Privacy Policy

This website and, once released, the mobile application are operated by Zdefence — sole proprietorship of Nilkanth Thanth, GSFC University, Vadodara, Gujarat, India, India ("Zdefence", "we", "us"). For the personal data described in this notice we act as controller (EU/UK GDPR), Data Fiduciary (India DPDP Act), business/operator (US state laws), responsable / data controller (Mexico LFPDPPP, Argentina Ley 25.326, Brazil LGPD operator roles as applicable), and the equivalent role under each local law listed in Section 24.

Privacy contact: privacy@zdefence.com. Security contact: security@zdefence.com. Legal contact: legal@zdefence.com. Support: support@zdefence.com. Postal address: GSFC University, Vadodara, Gujarat, India. Operator: Nilkanth Thanth (sole proprietorship). Data Protection Officer / Privacy Officer: none appointed — the operator is personally accountable. EU/UK representative: none appointed [LEGAL REVIEW REQUIRED before serving EU/UK; do not invent a representative].

Where we act as processor (for example if a future business product processes customer data on a customer's instructions), the Data Processing Addendum at /legal/dpa governs and this Privacy Policy describes our own-controller processing only. [LEGAL REVIEW REQUIRED before any B2B processing begins.]

This notice is an implementation draft for professional legal review. It is written to match actual product behaviour described in compliance/CONFIG.md and src/lib/compliance/*, not as legal advice. Items marked [PLACEHOLDER] or [LEGAL REVIEW REQUIRED] are unresolved and block any claim of final compliance.

Covered: (a) this marketing website and its waitlist, contact, consent, cookie and privacy-request surfaces; (b) website authentication via Clerk (sign-in/sign-up, session, email verification); (c) database and storage via Supabase; (d) once released, the mobile application described in features.md — nine scan modules, firewall, VPN, anti-phishing, threat intelligence, password manager, secure vault, privacy shield, device trust, Her Safety Hub — to the extent described in Sections 7-9.

Not covered: third-party sites linked from ours; app-store operators; mobile OS vendors; telecom carriers; threat-feed providers' own notices; Have I Been Pwned's own notice for breach lookups. We link to those notices where we direct you to them.

If you are an employee, contractor or job applicant, a separate workforce notice applies once one is adopted. [PLACEHOLDER — workforce notice does not yet exist.]

One consolidated policy with conditional regional sections is used because it is clearer than ten overlapping policies. Regional conditions are in Section 24 and in /legal/regional-* pages. Where a regional section is stricter than the global text, the regional section prevails for residents of that region.

We collect the minimum necessary to operate the surface you use. We do not collect date of birth, government ID, precise location, financial credentials, biometric templates, health data, or demographic attributes on this website. Every form field is reviewed under compliance/data-inventory.md finding DI-001 to DI-009: is it necessary, what purpose requires it, can the product work without it, is it optional, is there a less sensitive alternative, is it disclosed, and is retention limited?

The waitlist form asks only for: email (required), full name (optional), role/company (optional), platform interest (optional), marketing_consent (optional, unchecked by default — see Section 12), first-touch UTM/referrer (automatic, for attribution), slot number + timestamp (automatic, for queue order). No other field is collected. If a field is added, this notice, the data inventory and the consent evidence must be updated before it ships.

We do not use fingerprinting, session replay, A/B-testing identifiers, advertising IDs, or cross-site tracking on this website. The automated tracker test (npm run compliance --trackers) fails the build if a third-party origin appears that is not allow-listed.

Website waitlist: email address; optional full name; optional role/company string; platform-interest enum; marketing_consent boolean + consent text version + timestamp + evidence hash; slot number; created_at/updated_at; hashed network-address reference (SHA-256 truncated, never the raw IP); user-agent string (for abuse triage only).

Contact messages: name, email, message body, timestamp, handling notes. Support records: ticket content and resolution metadata.

Authentication (Clerk): email, name (where supplied), Clerk user ID, session metadata (expiry, device hints), email-verification and password-reset events, MFA enrollment where enabled. Passwords are verified by Clerk; we never see or store raw passwords.

Consent and privacy-request evidence: policy version, consent text version, category/purpose, status (granted/denied/withdrawn/expired), jurisdiction, source page, consent method, timestamp, withdrawn_at, anonymous ID (random, non-tracking), privacy-preserving IP reference, user-agent family, tamper-evident hash. Stored in consent_events / consent_records / privacy_requests / privacy_request_events.

Device and security telemetry (website): TLS handshake metadata, request ID, rate-limit counters, error logs with PII scrubbed. No precise location, no advertising identifiers.

Mobile product (once released — design intent, to be confirmed at launch): on-device scan signals (installed-app package names + SHA-256 hashes, permission states, OS posture flags such as root/emulator/debug/tamper, network posture such as VPN/proxy/Wi-Fi class, battery/storage/RAM aggregates); privacy-constrained AI payload (risk features only — no raw personal content, no passwords, no tokens, no precise location); breach-check k-anonymity prefix (5-char SHA-1 prefix only); SOS/journey data only where you start a safety session (live location shared with chosen guardians, emergency contacts, check-in state). Raw photos, messages, passwords and precise location are never transmitted to our servers.

Directly from you: waitlist and contact forms, cookie-preference controls, privacy-center requests, account signup/sign-in, and (once released) in-app settings, vault entries you choose to store, and safety sessions you start.

Automatically: hashed network-address reference and user-agent for abuse triage; consent-state and slot timestamps; security logs; crash reports with PII scrubbed (emails, phone numbers, tokens removed).

From service providers: Clerk (identity verification outcomes); Supabase (database write confirmations); threat-feed providers (reputation verdicts for hashes/URLs you ask us to check — the feed never receives your personal content, only the hash or URL you submit for lookup); Have I Been Pwned (k-anonymity breach verdict — only a hash prefix leaves the device).

We do not purchase data lists, scrape public profiles, or infer sensitive attributes about you.

A. Operate the waitlist: reserve queue order, deduplicate, confirm subscription, notify at launch. B. Respond to contact and support enquiries. C. Provide authentication and secure sessions. D. Remember cookie and marketing choices on your device. E. Prove consent and honour withdrawals (legal-obligation purpose). F. Prevent abuse, rate-limit, detect credential stuffing and form spam. G. Secure, log and debug the service (security purpose). H. Measure aggregate, privacy-preserving performance (no analytics vendor today). I. Send launch updates only where you separately opted in (marketing purpose, never bundled). J. (Mobile, once released) Provide scanning, firewall, VPN, anti-phishing, threat-intelligence, password-manager, vault, privacy-shield, device-trust and safety-hub functions you request.

We do not process for cross-context behavioural advertising, sale of personal information, profiling for third-party marketing, or training of third-party AI models. Any future purpose requires a new notice version and, where the law requires it, renewed consent before it begins.

• Purpose limitation is enforced in code: consent_records.purpose is checked before any optional processing; analytics/advertising/personalisation gates return false unless granted (src/lib/compliance/consent.ts isPurposeAllowed).
• Compatibility: we never repurpose waitlist emails for unrelated marketing without a fresh opt-in.

Design principle (from features.md): critical security checks run on your device. The nine scan modules (application, device, network, privacy, threat-intelligence, web-phishing, home-network, behavioural, dark-web-exposure) evaluate locally and produce a 0-100 risk score, category breakdown, top risk drivers and remediation steps.

Transmitted only: package SHA-256 hashes for reputation lookup (never APK binaries); URLs you ask to inspect (for VirusTotal / Safe Browsing / AI phishing assessment); hash prefixes for breach checks; device-posture snapshot flags (compromised/emulator/debug/hooked/tampered/screen-lock/biometric/developer-mode/USB-debugging booleans, OS version, platform string); firewall/VPN peer and handshake metadata; SOS/journey coordinates only during an active session you start.

Never transmitted: raw photos, message bodies, clipboard contents, passwords, auth tokens, precise location outside an active safety session, vault plaintext, or biometric templates. Vault encryption is AES-256-GCM with hardware-backed keys; cloud backup is strictly opt-in.

[LEGAL REVIEW REQUIRED] This section describes design intent for a pre-launch product. It must be re-verified against the shipped mobile build before launch; any deviation blocks launch under the consistency gate.

This website performs no AI processing of your data. No prompts, no profiling, no automated decisions.

Mobile (once released): AI assists security classification (risk score 0-100, category, confidence, plain-language explanation, evidence summary, recommended action with decision levels Allow/Monitor/Warn/Recommend Action/Critical Alert) and phishing assessment (confidence score, redirect-chain analysis). Payload is privacy-constrained as in Section 7. Providers/models, retention at the provider, training use, evaluation use, abuse monitoring and human-review arrangements: [PLACEHOLDER — list once a provider is integrated; currently none].

We do not claim accuracy percentages, unbiasedness, or guarantees. AI output is decision support, not a guarantee of safety. Where you interact with an AI system we disclose that it is an AI system (EU AI Act Art.50 transparency, applicable from 2 Aug 2026; grace for pre-existing generative systems to 2 Dec 2026).

Training: we do not use your data to train models unless the provider contract and a renewed notice say so. [LEGAL REVIEW REQUIRED on EU AI Act high-risk classification under Annex III and on China generative-AI/algorithm-filing duties before launch.]

Password breach checks use k-anonymity: only the first 5 characters of the SHA-1 hash are transmitted to Have I Been Pwned with padding; the full password never leaves the device. Safe fallback when the service is unavailable.

Threat-intelligence lookups transmit only IOCs (URL, IP, SHA-256, domain) you ask about to URLhaus / ThreatFox / OpenPhish / PhishStats / Feodo / MalwareBazaar via our backend; feeds are cached and health-reported; degraded states are honestly reported.

Firewall/VPN: device-side firewall uses Android local VPN; WireGuard full-tunnel encryption for the anonymity shield with validated server keys, kill-switch and split-tunnel preferences; fail-closed handoff; no activity logs or browsing history stored (see content.ts PROTECTION claims — each claim is tracked in claims-registry.json and must be evidenced).

EU/EEA (GDPR Art.6): consent (Art.6(1)(a)) for waitlist and marketing; contract (Art.6(1)(b)) for account services; legitimate interests (Art.6(1)(f)) for abuse prevention and security logging after a balancing test documented in the data inventory; legal obligation (Art.6(1)(c)) for retaining consent evidence (Art.7(1) accountability). Special-category data: none collected on the website.

UK: same as EU under UK GDPR Art.6/Art.7; PECR reg.6 for storage, reg.22 for marketing. Data (Use and Access) Act 2025 staged commencement is tracked; reliance on any new DUAA basis requires counsel sign-off.

India (DPDP Act ss.4-6 + Rules 2025): free, specific, informed, unconditional, unambiguous consent by clear affirmative action for the specified purpose in the itemised s.5 notice; withdrawal as easy as giving (s.6(4)-(6)); burden of proof on us (s.6(10)) — hence tamper-evident consent evidence. Grievance redressal (s.13) via privacy@zdefence.com and the Board portal once constituted.

California (CCPA/CPRA, conditional): consent/opt-in for minors' sale/sharing; opt-out of sale/sharing for adults via /legal/your-privacy-choices + GPC; notice at collection. We do not sell/share today (see Section 13).

Canada (PIPEDA Sch.1 Cl.4.3 + Quebec Law 25): meaningful knowledge + express/implied consent per sensitivity; CASL express/implied consent for CEMs. Brazil (LGPD Arts.7-8,11): consent or another Art.7 basis; sensitive data heightened. Australia (APPs 3,5): consent for sensitive, notice for all. Japan (APPI): consent for sensitive and third-party provision. Singapore (PDPA ss.13-17): consent with deemed-consent/legitimate-interest exceptions. China (PIPL Arts.13-17): consent generally; separate consent for sensitive, sharing and cross-border. UAE (DL 45/2021): consent or another lawful basis. South Africa (POPIA ss.11-12): consent or another justification. Nigeria (NDPA): consent or another lawful basis. New Zealand (IPPs 1-4): lawful, necessary, fair collection. South Korea (PIPA Arts.15,17,23): consent or enumerated basis; separate consent for sensitive/third-party. Thailand (PDPA ss.19,26): explicit consent; sensitive heightened. Indonesia (UU PDP Arts.20,23-25): explicit valid consent. Malaysia (PDPA s.6 + 2024 amendments): consent; biometric/sensitive explicit. Philippines (DPA ss.12-13): consent or criterion; sensitive heightened. Israel (PPL): informed explicit/implied consent; sensitive explicit. Mexico (LFPDPPP): tiered tacit/express/express-written consent; sensitive/financial express written. Argentina (Ley 25.326 Art.5): free, express, informed written-or-equivalent consent.

Where consent is the basis you may withdraw at any time via /privacy-center, /cookie-preferences or privacy@zdefence.com without affecting prior lawfulness. Withdrawal is as easy as giving: one control, no account required, no dark pattern.

Strictly necessary (always on, exempt): authentication session (Clerk), security (rate limiting, CSRF), load balancing. No consent required because the service you request cannot work without them.

Everything else is off until you turn it on. Today the site sets no analytics, advertising, session-replay, personalisation, A/B-testing or social-widget storage at all. If that changes, the technology will not execute until you consent, the Cookie Policy will list the vendor, purpose, duration and transfer, and the tracker test will enforce the gate.

Your cookie choice persists 12 months on the device (localStorage zdefence_consent_v1), then we ask again. A policy-version bump can trigger a re-ask. GPC/DNT is honoured as an opt-out of advertising/personalisation and, where required, as an opt-out of sale/sharing with visible confirmation.

Third-party embeds are lazy and privacy-preserving: no YouTube/Vimeo, maps, support widget, scheduling tool, session replay or social pixel loads until you choose it where consent is required. Fonts are self-hosted via next/font (IBM Plex) — no Google Fonts transfer. Clerk scripts are deferred via /clerk-defer.js and only execute as necessary for authentication.

Email, SMS and push consent are collected separately. Agreeing to email does not opt you into SMS or push. Pre-ticked marketing boxes are never used. The waitlist marketing_consent field defaults to false in the UI; the database default bug (DI-004, p_marketing_consent default true) is fixed before launch and the route passes the user's actual choice.

Every marketing message identifies us accurately, uses an honest subject line, includes a valid postal address where required (CAN-SPAM), and carries a one-click unsubscribe that is honoured immediately and recorded in suppression_records. We do not send marketing after unsubscribe. Suppression entries are retained (hashed address only) to enforce the opt-out.

Jurisdiction overlays: EU ePrivacy Art.13 consent or narrow soft opt-in + opt-out; UK PECR reg.22; US CAN-SPAM (accurate header/subject, ad identification, physical address, 10-business-day opt-out); Canada CASL (express/implied consent, identification, 10-business-day unsubscribe); Australia Spam Act; Singapore DNC + Spam Control Act; Japan specified-commercial-transactions rules; Israel s.30A spam rules; Mexico secondary-purpose opt-out + PROFECO. [LEGAL REVIEW REQUIRED for each marketing send until counsel confirms the channel/jurisdiction matrix.]

We do not sell personal information and we do not share it for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA, state privacy laws, LGPD, PIPEDA or equivalent. We do not build advertising profiles and we do not disclose waitlist data to ad networks, data brokers or analytics vendors (there are none).

This is a factual description of current behaviour verified against the vendor registry, the tracker inventory and the claims registry. It must be re-verified before any analytics, pixel or advertising SDK is added. If sale/sharing ever begins, /legal/your-privacy-choices becomes the operative opt-out and GPC is honoured as a valid opt-out with confirmation.

We do not claim 'we never sell' as a perpetual guarantee — we state what we do today and commit to notice + choice before any change.

Supabase (managed PostgreSQL + object storage): waitlist, contact and consent records. Country: Australia (Oceania/Sydney — confirmed 2026-10-07). Subprocessor: AWS infrastructure. DPA: https://supabase.com/legal/dpa — accepted by the operator (2026-10-07). Transfer mechanism: SCCs / EU-US DPF per Supabase terms — VERIFY before reliance (LEGAL REVIEW REQUIRED + TIA pending).

Clerk (authentication): email, name, Clerk ID, session metadata. Country: United States. DPA: https://clerk.com/legal/dpa. Transfer mechanism: SCCs / DPF — VERIFY before reliance.

Hosting/CDN provider: Cloudflare (Workers + edge network; global edge locations). Request metadata in transit. Host DPA: https://www.cloudflare.com/legal/dpa/ — acceptance to be recorded before launch (LEGAL REVIEW REQUIRED). No email, CRM, support, analytics, marketing-automation, session-replay, A/B-testing or AI provider is integrated today. Adding one requires a vendor review, DPA, transfer assessment and a notice update before it processes data.

The public list at /legal/subprocessors is generated from the vendor registry (src/lib/compliance/vendors.ts) so it cannot drift. Vendors whose role is unclassified are not publicly asserted as processors. Contract status, retention, deletion process and last review date are shown per vendor.

Origin is your country; destinations are the vendor hosting regions above (primarily the United States, pending confirmation). Each transfer row in compliance/transfer-register.md records origin, destination, category, sender, recipient, purpose, mechanism, contract, safeguards, assessment, retention and legal review.

EU/EEA: adequacy decision (Art.45) or 2021/914 SCCs + transfer impact assessment (Art.46). US reliance on the EU-US Data Privacy Framework depends on the recipient's certification — verify at transfer time. UK: adequacy or UK IDTA/Addendum. Brazil: adequacy, SCCs, BCRs or consent per ANPD regulation. Australia APP 8: reasonable steps for recipient compliance. Japan: consent with prescribed information or equivalent-protection recipient. Singapore: comparable protection. China: CAC security assessment, certification or standard contract depending on volume/type — assess before any transfer. India: permitted except to Central-Government-restricted countries (check the list before relying). UAE/DIFC/ADGM: adequacy or safeguards. South Africa: adequacy, consent or contract. Nigeria: adequacy or safeguards. New Zealand IPP 12: comparable safeguards or authorisation. South Korea: consent with disclosures or PIPC-recognised adequacy (EU recognised 3 Sep 2025) / safeguards. Thailand s.28: adequacy or safeguards + assessment. Indonesia Art.62: adequate binding protection or consent. Malaysia s.129 + CBPDT: adequacy or safeguards + TIA. Philippines s.21: accountability + contractual comparable protection. Israel Transfer Regs: Convention-108/adequate-cooperation country or safeguards + EEA-data duties. Mexico Arts.36-37: aviso + consent tier. Argentina Art.12: adequate country or consent.

Do not invent a transfer mechanism. Every mechanism above is conditional on a signed contract and a completed assessment. [LEGAL REVIEW REQUIRED + TIA pending for Supabase/Clerk/host destinations.]

Waitlist records: 24 months from last activity or launch + 6 months, whichever is first; then deleted. Contact messages: 12 months from resolution. Abuse-triage metadata (hashed IP reference, user-agent): 90 days, then nulled (row kept). Consent evidence: relationship + 3 years (legal obligation to prove consent). Cookie choices: 12 months, then re-asked. Authentication identity (Clerk): until account deletion, then deleted via Clerk API. Application logs: 30 days rolling. Privacy-request files: per Section 18. Suppression entries: retained as hashed opt-outs to enforce unsubscribes.

Where immediate deletion from backups is technically impossible, deletion takes effect as backups rotate (platform backup lifecycle). This is a documented control, not a claim of instant erasure, and the deletion job records it in deletion_exceptions. Legal hold suspends deletion for records under active claim, dispute or incident.

Machine-readable rules and scheduled cleanup SQL are in compliance/retention-matrix.md and src/lib/compliance/retention.ts. No category is retained forever.

A deletion request evaluates: primary database rows, replicas, object storage and uploaded files, CRM, email systems, support platforms, analytics, marketing systems and suppression handling, AI providers and vector stores, caches, logs, backups (lifecycle control), exports, and third-party applications. Each target is recorded in deletion_targets with attempts in deletion_attempts and holds in deletion_exceptions; the full trail is in deletion_audit_log.

We do not claim deletion is complete unless the defined scope is complete. If a target cannot be deleted immediately (for example a backup window), we tell you the target, the reason and the date it will age out. Consent proof and records under legal hold are retained as disclosed in Section 16 and explained in the response.

Mobile (once released): vault entries you delete are securely overwritten on-device; cloud backups you enabled are deleted on request; safety-session locations expire per the session policy. [To be confirmed at launch.]

Use /privacy-center or email privacy@zdefence.com. Available everywhere: access, correction, deletion, export (JSON + CSV/ZIP + original uploads where applicable), withdrawal of consent, marketing opt-out, and complaint. No account is required. Identity verification uses the minimum necessary (email ownership check); we never ask for government ID for an ordinary request.

Response times we honour (statutory minima): EU/UK GDPR one month (extendable by two for complexity); India DPDP 90 days for access/correction/erasure via the Board portal + grievance acknowledgement; California 45 days (extendable); Canada PIPEDA 30 days; Brazil LGPD 15 days for confirmation/access; Australia APP 12-13 reasonable period; Japan APPI disclosure without delay; Singapore PDPA 30 days; China PIPL timely; South Africa POPIA reasonable; Nigeria NDPA defined window; New Zealand IPP 6-7 20 working days; South Korea PIPA without delay; Thailand PDPA + 2026 DSAR Notification procedure; Indonesia UU PDP timely; Malaysia PDPA 21 days; Philippines DPA 15 days; Israel PPL 30 days; Mexico LFPDPPP 20 business days + 15 to fulfil; Argentina Ley 25.326 statutory terms (habeas data lies on expiry). Where your law is stricter, the stricter time applies.

We do not discriminate for exercising a right, charge unless the law permits it (for example Mexico first request per 12 months is free; manifestly unfounded/excessive requests), or reveal another person's data. Privacy-preserving refusals never leak internal identifiers.

Appeals and complaints: if we cannot fulfil a request (legal exception, conflicting rights, trade-secret/confidentiality limit), we explain the exception, the legal basis and how to appeal to us and to your regulator (see /legal/legal-contact for regulator links).

Encryption in transit (HTTPS/TLS) with HSTS; security headers (Content-Security-Policy tuned to the app, X-Content-Type-Options, Referrer-Policy, Permissions-Policy restricting geolocation/microphone/camera, frame-ancestors); secure, HttpOnly, SameSite cookies; CSRF protection; server-side input validation and output encoding; parameterised queries; least-privilege database credentials with the service key server-only; secrets in environment configuration, never committed (secrets scan in CI); dependency scanning; rate limiting and brute-force throttling; Clerk RS256/JWKS session verification with expiry; RBAC with fail-closed authorisation and anti-IDOR ownership checks; signed webhooks; file-upload controls (type/size/rename/signed-URL/malware scan where appropriate — no uploads on the website today); backups with restore testing; audit logging for policy, export, deletion, role, vendor, security and billing changes.

Baseline: OWASP ASVS (see compliance/security-baseline.md). We do not claim certifications we do not hold (no SOC 2, ISO 27001, PCI, HIPAA badges) and we do not claim to be '100% secure'. The Security Statement at /security describes only controls that exist.

Logging hygiene: never log passwords, tokens, payment secrets, private uploads, full AI prompts (unless needed and disclosed), or unnecessary personal data. PII redaction is enforced; log retention and access permissions are in Section 16.

[OWNER INPUT REQUIRED — blocking.] The website has no age gate today. Product copy refers to families and children (TEAMS 'Families & Households', 'keeping your kids safe'), so the owner must decide before launch whether the service is child-directed or likely to be accessed by children.

Current draft position (not final): the website is not directed to children and we do not knowingly collect children's data; if we learn a child provided data without required parental consent we delete it. If the service is directed to under-13s (US COPPA verifiable parental consent), under-16s (EU GDPR Art.8; member states 13-16), under-14s (China PIPL guardian consent; South Korea PIPA under-14 representative consent), or equivalent thresholds in India (DPDP s.9 verifiable parental consent + no behavioural tracking/advertising directed at children), Brazil (LGPD Art.14 specific parental consent), South Africa (POPIA s.35), Indonesia (Art.25), Thailand (under-10/10-20 rules), Mexico/Argentina (best-interests + guardian consent), the full parental-consent, age-assurance, advertising-restriction and deletion controls must be built before marketing to those users. See /legal/age-policy.

See Sections 11-12 and the Cookie Policy. GPC/DNT is treated as an opt-out of advertising/personalisation and, where required (California, EU/UK opt-in regimes), as an opt-out of sale/sharing with visible confirmation. Withdrawing marketing consent never affects service messages (security alerts, transactional confirmations).

This website makes no automated decisions with legal or similarly significant effects. The mobile risk score (0-100) and phishing verdicts are advisory and always paired with human-readable explanations and user-confirmed remediation; they are not solely automated decisions under GDPR Art.22 / UK GDPR Art.22 / equivalent. If high-impact automated decisions are introduced, we will add a decision registry (decision, data, model, logic, impact, human involvement, appeal, correction, explanation, audit) and seek specific legal review before launch.

Version 0.9.0-draft, last updated 2026-10-02, next review 2026-12-01, owner Privacy, status DRAFT, legal review LEGAL REVIEW REQUIRED. Versions are append-only (src/lib/compliance/legal-versions.ts): a change increments the version, records effective date, reason, jurisdictions, affected products, preserves the prior text, and decides whether re-acceptance is needed. Material changes are announced to waitlist members and, where the law requires it, we ask for renewed consent/acceptance. We never silently overwrite a prior version.

EU/EEA: controller identity, DPO contact (once appointed), Art.13/14 notice items, Art.7 consent proof, Arts.15-22 rights, Art.33 72-hour authority notification + Art.34 individual notification where high risk, Art.5(1)(e) storage limitation, Art.44-50 transfers, Art.8 child age, Art.22 ADM, EAA accessibility from 28 Jun 2025, AI Act Art.50 transparency from 2 Aug 2026.

UK: UK GDPR + DPA 2018 + DUAA 2025 (staged) + PECR regs.6/22; ICO 72-hour rule; Children's Code if likely to be accessed by children; DMCC Act 2024 subscription rules before paid launch.

US federal: FTC Act §5 substantiation for every claim in claims-registry.json; CAN-SPAM; COPPA if child-directed. California (conditional on thresholds): CCPA/CPRA rights (know/delete/correct/opt-out/limit/non-discrimination), notice at collection, 45-day response, GPC honoured + confirmed, no account required for opt-out. Other US states (CO/CT/VA/TX etc.): not yet modelled — adding them is data, not code (registerJurisdiction); GPC handling already covers the common opt-out.

Canada: PIPEDA + Quebec Law 25 (portability phased) + CASL; 30-day access, real-risk-of-significant-harm breach report to OPC + individuals. Brazil: LGPD Art.18 rights, 15-day confirmation/access, 3-business-day ANPD breach communication (confirm text). Australia: APPs 5/12/13, Spam Act, eligible-breach notification as soon as practicable. Japan: APPI purpose notice, disclosure/correction/suspension, PPC + individual breach notification. Singapore: PDPA ss.20-22 rights, DNC, 3-calendar-day PDPC breach notification. China: PIPL Arts.44-50 rights, separate consents, CAC transfer assessment/certification/contract. India: DPDP ss.5-6 notice/consent, ss.11-15 rights, 90-day response, Board + Data Principal breach notification in plain language + 72-hour Board update, CERT-In 6-hour reporting for specified incidents + 180-day log retention (confirm applicability). UAE: DL 45/2021 + DIFC/ADGM variants. South Africa: POPIA ss.11-25, s.69 marketing opt-in, regulator + subject notification as soon as reasonably possible. Nigeria: NDPA rights, 72-hour NDPC notification (confirm directive). New Zealand: IPPs 1-13 (incl. 3A from 1 May 2026), 20-working-day access, ss.114-115 breach notification. South Korea: PIPA Arts.15/17/23 consents, Arts.35-37 rights, prompt breach notification (expanded definition from 11 Sep 2026). Thailand: PDPA ss.19/23/26 consents, ss.30-36 rights + 2026 DSAR procedure from 14 Sep 2026, s.37(4) 72-hour PDPC + high-risk subject notification, s.28 transfers. Indonesia: UU PDP Arts.5-13/20/23-25 rights/consents, 3x24-hour breach notice, Art.62 transfers. Malaysia: Act 709 + 2024 amendments (DPO, portability, biometric-as-sensitive), s.12B breach (72h Commissioner / 7-day subjects per 2025 guideline), s.129 transfers + TIA. Philippines: RA 10173 ss.12-13/16-18/21 rights/bases/accountability, Circular 16-03 72-hour NPC + subject notification. Israel: PPL ss.13-14 access/correction, Security Regs s.11 severe-incident prompt PPA notification (PPA may order subject notice), Transfer Regs adequacy, Amendment-13 enforcement. Mexico: LFPDPPP 2025 Arts.22-26 ARCO (20+15 working days), tiered consents, Arts.36-37 transfers, Art.19/Reg.63 immediate subject breach notification where significant (no fixed deadline), Art.30 data department. Argentina: Ley 25.326 Arts.5-6/9-12 duties, Arts.13-16/19-20 rights, Art.21 registration, Art.12 transfer adequacy/consent; reform pending.

Where a regional rule above is stricter than the global text, it prevails for residents of that region. Every rule cites its source_id in compliance/legal-source-registry.md with effective date and last_verified_at 2026-10-02. Unverified points are labelled UNVERIFIED — LEGAL REVIEW REQUIRED and carried into compliance/legal-review-package.md.

Privacy: privacy@zdefence.com. Grievance (India DPDP s.13): privacy@zdefence.com [PLACEHOLDER — grievance officer name/contact once appointed]. Security: security@zdefence.com. Legal: legal@zdefence.com. Support: support@zdefence.com. Data department (Mexico Art.30): [PLACEHOLDER]. Response target: acknowledge within 72 hours; resolve within your law's deadline (Section 18).

Regulators: EU national DPAs via EDPB; UK ICO; California AG/CPPA; Canada OPC; Brazil ANPD; Australia OAIC; Japan PPC; Singapore PDPC; India Data Protection Board (via MeitY portal); UAE Data Office/DIFC/ADGM; South Africa Information Regulator; Nigeria NDPC; New Zealand OPC; South Korea PIPC; Thailand PDPC; Indonesia authority (once established); Malaysia JPDP; Philippines NPC; Israel PPA; Mexico Secretaría Anticorrupción (successor to INAI); Argentina AAIP. Links at /legal/legal-contact.

Effective: [PLACEHOLDER — EFFECTIVE DATE — set at publication]. Last updated 2026-10-02. Next review 2026-12-01. Prior versions are preserved; this draft has no prior published version. Source registry: compliance/legal-source-registry.md (every source_id above with official URL, effective date and last_verified_at 2026-10-02). Jurisdiction engine: src/lib/compliance/jurisdictions.ts. Data inventory: compliance/data-processing-registry.json. Transfer register: compliance/transfer-register.md. Retention: compliance/retention-matrix.md. Vendor registry: src/lib/compliance/vendors.ts + /legal/subprocessors.