Data processing

For data a customer puts into a hosted deployment, the customer is the organisation responsible for it and the operator processes it on documented instructions. For data the platform collects about its own visitors — accounts, contributions, feedback — the operator is responsible.

• Account email and password hash; session token hashes.
• Saved views (a name and the map’s query string).
• Contributions: category, name, note, coordinates, optional email, IP for abuse triage.
• Feedback: kind, title, detail, optional email, page, IP.
• Operational records: request logs, hashed rate-limit keys, job runs, audit trail.

Product analytics is first-party and carries no IP, no account link and no query text.

This deployment is not hosted yet, so the list is currently empty. When it is hosted, this table is the authoritative list, and customers are told before a new one is added.

• Database hosting — not provisioned.
• Application hosting — not provisioned.
• Map tiles, routing and camera frames — served from this deployment, not a third party.
• Email delivery — none; no transactional mail is sent yet.
• Analytics, tag management, session replay — none, by design.

Measures are described in Security and docs/security.md: scrypt password hashes, hashed session tokens, per-address rate limits, CSP with a per-request nonce, and an operator console that fails closed.

A personal data breach will be notified to affected customers without undue delay, with what happened, what was affected, and what was changed. There is no 24/7 on-call rota yet; the notification commitment is honest about business hours.

Retention is listed in the privacy notice. On termination, customer data is exported on request and deleted within 30 days, except records required for tax or security. Hosting region will be stated when provisioned; if data leaves Singapore, transfers rely on the PDPA’s comparable-protection requirement and the customer is told in advance.

Data processing contact: no address is configured for this deployment yet — set NEXT_PUBLIC_CONTACT_EMAIL before launch.

Operator actions are audited (`audit` table) and the Enterprise Edition exposes an audit export. A customer may request a summary of the audit trail covering their data once per contract year.