Privacy Policy — Version History
Policy file: docs/legal/policies/privacy-policy-v1.md
Published URL (pending): https://getraxx.com/privacy
Changelog
| Version | Date | Changed by | Summary |
|---|---|---|---|
| 1.0.0 | 2026-05-11 UTC (drafted); 2026-05-XX UTC (published) | raxx-dev-bot / operator | Initial policy published. Customized from BLR skeleton (docs/legal/artifacts/privacy-policy-skeleton.md) per DIY compliance path (PR #1646). Covers all 9 pre-mapped data fields plus 6 billing fields added in #1604 architect v3. Operator-locked copy for DSR and data retention sections per MooseQuest comment on #1640 2026-05-11 ~21:50 UTC. |
What constitutes a material change (triggers 30-day notice)
Per Section 11 of the policy, the following changes are material and require 30 days' notice to registered users by email:
- Adding a new category of personal data collected
- Adding a new third-party recipient category
- Changing the legal basis for any processing activity
- Changing retention periods to shorter or longer durations
- Introducing automated decision-making (GDPR Art. 22 / CPRA ADMT)
- Changing the process for handling data subject requests
Non-material changes (no notice required): fixing typos, clarifying existing language without changing meaning, updating contact details.
Planned future revisions
| Target version | Trigger | Scope |
|---|---|---|
| 1.1 | EU Art. 27 representative designated (#1648) | Replace placeholder in Sections 1 and 12 with named representative |
| 1.2 | Attorney review pass (Tier B — first enterprise deal or $500K ARR) | Attorney-reviewed policy replaces DIY draft |
| 2.0 | If automated DSR tooling ships (2026-Q3, #1630) | Update Section 8 to reflect self-service DSR process |
| 2.x | If ADMT / computed scoring is introduced | Add GDPR Art. 22 / CPRA ADMT disclosures |
| 2.x | If Quebec geo-block is lifted | Add Quebec-specific PIPEDA/Law 25 disclosures |
| 2.x | If GLBA/RIA status is determined | Add Regulation P / GLBA financial privacy notice |
Version review schedule
Annual review: calendar reminder set for 2027-05-01 UTC to review policy against actual practices and any regulatory changes.
Refs: #1640 (policy card), #1646 (BLR DIY memo), #1648 (EU representative), #1630 (automated DSR tooling), #1525 (Quebec geo-block), ADR-0076.