and payouts. Card details are entered on Stripe's or PayPal's pages and are never received or stored by StandardWorks.
  • Storefront data (processed for Hosting Businesses): End Customer names, email addresses, password hashes, orders, subscriptions and invoices.
  • Email records: for each email we send, the recipient, subject, type and delivery status. Email bodies are kept only until delivery is complete.
  • Audit log: actions taken in Organizations, with the acting person's email address and time.
  • Security data: IP addresses are used to rate-limit sign-in and sign-up attempts. They are held in memory for up to an hour and are not written to our database.

Why we use it

  • To provide StandardWorks: run your Services, back them up, bill and pay correctly, and show you your data. Legal basis: performance of our contract with you.
  • To keep StandardWorks secure and prevent abuse and fraud. Legal basis: our legitimate interests, and legal obligations.
  • To keep financial records. Legal basis: legal obligation.
  • To send service emails (password resets, receipts, invoices, payment-due and suspension notices, security notices). We don't send marketing email without consent.

Who we share it with

  • Stripe and PayPal, to take payments, issue refunds and send payouts.
  • Our email delivery provider [EMAIL PROVIDER], to deliver service emails.
  • The S3-compatible storage provider your Organization chooses, for offsite backups. You configure this and its terms apply.
  • Network Providers, if you rent capacity: your Services run on their hardware. They can't see or control them through StandardWorks, but they operate the machines.
  • Google Fonts: our pages load fonts from Google, which receives your IP address and browser details when a page loads. [DECISION: self-host fonts to remove this transfer.]
  • Our hosting provider [CONTROL PLANE HOSTING PROVIDER].
  • Authorities, where the law requires it.

We don't sell personal data.

International transfers

[TRANSFER MECHANISM: for example, Standard Contractual Clauses, and the countries involved.]

How long we keep it

  • Account and Organization data: while the account is active, then [ACCOUNT RETENTION PERIOD].
  • Archives of released Services: 30 days, unless a legal hold applies.
  • Backups: according to each Service's retention setting.
  • Financial records (ledger, invoices, payouts): for as long as tax and accounting law requires, [FINANCIAL RETENTION PERIOD]. The ledger is append-only and can't be edited.
  • Audit log and email records: [LOG RETENTION PERIOD].

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to complain to a data protection authority. Most data can be viewed and exported from the dashboard. For anything else, contact [PRIVACY CONTACT EMAIL]. End Customers of a Hosting Business should contact that business first.

Security

Two-factor sign-in (required for platform operators); secrets, credentials and task payloads encrypted at rest; password hashing with scrypt; tokens stored only as hashes; strict content-security policies; automated cross-tenant access testing; an append-only financial ledger.

Cookies

See the Cookie Notice.

Children

StandardWorks isn't directed at children under 16, and we don't knowingly collect their data.

Changes and contact

We'll post updates here and notify you of material changes. Contact: [PRIVACY CONTACT EMAIL], [COMPANY LEGAL NAME], [REGISTERED ADDRESS].