Privacy Notice

A draft overview of data-handling areas that must be formally documented before Oxyra Forge is used for production or sensitive personal data.

Important: This page is a product-policy draft, not a finalized legal commitment or independent assurance statement. It requires review and approval by Oxyra Technologies before being relied on as binding policy. No effective date or legal contact has been invented.

1. Scope and controller details

This draft concerns the Oxyra Forge website and application operated by Oxyra Technologies. The legal entity details, controller identity, privacy contact and applicable jurisdiction must be confirmed before this notice can become final.

2. Categories of data

Depending on the features a user operates, the service may process account and organization details, project and work records, requirements, estimates, time and resource data, audit events, uploaded files, integration configuration and technical diagnostic information. The exact data inventory and purposes must be confirmed against the deployed implementation.

3. Purposes and legal basis

Potential purposes include account operation, tenant authorization, delivery-work management, estimation, integration processing, service security, support and reliability. The final notice must map each purpose to the applicable legal basis and identify any optional processing separately.

4. Integrations and AI processing

When an administrator connects an external provider, data may be exchanged according to the configured integration and granted permissions. Provider scopes, data sent, retention, subprocessors and any cross-border transfer must be documented before enabling the integration for sensitive workloads.

Do not assume that an AI provider, retrieval system or model-training policy is configured merely because AI-related product features are planned. The actual providers, prompts, data flows and retention settings must be verified and disclosed before such features are enabled.

5. Access, security and retention

The application has organization-scoped access and role-permission foundations, but that alone is not a complete privacy or security guarantee. The final policy must document retention periods, deletion behavior, backup handling, access logging, incident response and the process for exercising applicable data rights.

6. Rights and contact

Depending on applicable law, individuals may have rights to access, correct, delete, restrict or object to certain processing, and to lodge a complaint with a relevant authority. The final notice must explain which rights apply, how to submit requests, response timelines and the verified privacy contact.

7. Finalization required

This draft does not assert a specific retention period, certification, hosting region, subprocessor list, data-residency guarantee or completed legal compliance review. Those details must be verified and approved before this notice is treated as operative.