Privacy Notice — Draft

Recofolio · Draft prepared 26 Aug 2026 for review · Not reviewed by a licensed lawyer

0. What this page actually is

This is a first assembled draft for the recofolio.com website and Recofolio Lite (the free, sign-up, browser-based product the site offers today). It is built from two things Venkat's team already produced and approved for AI-first drafting: the full Privacy Notice (docs/legal/D-L2-PRIVACY-NOTICE.md), written for the whole Recofolio product line including the future desktop Pro edition, and this repository's own code, read directly rather than assumed. Where the two could conflict, this draft follows the code, because a privacy notice that overstates what a product does is the more dangerous error.

1. What actually happens today, checked against the code

Before the general notice below, the two things a visitor to this site actually touches:

The converter (`/convert`)

Reads your statement entirely inside your own browser. It makes no network call of any kind while doing it — not to us, not to anyone. This is not a promise we ask you to trust; the page's own Content-Security-Policy sets connect-src 'none', which makes a fetch, an upload, a WebSocket or a background "phone home" fail at the browser level rather than merely something we chose not to write. It stores nothing after you close the tab, and it needs no account, no sign-up and no email address.

Source: site/convert.html and site/vercel.json (the connect-src 'none' policy, served twice — as a header and inside the page itself — for the same reason: so it holds even when opened somewhere that never sent the header).

A Recofolio Lite account (`/app`)

Creating an account is the only point at which this product holds anything about you at all, and what it can hold is limited by the database schema itself — there is no column to put anything else in. Specifically:

Your email address, so you can sign in.
A cryptographic verifier of your password — never the password itself. It cannot be reversed back into your password.
Your trial's start and expiry dates.
Display preferences — which of three things: your colour theme, which Center you land on, and whether you have dismissed the onboarding guidance. Nothing else may be stored as a "preference"; the database rejects any other value.
If you answer the "help us read your bank" invitation: which bank you were asked about, whether you said yes or no, and the exact wording you were shown when you answered. Not the file. Not your account details. Not your name, if you chose not to give one for this purpose.

It does not hold your statements, your transactions, your balances, your bank account numbers, or any file you drop into the converter — inside /app the converter is the same one described above, running the same way, in your browser.

Source: lite/server/schema.sql (the exhaustive table list, with the comment "WHAT MAY NEVER LIVE HERE: statement bytes... There is no table and no column in which one could be put") and lite/server/main.py's stated "four laws", the first of which is zero statement custody.

Open, for Venkat: Recofolio Lite currently sends no verification email (no mail sender is configured) and offers no second sign-in factor. Neither changes what is stored, but both are worth knowing before this notice is read by a real customer. See lite/server/README.md "Open".

2. Who is responsible for your data

[[FQ_LEGAL_NAME]], DMCC licence [[FQ_LICENCE_NO]], registered at [[FQ_REGISTERED_ADDRESS]], United Arab Emirates, is the controller. Contact: [[PRIVACY_EMAIL]].

D-L2 §1. Bracketed values are unresolved in the source document itself — see §7 below.

3. What we never do

We never sell personal data.
We never share personal data for advertising or profiling by others.
We never use your data to train any general-purpose AI model.
We never make automated decisions about you that have legal or similarly significant effects.

D-L2 §4, verbatim.

4. Support — we do not take your files

If you write to us for help, we keep your correspondence. If a diagnostic is needed, it runs on your own machine and produces a short readable report — how much was read, which check failed, which row — that you see in full before anything is sent, and sending it is your act. The report cannot carry a payee name, an account number, or a real balance.

D-L2 §3.4, condensed. This reflects Venkat's ruling that support takes no files at all (DP-089), which superseded an earlier, wider draft the same day — see LEGAL-REGISTER.md L-05 change log for the full round trip.

5. How long we keep things

Data	Kept for
Account record	While your account is open, then 90 days
Licence / billing records and tax invoices	5 years from the end of the relevant tax period (UAE tax law)
Application telemetry (Pro, future)	13 months
Support correspondence	24 months from closure
Founding Formats raw contributions	Deleted as soon as the reader is validated

D-L2 §7 / Annex B, condensed to the categories this site and Lite currently create. Billing and telemetry rows describe the future paid product, not what exists today — Lite has no billing and no telemetry yet.

6. Your rights

Under UAE PDPL you may ask to see what we hold, get a copy of it, have it corrected, have it deleted (subject to records we must keep by law), object to processing, withdraw consent, and complain to the UAE Data Office. Write to [[PRIVACY_EMAIL]]; we respond within 30 days. If you are in Saudi Arabia, Bahrain, Oman, Qatar or India, equivalent rights apply under your own country's law — see D-L2 §12 for the country-by-country detail.

7. Cookies on this site

Today, this site sets no cookie at all except one: signing in to /app sets a session cookie so you stay signed in. It is strictly necessary — the site cannot keep you signed in without it — and it is not used to track you anywhere else. No analytics tool is wired into this build today, so the "Analytics" category described in the source cookie notice (docs/legal/D-L8-WEBSITE-TERMS-AND-COOKIE-NOTICE.md Part B) does not yet apply in practice. If and when one is added, this page is the one that gets updated first, and — per that source document's own rule — nothing beyond strictly-necessary cookies runs until a visitor is asked and agrees.

Checked against site/vite.config.ts ("No analytics, no third-party scripts...") and lite/server/sessions.py's cookie handling; policy language from D-L8 Part B.

8. Open questions this draft does not resolve

Named privacy contact. D-L2 §11 needs a real name or role for [[PRIVACY_CONTACT_NAME_OR_ROLE]]. Flagged, not chosen, in LEGAL-REGISTER.md's 18 Aug 2026 change-log entry as one of three questions the drafting pass surfaced.

Minors and household consent. The source notice states the Service is for people 18 and over (D-L2 §10). The register separately flags "minors and household consent" as an open question the drafting pass raised — for example, whether a statement in someone else's name (a spouse, a joint account) inside a household changes anything. Not resolved here.

Business statements in Founding Formats. The register flags "whether business statements may be contributed to Founding Formats" as open. This draft's §1 describes only the "help us read your bank" click-through consent that exists in Lite today (a bank name and a yes/no); it says nothing about a fuller Founding Formats contribution flow, which is not built in Lite.

Every bracketed placeholder above — legal name, licence number, registered address, privacy email, hosting region, and the named service providers in D-L2's Annex C — is unresolved pending the entity and vendor decisions tracked in LEGAL-REGISTER.md (L-01 licence amendment is still "Open" as of that register's latest entry). None should be filled in with a guess.

9. Full source documents

docs/legal/D-L2-PRIVACY-NOTICE.md — the complete privacy notice this draft condenses, including Annex A (record of processing), Annex B (retention with reasons) and Annex C (service providers).
docs/legal/D-L8-WEBSITE-TERMS-AND-COOKIE-NOTICE.md Part B — the full cookie notice.
docs/LEGAL-REGISTER.md — the risk register these deliverables answer to, and the source of the open questions in §8.

Draft v0.1 · 26 Aug 2026 · Assembled by Claude for Venkat's review, from the sources above and this repository's code. Routed as a page and linked from the footer since 3 Sep 2026; still not reviewed by counsel, and not in force. See REVIEW-PACK-OG-LEGAL-DRAFTS-2026-08-26.md for what needs approval before this goes anywhere near a visitor.