diff --git a/frontend/templates/privacy.html b/frontend/templates/privacy.html index de0d5130..e394b49a 100644 --- a/frontend/templates/privacy.html +++ b/frontend/templates/privacy.html @@ -1,388 +1,316 @@ {% extends "base.html" %} -{% block title %}Privacy Notice - DocuElevate{% endblock %} +{% block title %}{{ _("privacy.page_title") }}{% endblock %} {% block content %}
-

DocuElevate – Privacy Notice

-

Last Updated: {{ build_date|default(current_date|default('April 7, 2024')) }}

+

{{ _("privacy.heading") }}

+

{{ _("privacy.last_updated") }} {{ build_date|default(current_date|default('April 7, 2024')) }}

-

Contents

+

{{ _("privacy.toc_heading") }}

    -
  1. Data Controller
    2. -
  2. Scope of this Privacy Notice
    3. -
  3. Data Collection & Purposes
    4. -
  4. Data Minimization & Purpose Limitation
    5. -
  5. Use of Cookies & Similar Technologies
    6. -
  6. Third-Party Services
    7. -
  7. International Data Transfers
    8. -
  8. Data Retention
    9. -
  9. Data Security
    10. -
  10. Your Rights (EU / EEA / UK / Switzerland)
    11. -
  11. Additional Rights – United States (CCPA/CPRA)
    12. -
  12. Additional Rights – Canada (PIPEDA / Law 25)
    13. -
  13. Additional Rights – Latin America (LGPD & others)
    14. -
  14. Additional Rights – Asia-Pacific & Japan
    15. -
  15. Additional Rights – Ukraine
    16. -
  16. Updates to this Privacy Notice
    17. +
  17. {{ _("privacy.toc_1") }}
    18. +
  18. {{ _("privacy.toc_2") }}
    19. +
  19. {{ _("privacy.toc_3") }}
    20. +
  20. {{ _("privacy.toc_4") }}
    21. +
  21. {{ _("privacy.toc_5") }}
    22. +
  22. {{ _("privacy.toc_6") }}
    23. +
  23. {{ _("privacy.toc_7") }}
    24. +
  24. {{ _("privacy.toc_8") }}
    25. +
  25. {{ _("privacy.toc_9") }}
    26. +
  26. {{ _("privacy.toc_10") }}
    27. +
  27. {{ _("privacy.toc_11") }}
    28. +
  28. {{ _("privacy.toc_12") }}
    29. +
  29. {{ _("privacy.toc_13") }}
    30. +
  30. {{ _("privacy.toc_14") }}
    31. +
  31. {{ _("privacy.toc_15") }}
    32. +
  32. {{ _("privacy.toc_16") }}
-

1. Data Controller

+

{{ _("privacy.s1_heading") }}

- The controller responsible for processing your personal data under the EU General Data Protection Regulation (GDPR) and equivalent privacy laws worldwide is: + {{ _("privacy.s1_p1") }}

- Christian Louis IT Beratung
- Alter Steinweg 3, 20459 Hamburg, Germany + {{ _("privacy.s1_company") }}
+ {{ _("privacy.s1_address") }}

- Contact Email: docuelevate@christian-louis.de + {{ _("privacy.s1_contact_label") }} docuelevate@christian-louis.de

- For all privacy-related requests (access, deletion, rectification, opt-out, or complaints), please contact us at the email address above. - We will respond within 30 days (or the period prescribed by applicable law). + {{ _("privacy.s1_p3") }}

-

2. Scope of this Privacy Notice

+

{{ _("privacy.s2_heading") }}

- This notice applies to the DocuElevate web application, hosted at + {{ _("privacy.s2_p1_pre") }} {{ request.url.scheme }}://{{ request.url.netloc }}/.

- It covers all users globally, including those in the European Union (EU), European Economic Area (EEA), - Germany, United Kingdom (UK), Switzerland, Ukraine, United States (US), Canada, Latin America (Latam), - Asia-Pacific, and Japan. Market-specific disclosures are provided in dedicated sections below. + {{ _("privacy.s2_p2") }}

-

3. Data Collection & Purposes

+

{{ _("privacy.s3_heading") }}

- User Authentication: We use OAuth 2.0 (Google, Dropbox, Microsoft/OneDrive) and optional - local authentication. Through OAuth, we may receive your name, email address, and profile picture. + {{ _("privacy.s3_auth_label") }} {{ _("privacy.s3_auth_body") }}

- Document Processing: Documents you upload are processed for OCR (optical character recognition), - metadata extraction, and storage to your chosen cloud provider. Document content is processed only for the - purpose you initiate and is not stored beyond what is operationally necessary. + {{ _("privacy.s3_doc_label") }} {{ _("privacy.s3_doc_body") }}

- Audit Logs: We maintain limited audit logs (action type, timestamp, user identifier) to - ensure service integrity and security. These logs do not include document content. + {{ _("privacy.s3_audit_label") }} {{ _("privacy.s3_audit_body") }}

- Legal Basis (GDPR Art. 6): Our primary legal bases for processing are: + {{ _("privacy.s3_legal_label") }} {{ _("privacy.s3_legal_body") }}

-

4. Data Minimization & Purpose Limitation

+

{{ _("privacy.s4_heading") }}

- DocuElevate is designed with data minimization as a core principle (GDPR Art. 5(1)(c)): + {{ _("privacy.s4_p1") }}

-

5. Use of Cookies & Similar Technologies

+

{{ _("privacy.s5_heading") }}

- DocuElevate uses only strictly necessary session cookies to maintain your authenticated - session. These cookies are essential for the service to function and are exempt from prior-consent - requirements under the EU ePrivacy Directive (Art. 5(3)) and equivalent national laws. + {{ _("privacy.s5_p1_pre") }} {{ _("privacy.s5_p1_strong") }} {{ _("privacy.s5_p1_post") }}

- We do not use: analytics cookies, advertising cookies, tracking pixels, or any - third-party cookies that would require your consent. + {{ _("privacy.s5_p2_label") }} {{ _("privacy.s5_p2_body") }}

- For full details on the cookies we set, their names, duration, and purpose, please visit our - Cookie Policy. + {{ _("privacy.s5_p3_pre") }} + {{ _("privacy.s5_cookie_link") }}.

-

6. Third-Party Services

+

{{ _("privacy.s6_heading") }}

- OAuth Providers (Google, Dropbox, Microsoft): When you choose to authenticate via - OAuth, the respective provider processes your credentials and may share limited profile information - with us. These providers maintain their own privacy policies. + {{ _("privacy.s6_oauth_label") }} {{ _("privacy.s6_oauth_body") }}

- Cloud Storage Providers (Google Drive, Dropbox, OneDrive, Amazon S3, Nextcloud, WebDAV/SFTP/FTP): - Documents are stored in the cloud provider you configure. Your configured credentials are stored - encrypted in the application database and are used solely to perform the storage operations you request. + {{ _("privacy.s6_storage_label") }} + {{ _("privacy.s6_storage_body") }}

- AI Processing Services (OpenAI, Azure Document Intelligence, others): When you initiate - OCR or AI-based metadata extraction, document data is transmitted to the AI service you or your - administrator has configured. This transmission is governed by a data processing agreement with the - respective provider. + {{ _("privacy.s6_ai_label") }} {{ _("privacy.s6_ai_body") }}

- No Sale or Sharing for Advertising: We do not sell, rent, or share your personal data - with third parties for advertising, marketing, or any purpose unrelated to providing the service. + {{ _("privacy.s6_no_sale_label") }} {{ _("privacy.s6_no_sale_body") }}

-

7. International Data Transfers

+

{{ _("privacy.s7_heading") }}

- DocuElevate is hosted in the European Union / EEA by default. Where personal data is transferred - outside the EEA (for example to US-based AI service providers such as OpenAI), we rely on - appropriate safeguards including: + {{ _("privacy.s7_p1") }}

- You may request a copy of the relevant safeguards by contacting us at + {{ _("privacy.s7_contact") }} docuelevate@christian-louis.de.

-

8. Data Retention

+

{{ _("privacy.s8_heading") }}

- We retain personal data only as long as strictly necessary to provide the DocuElevate service or to - comply with legal obligations: + {{ _("privacy.s8_p1") }}

- To request deletion of your account and all associated personal data, please contact us at + {{ _("privacy.s8_contact") }} docuelevate@christian-louis.de.

-

9. Data Security

+

{{ _("privacy.s9_heading") }}

- We implement appropriate technical and organisational measures (TOMs) to protect your personal data, - including: + {{ _("privacy.s9_p1") }}

-

10. Your Rights (EU / EEA / UK / Switzerland)

+

{{ _("privacy.s10_heading") }}

- Under GDPR (and the UK GDPR / Swiss nFADP equivalent), you have the following rights: + {{ _("privacy.s10_p1") }}

- To exercise any of the above rights, contact us at + {{ _("privacy.s10_contact") }} docuelevate@christian-louis.de. - We will respond within one calendar month (extendable by two further months for complex requests). + {{ _("privacy.s10_response") }}

-

11. Additional Rights – United States (CCPA / CPRA)

+

{{ _("privacy.s11_heading") }}

- If you are a resident of California or another US state with applicable privacy legislation - (including Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA), the following additional - disclosures apply: + {{ _("privacy.s11_p1") }}

- To submit a verifiable consumer request, contact us at + {{ _("privacy.s11_contact") }} docuelevate@christian-louis.de. - We will respond within 45 days (extendable by an additional 45 days when reasonably necessary). + {{ _("privacy.s11_response") }}

-

12. Additional Rights – Canada (PIPEDA / Québec Law 25)

+

{{ _("privacy.s12_heading") }}

- If you are located in Canada, the following applies under the Personal Information Protection and - Electronic Documents Act (PIPEDA) and applicable provincial legislation (including Québec Law 25 / - Bill 64): + {{ _("privacy.s12_p1") }}

- Direct privacy complaints to our Privacy Officer at - docuelevate@christian-louis.de, - or to the Office of the Privacy Commissioner of Canada. + {{ _("privacy.s12_contact") }} + docuelevate@christian-louis.de{{ _("privacy.s12_contact_post") }}

-

13. Additional Rights – Latin America (LGPD & Others)

+

{{ _("privacy.s13_heading") }}

- Brazil (LGPD – Lei Geral de Proteção de Dados, Law 13.709/2018): - If you are located in Brazil, you have the following rights under the LGPD: + {{ _("privacy.s13_brazil_label") }} + {{ _("privacy.s13_brazil_body") }}

- Other Latin American Countries: We also recognise applicable privacy laws in Argentina - (PDPA), Mexico (LFPDPPP), Chile, Colombia (Ley 1581), and others. Users in these jurisdictions may - exercise equivalent rights as outlined under their national law by contacting us. + {{ _("privacy.s13_other_label") }} {{ _("privacy.s13_other_body") }}

- Contact: + {{ _("privacy.s13_contact") }} docuelevate@christian-louis.de

-

14. Additional Rights – Asia-Pacific & Japan

+

{{ _("privacy.s14_heading") }}

- Japan (APPI – Act on the Protection of Personal Information): - Japanese residents may request disclosure, correction, addition or deletion, suspension of use, - erasure, or suspension of third-party provision of their personal information held by us. - Third-party disclosures require your prior consent except where permitted by law. + {{ _("privacy.s14_japan_label") }} + {{ _("privacy.s14_japan_body") }}

- Australia (Privacy Act 1988 and Australian Privacy Principles): - Australian residents may request access to and correction of their personal information. - We will respond to access requests within 30 days. Complaints may be lodged with the - Office of the Australian Information Commissioner (OAIC). + {{ _("privacy.s14_australia_label") }} + {{ _("privacy.s14_australia_body") }}

- South Korea (PIPA – Personal Information Protection Act): - Korean residents may request access, correction, deletion, and suspension of processing. - We handle personal information of Korean residents in accordance with the PIPA. + {{ _("privacy.s14_korea_label") }} + {{ _("privacy.s14_korea_body") }}

- Other APJ markets (Singapore PDPA, New Zealand Privacy Act, India DPDP Act): - We recognise the data protection rights afforded to residents of these jurisdictions under their - respective national laws. Contact us to exercise your rights. + {{ _("privacy.s14_apj_label") }} + {{ _("privacy.s14_apj_body") }}

- Contact: + {{ _("privacy.s14_contact") }} docuelevate@christian-louis.de

-

15. Additional Rights – Ukraine

+

{{ _("privacy.s15_heading") }}

- Users located in Ukraine are protected under the Law of Ukraine "On Personal Data Protection" - (No. 2297-VI). Your rights include access to, correction, blocking, and deletion of your personal - data, as well as the right to object to processing. + {{ _("privacy.s15_p1") }}

- Contact: + {{ _("privacy.s15_contact") }} docuelevate@christian-louis.de

-

16. Updates to this Privacy Notice

+

{{ _("privacy.s16_heading") }}

- We may update this notice from time to time to reflect changes in our practices or applicable laws. - The "Last Updated" date at the top of this page indicates when the notice was last revised. - Where changes are material, we will notify users via in-application notification or email where - appropriate. + {{ _("privacy.s16_p1") }}

- If you have any questions or concerns about this Privacy Notice or your personal data, please - contact us at + {{ _("privacy.s16_p2_pre") }} docuelevate@christian-louis.de.

- Please also review our Terms of Service, - Cookie Policy, and - License Information. + {{ _("privacy.s16_p3_pre") }} {{ _("privacy.s16_terms_link") }}, + {{ _("privacy.s16_cookies_link") }}, + and {{ _("privacy.s16_license_link") }}.

diff --git a/frontend/translations/en.json b/frontend/translations/en.json index 5fbefa1f..5abbc415 100644 --- a/frontend/translations/en.json +++ b/frontend/translations/en.json @@ -828,6 +828,185 @@ "pipelines.system_label": "System", "pipelines.system_pipeline_label": "System pipeline (visible to all users)", "pipelines.title": "Processing Pipelines", + "privacy.heading": "DocuElevate – Privacy Notice", + "privacy.last_updated": "Last Updated:", + "privacy.page_title": "Privacy Notice - DocuElevate", + "privacy.s10_access_body": "You may request a copy of the personal data we hold about you.", + "privacy.s10_access_label": "Right of Access (Art. 15):", + "privacy.s10_complaint_body": "You have the right to lodge a complaint with your national Data Protection Authority (DPA). In Germany: Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI). In the UK: Information Commissioner's Office (ICO). In Switzerland: Federal Data Protection and Information Commissioner (FDPIC).", + "privacy.s10_complaint_label": "Right to Lodge a Complaint:", + "privacy.s10_contact": "To exercise any of the above rights, contact us at", + "privacy.s10_erasure_body": "You may request deletion of your personal data where there is no overriding legitimate reason for us to retain it.", + "privacy.s10_erasure_label": "Right to Erasure (Art. 17):", + "privacy.s10_heading": "10. Your Rights (EU / EEA / UK / Switzerland)", + "privacy.s10_object_body": "You may object to processing based on legitimate interests at any time.", + "privacy.s10_object_label": "Right to Object (Art. 21):", + "privacy.s10_p1": "Under GDPR (and the UK GDPR / Swiss nFADP equivalent), you have the following rights:", + "privacy.s10_portability_body": "You may request your data in a structured, commonly used, machine-readable format.", + "privacy.s10_portability_label": "Right to Data Portability (Art. 20):", + "privacy.s10_rectification_body": "You may request correction of inaccurate or incomplete personal data.", + "privacy.s10_rectification_label": "Right to Rectification (Art. 16):", + "privacy.s10_response": "We will respond within one calendar month (extendable by two further months for complex requests).", + "privacy.s10_restriction_body": "You may request that we temporarily halt processing of your data in certain circumstances.", + "privacy.s10_restriction_label": "Right to Restriction (Art. 18):", + "privacy.s10_withdraw_body": "Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.", + "privacy.s10_withdraw_label": "Right to Withdraw Consent:", + "privacy.s11_categories_body": "Identifiers (name, email), account authentication tokens, and document metadata that you choose to upload.", + "privacy.s11_categories_label": "Categories of personal information collected:", + "privacy.s11_contact": "To submit a verifiable consumer request, contact us at", + "privacy.s11_correct_body": "You may request correction of inaccurate personal information.", + "privacy.s11_correct_label": "Right to Correct:", + "privacy.s11_delete_body": "You may request deletion of personal information we have collected, subject to certain exceptions.", + "privacy.s11_delete_label": "Right to Delete:", + "privacy.s11_heading": "11. Additional Rights – United States (CCPA / CPRA)", + "privacy.s11_know_body": "You may request disclosure of the categories and specific pieces of personal information we have collected about you.", + "privacy.s11_know_label": "Right to Know:", + "privacy.s11_limit_body": "We do not use sensitive personal information beyond what is necessary to provide the service.", + "privacy.s11_limit_label": "Right to Limit Use of Sensitive Personal Information:", + "privacy.s11_nondiscrim_body": "We will not discriminate against you for exercising any of these rights.", + "privacy.s11_nondiscrim_label": "Non-Discrimination:", + "privacy.s11_optout_body": "We do not sell or share personal information as defined by CCPA/CPRA. No opt-out mechanism is required; however, you may contact us to confirm this.", + "privacy.s11_optout_label": "Right to Opt Out of Sale / Sharing:", + "privacy.s11_p1": "If you are a resident of California or another US state with applicable privacy legislation (including Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA), the following additional disclosures apply:", + "privacy.s11_purpose_body": "Providing, improving, and securing the DocuElevate service. We do not sell or share personal information for cross-context behavioural advertising.", + "privacy.s11_purpose_label": "Purpose of collection:", + "privacy.s11_response": "We will respond within 45 days (extendable by an additional 45 days when reasonably necessary).", + "privacy.s12_access_body": "You may request access to your personal information and information about how it has been used or disclosed.", + "privacy.s12_access_label": "Right of Access:", + "privacy.s12_contact": "Direct privacy complaints to our Privacy Officer at", + "privacy.s12_contact_post": ", or to the Office of the Privacy Commissioner of Canada.", + "privacy.s12_correction_body": "You may challenge the accuracy or completeness of your personal information and request correction.", + "privacy.s12_correction_label": "Right to Correction:", + "privacy.s12_heading": "12. Additional Rights – Canada (PIPEDA / Québec Law 25)", + "privacy.s12_li1": "We collect, use, and disclose personal information only with your knowledge and consent, or as permitted by law.", + "privacy.s12_p1": "If you are located in Canada, the following applies under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation (including Québec Law 25 / Bill 64):", + "privacy.s12_quebec_body": "Under Law 25, you have additional rights including the right to data portability (effective September 2023) and the right to de-indexation where personal information is disseminated online.", + "privacy.s12_quebec_label": "Québec residents:", + "privacy.s12_withdraw_body": "Subject to legal or contractual restrictions, you may withdraw consent to the collection, use, or disclosure of your personal information on reasonable notice.", + "privacy.s12_withdraw_label": "Right to Withdraw Consent:", + "privacy.s13_brazil_body": "If you are located in Brazil, you have the following rights under the LGPD:", + "privacy.s13_brazil_label": "Brazil (LGPD – Lei Geral de Proteção de Dados, Law 13.709/2018):", + "privacy.s13_contact": "Contact:", + "privacy.s13_heading": "13. Additional Rights – Latin America (LGPD & Others)", + "privacy.s13_li1": "Confirmation of the existence of processing and access to your data.", + "privacy.s13_li2": "Correction of incomplete, inaccurate, or outdated data.", + "privacy.s13_li3": "Anonymisation, blocking, or deletion of unnecessary or excessive data.", + "privacy.s13_li4": "Portability of your data to another service or product provider.", + "privacy.s13_li5": "Deletion of personal data processed with your consent.", + "privacy.s13_li6": "Information about entities with which your data has been shared.", + "privacy.s13_li7": "Information about the possibility of not consenting and the consequences of refusal.", + "privacy.s13_li8": "Revocation of consent.", + "privacy.s13_other_body": "We also recognise applicable privacy laws in Argentina (PDPA), Mexico (LFPDPPP), Chile, Colombia (Ley 1581), and others. Users in these jurisdictions may exercise equivalent rights as outlined under their national law by contacting us.", + "privacy.s13_other_label": "Other Latin American Countries:", + "privacy.s14_apj_body": "We recognise the data protection rights afforded to residents of these jurisdictions under their respective national laws. Contact us to exercise your rights.", + "privacy.s14_apj_label": "Other APJ markets (Singapore PDPA, New Zealand Privacy Act, India DPDP Act):", + "privacy.s14_australia_body": "Australian residents may request access to and correction of their personal information. We will respond to access requests within 30 days. Complaints may be lodged with the Office of the Australian Information Commissioner (OAIC).", + "privacy.s14_australia_label": "Australia (Privacy Act 1988 and Australian Privacy Principles):", + "privacy.s14_contact": "Contact:", + "privacy.s14_heading": "14. Additional Rights – Asia-Pacific & Japan", + "privacy.s14_japan_body": "Japanese residents may request disclosure, correction, addition or deletion, suspension of use, erasure, or suspension of third-party provision of their personal information held by us. Third-party disclosures require your prior consent except where permitted by law.", + "privacy.s14_japan_label": "Japan (APPI – Act on the Protection of Personal Information):", + "privacy.s14_korea_body": "Korean residents may request access, correction, deletion, and suspension of processing. We handle personal information of Korean residents in accordance with the PIPA.", + "privacy.s14_korea_label": "South Korea (PIPA – Personal Information Protection Act):", + "privacy.s15_contact": "Contact:", + "privacy.s15_heading": "15. Additional Rights – Ukraine", + "privacy.s15_p1": "Users located in Ukraine are protected under the Law of Ukraine \"On Personal Data Protection\" (No. 2297-VI). Your rights include access to, correction, blocking, and deletion of your personal data, as well as the right to object to processing.", + "privacy.s16_cookies_link": "Cookie Policy", + "privacy.s16_heading": "16. Updates to this Privacy Notice", + "privacy.s16_license_link": "License Information", + "privacy.s16_p1": "We may update this notice from time to time to reflect changes in our practices or applicable laws. The \"Last Updated\" date at the top of this page indicates when the notice was last revised. Where changes are material, we will notify users via in-application notification or email where appropriate.", + "privacy.s16_p2_pre": "If you have any questions or concerns about this Privacy Notice or your personal data, please contact us at", + "privacy.s16_p3_pre": "Please also review our", + "privacy.s16_terms_link": "Terms of Service", + "privacy.s1_address": "Alter Steinweg 3, 20459 Hamburg, Germany", + "privacy.s1_company": "Christian Louis IT Beratung", + "privacy.s1_contact_label": "Contact Email:", + "privacy.s1_heading": "1. Data Controller", + "privacy.s1_p1": "The controller responsible for processing your personal data under the EU General Data Protection Regulation (GDPR) and equivalent privacy laws worldwide is:", + "privacy.s1_p3": "For all privacy-related requests (access, deletion, rectification, opt-out, or complaints), please contact us at the email address above. We will respond within 30 days (or the period prescribed by applicable law).", + "privacy.s2_heading": "2. Scope of this Privacy Notice", + "privacy.s2_p1_pre": "This notice applies to the DocuElevate web application, hosted at", + "privacy.s2_p2": "It covers all users globally, including those in the European Union (EU), European Economic Area (EEA), Germany, United Kingdom (UK), Switzerland, Ukraine, United States (US), Canada, Latin America (Latam), Asia-Pacific, and Japan. Market-specific disclosures are provided in dedicated sections below.", + "privacy.s3_audit_body": "We maintain limited audit logs (action type, timestamp, user identifier) to ensure service integrity and security. These logs do not include document content.", + "privacy.s3_audit_label": "Audit Logs:", + "privacy.s3_auth_body": "We use OAuth 2.0 (Google, Dropbox, Microsoft/OneDrive) and optional local authentication. Through OAuth, we may receive your name, email address, and profile picture.", + "privacy.s3_auth_label": "User Authentication:", + "privacy.s3_doc_body": "Documents you upload are processed for OCR (optical character recognition), metadata extraction, and storage to your chosen cloud provider. Document content is processed only for the purpose you initiate and is not stored beyond what is operationally necessary.", + "privacy.s3_doc_label": "Document Processing:", + "privacy.s3_heading": "3. Data Collection & Purposes", + "privacy.s3_legal_body": "Our primary legal bases for processing are:", + "privacy.s3_legal_label": "Legal Basis (GDPR Art. 6):", + "privacy.s3_li1": "(1)(b) Performance of a contract: to provide the DocuElevate service you have requested.", + "privacy.s3_li2": "(1)(c) Legal obligation: to comply with applicable laws and regulations.", + "privacy.s3_li3": "(1)(f) Legitimate interests: ensuring the security of the service and preventing fraud.", + "privacy.s4_heading": "4. Data Minimization & Purpose Limitation", + "privacy.s4_li1": "We collect only the minimum personal data required to operate the service.", + "privacy.s4_li2": "Document content is processed strictly for the purpose you initiate (OCR, storage, metadata extraction). We do not use your documents to train AI models or for any secondary purpose.", + "privacy.s4_li3": "No advertising, behavioural tracking, or profiling is performed.", + "privacy.s4_li4": "No tracking cookies or analytics scripts are loaded.", + "privacy.s4_li5": "Third-party AI services (e.g., OpenAI, Azure Document Intelligence) are invoked only when you initiate document processing, and data is transmitted under data processing agreements.", + "privacy.s4_p1": "DocuElevate is designed with data minimization as a core principle (GDPR Art. 5(1)(c)):", + "privacy.s5_cookie_link": "Cookie Policy", + "privacy.s5_heading": "5. Use of Cookies & Similar Technologies", + "privacy.s5_p1_post": "to maintain your authenticated session. These cookies are essential for the service to function and are exempt from prior-consent requirements under the EU ePrivacy Directive (Art. 5(3)) and equivalent national laws.", + "privacy.s5_p1_pre": "DocuElevate uses", + "privacy.s5_p1_strong": "only strictly necessary session cookies", + "privacy.s5_p2_body": "analytics cookies, advertising cookies, tracking pixels, or any third-party cookies that would require your consent.", + "privacy.s5_p2_label": "We do not use:", + "privacy.s5_p3_pre": "For full details on the cookies we set, their names, duration, and purpose, please visit our", + "privacy.s6_ai_body": "When you initiate OCR or AI-based metadata extraction, document data is transmitted to the AI service you or your administrator has configured. This transmission is governed by a data processing agreement with the respective provider.", + "privacy.s6_ai_label": "AI Processing Services (OpenAI, Azure Document Intelligence, others):", + "privacy.s6_heading": "6. Third-Party Services", + "privacy.s6_no_sale_body": "We do not sell, rent, or share your personal data with third parties for advertising, marketing, or any purpose unrelated to providing the service.", + "privacy.s6_no_sale_label": "No Sale or Sharing for Advertising:", + "privacy.s6_oauth_body": "When you choose to authenticate via OAuth, the respective provider processes your credentials and may share limited profile information with us. These providers maintain their own privacy policies.", + "privacy.s6_oauth_label": "OAuth Providers (Google, Dropbox, Microsoft):", + "privacy.s6_storage_body": "Documents are stored in the cloud provider you configure. Your configured credentials are stored encrypted in the application database and are used solely to perform the storage operations you request.", + "privacy.s6_storage_label": "Cloud Storage Providers (Google Drive, Dropbox, OneDrive, Amazon S3, Nextcloud, WebDAV/SFTP/FTP):", + "privacy.s7_adequacy_body": "where the European Commission has recognised an equivalent level of protection (e.g., United Kingdom, Switzerland, Canada (commercial organisations), Japan, South Korea).", + "privacy.s7_adequacy_label": "Adequacy Decisions", + "privacy.s7_contact": "You may request a copy of the relevant safeguards by contacting us at", + "privacy.s7_heading": "7. International Data Transfers", + "privacy.s7_idta_body": "for transfers from the UK after Brexit.", + "privacy.s7_idta_label": "UK International Data Transfer Agreements (IDTAs)", + "privacy.s7_p1": "DocuElevate is hosted in the European Union / EEA by default. Where personal data is transferred outside the EEA (for example to US-based AI service providers such as OpenAI), we rely on appropriate safeguards including:", + "privacy.s7_scc_body": "adopted by the European Commission (2021/914/EU) for transfers to processors and controllers in third countries.", + "privacy.s7_scc_label": "Standard Contractual Clauses (SCCs)", + "privacy.s8_audit_body": "Retained for up to 90 days for security and compliance purposes.", + "privacy.s8_audit_label": "Audit logs:", + "privacy.s8_contact": "To request deletion of your account and all associated personal data, please contact us at", + "privacy.s8_files_body": "Retained for the duration of your use of the service. You may delete individual files at any time through the application.", + "privacy.s8_files_label": "File records and metadata:", + "privacy.s8_heading": "8. Data Retention", + "privacy.s8_oauth_body": "Stored in encrypted form and revocable at any time via your OAuth provider.", + "privacy.s8_oauth_label": "OAuth tokens:", + "privacy.s8_p1": "We retain personal data only as long as strictly necessary to provide the DocuElevate service or to comply with legal obligations:", + "privacy.s8_session_body": "Deleted when you log out or after session timeout.", + "privacy.s8_session_label": "Session data:", + "privacy.s9_heading": "9. Data Security", + "privacy.s9_li1": "Encryption of credentials and sensitive configuration at rest.", + "privacy.s9_li2": "Transport Layer Security (TLS/HTTPS) for all communications.", + "privacy.s9_li3": "Role-based access controls limiting access to personal data.", + "privacy.s9_li4": "Regular security audits and dependency vulnerability scanning.", + "privacy.s9_li5": "CSRF protection on all state-changing requests.", + "privacy.s9_p1": "We implement appropriate technical and organisational measures (TOMs) to protect your personal data, including:", + "privacy.toc_1": "Data Controller", + "privacy.toc_10": "Your Rights (EU / EEA / UK / Switzerland)", + "privacy.toc_11": "Additional Rights – United States (CCPA/CPRA)", + "privacy.toc_12": "Additional Rights – Canada (PIPEDA / Law 25)", + "privacy.toc_13": "Additional Rights – Latin America (LGPD & others)", + "privacy.toc_14": "Additional Rights – Asia-Pacific & Japan", + "privacy.toc_15": "Additional Rights – Ukraine", + "privacy.toc_16": "Updates to this Privacy Notice", + "privacy.toc_2": "Scope of this Privacy Notice", + "privacy.toc_3": "Data Collection & Purposes", + "privacy.toc_4": "Data Minimization & Purpose Limitation", + "privacy.toc_5": "Use of Cookies & Similar Technologies", + "privacy.toc_6": "Third-Party Services", + "privacy.toc_7": "International Data Transfers", + "privacy.toc_8": "Data Retention", + "privacy.toc_9": "Data Security", + "privacy.toc_heading": "Contents", "profile.avatar_alt": "Your profile picture", "profile.avatar_heading": "Profile Picture", "profile.avatar_remove": "Remove custom avatar",