DRAFT — pending legal review. Not legal advice. Before public launch, a qualified reviewer must finalize the operating legal entity / controller name, contact address, data-retention periods, the user-rights language for the applicable jurisdictions, and the list of active subprocessors. See docs/PRIVACY_CONSENT.md → “Deployment blockers”.

Privacy Policy

Version 1 (draft). Last updated: pending review.

Who we are

[DRAFT — legal entity / data controller name and registered address to be confirmed.] Enablys is a workspace for event operations (people, travel, documents, and scheduling).

What we collect and why

We process the account and operational data you and your organization provide to run the service: your identity and sign-in, organization memberships and roles, event and assignment records, and (where applicable) travel details you choose to store. We use it only to provide and secure the service. We do not use analytics, advertising, or marketing trackers.

Cookies & storage

We use only strictly-necessary and functional browser storage. There are no analytics or marketing cookies. Full details, and your choices, are in the Cookie Notice.

Subprocessors (currently active)

We use the following processor in the live service today:

  • Supabase — hosted database and authentication (stores your account and application data; processes sign-in).

[DRAFT] Other integrations (transactional email, travel/fare providers, payments) are not active and process no production data yet. This list is updated — with a policy-version bump and, where required, renewed notice — before any new processor goes live.

Global Privacy Control & Do Not Track

We honor the Global Privacy Control (GPC) signal: when your browser sends it, we treat optional technologies as declined. We also respect the legacy Do Not Track (DNT) signal as a preference, though DNT has no settled legal standing and is not equivalent to GPC.

Data retention

[DRAFT — retention periods per data category to be confirmed before launch.]

Your rights

[DRAFT — access / correction / deletion / portability / objection language for the applicable jurisdictions to be confirmed by legal review.]

Contact

[DRAFT — privacy contact address to be confirmed.]

Changes to this policy

When we make a material change we increment the policy version and, where optional technologies exist, ask for your choices again.