Privacy review draft
A production privacy notice must describe the deployed service, not this local demonstration. The following is a decision ledger for review.
Do not publish this as an effective privacy notice. Hosting, identity, billing, provider integrations, analytics, retention periods, legal entity, governing law, and privacy contact remain unapproved.
Tenant and membership identifiers; business contact and directory fields; signature templates and assets; approval and publication history; provider connection metadata; billing and partner records; and bounded security and operational events.
Application databases and logs must not contain raw mail bodies, subjects, attachments, provider secrets, or unnecessary directory payloads. The browser-only generator makes no product API request.
Each production processor, support-access path, provider API, public contact asset, and consented analytics purpose must be named. Public signature images are intentionally retrievable by anyone holding their opaque URL.
Published signature history and commercial evidence may need durable retention; transient imports, exports, logs, support access, credentials, and inactive-tenant data need bounded schedules. Exact periods and lawful bases are owner decisions.
Access, correction, export, deletion, objection, and complaint handling need verified-request procedures and jurisdiction-aware response times. The configured support channel is support@stunomatic.com; the owner must separately confirm whether it is approved for privacy requests.