Privacy Policy
DRAFT · Version privacy-draft-2026-07-25-v3 · Last updated July 25, 2026
This placeholder describes the current product behavior at a high level and flags subjects that require a counsel-approved policy. It is intentionally incomplete and is not legal advice.
1. Information handled — placeholder
The client platform handles account details, authentication records, organization and project content, feedback, support communications, and operational records needed to provide and secure the service. Counsel must approve the final categories and required notices.
2. Uses and service providers — placeholder
Information is used to authenticate users, operate and secure the platform, deliver client work, communicate about the service, and meet applicable obligations. Final language must identify relevant processors, disclosures, legal bases, and cross-border safeguards.
Processors currently used by the platform (generated from the platform's own processor registry so this list cannot drift from the code):
Anthropic (Claude API / claude CLI) — Cloud LLM for typed, non-verbatim projections: intake-consultation reasoning, planner/generation prompt composition (subscription-billed via the claude CLI), and prospect/lead research.
Neon (PostgreSQL) — Primary application database.
Vercel — Application hosting, build pipeline, and file (Blob) storage.
Microsoft 365 (Graph, app-only) — Outbound transactional email (account and lifecycle notices).
Stripe — Billing and invoicing (invoice-then-pay; no stored-card auto-charge).
Dropbox Sign (HelloSign) — E-signature for NDAs and engagement contracts.
Sentry — Error monitoring (error events only; PII collection disabled). Status: evaluated not armed.
3. Cookies and similar technologies
The platform uses only essential cookies and local browser storage — sign-in, security, and saved preferences (like theme and dismissed notices). TapQuality currently installs no analytics, advertising, or third-party tracking technology, so there is no optional cookie category and no consent decision to make; the on-screen notice is informational and can be dismissed.
4. Retention and deletion — placeholder
We keep account, brief, and project information while we provide the service and as needed for legitimate legal or accounting obligations. You can request deletion from the portal; a person reviews the request before data is removed to prevent accidental loss.
Final retention periods, deletion exceptions, backup treatment, and any legally required recordkeeping must be supplied or approved by counsel.
5. Rights, security, and contact — counsel required
Final language must address applicable access, correction, deletion, export, objection, restriction, appeal, and complaint rights; reasonable security measures; incident notices; children; policy changes; and the correct privacy contact and jurisdiction-specific disclosures.