Raxx · internal docs

internal · gated

Privacy Policy — Version History

Policy file: docs/legal/policies/privacy-policy-v1.md Published URL (pending): https://getraxx.com/privacy

Changelog

Version Date Changed by Summary
1.0.0 2026-05-11 UTC (drafted); 2026-05-XX UTC (published) raxx-dev-bot / operator Initial policy published. Customized from BLR skeleton (docs/legal/artifacts/privacy-policy-skeleton.md) per DIY compliance path (PR #1646). Covers all 9 pre-mapped data fields plus 6 billing fields added in #1604 architect v3. Operator-locked copy for DSR and data retention sections per MooseQuest comment on #1640 2026-05-11 ~21:50 UTC.
1.0.1 2026-10-31 UTC (drafted); takes effect when onboarding_quiz_v1 is ON raxx-dev-bot Adds the setup answers collected by the first-run setup quiz (#4837, epic #4818): a row in the Section 2 collected-data table and the Section 7 retention table, a "Setup answers" note in Section 2 (what is kept, held in the browser tab until the account exists, the analytics event for options chosen, purpose, retention, deletion path) and a line in Section 3. The text is shown on the live page (getraxx-landing PrivacyPolicy.jsx and the raxx-next port) only while the quiz flag is ON; with it OFF the page is unchanged and keeps its 2026-06-21 date. Counsel review is queued under #3141 (packet #4835). This adds a new category of personal data, which the list below treats as a material change; whether 30 days' email notice to registered users is needed before the flag is flipped is for counsel, and it sets the earliest date the quiz can be ON. Open point for counsel (#4835), to reconcile before the flip: the new Section 2.3 sentence "If you have allowed analytics ... See Section 6" describes an opt-in model (the app has a consent banner and the quiz analytics event is consent-gated), but Section 6 is unchanged and the published page still describes analytics as opt-out by emailing privacy@raxx.app with an in-product control "coming" (this record's Section 6 says "via consent banner"). Section 6 was not edited here: it is attorney-gated text. The deletion sentence in Section 2.3 ("deleting your account removes them") is backed today by the admin hard delete (the Console customer delete) and by Step 4c of the manual DSR runbook, which is how a privacy request by email is processed. The automated erasure sweep (billing_dsr_service.execute_dsr, raptor_user_dsr_service.erase_user_setup_answers) also removes them but is reachable only while billing_dsr_erasure_flow is ON, and that flag is OFF by default.

What constitutes a material change (triggers 30-day notice)

Per Section 11 of the policy, the following changes are material and require 30 days' notice to registered users by email:

Non-material changes (no notice required): fixing typos, clarifying existing language without changing meaning, updating contact details.

Planned future revisions

Target version Trigger Scope
1.1 EU Art. 27 representative designated (#1648) Replace placeholder in Sections 1 and 12 with named representative
1.2 Attorney review pass (Tier B — first enterprise deal or $500K ARR) Attorney-reviewed policy replaces DIY draft
2.0 If automated DSR tooling ships (2026-Q3, #1630) Update Section 8 to reflect self-service DSR process
2.x If ADMT / computed scoring is introduced Add GDPR Art. 22 / CPRA ADMT disclosures
2.x If Quebec geo-block is lifted Add Quebec-specific PIPEDA/Law 25 disclosures
2.x If GLBA/RIA status is determined Add Regulation P / GLBA financial privacy notice

Version review schedule

Annual review: calendar reminder set for 2027-05-01 UTC to review policy against actual practices and any regulatory changes.

Refs: #1640 (policy card), #1646 (BLR DIY memo), #1648 (EU representative), #1630 (automated DSR tooling), #1525 (Quebec geo-block), ADR-0076.