Privacy Policy

# Inchframe Privacy Policy — DRAFT FOR COUNSEL REVIEW

Effective date: [DATE]
Controller/business: Unus Mundus LLC, [ADDRESS]
Privacy contact: [PRIVACY EMAIL]

THIS TEMPLATE IS NOT LEGAL ADVICE. It must be reconciled with the actual production backend, payment processor, telemetry, support, hosting, retention, and vendor configuration before launch.

## 1. Product architecture summary

Inchframe is primarily a local desktop workflow tool. Project media, prompts, renders, and local API keys are intended to remain on the customer’s device unless the customer chooses a connected provider or cloud feature. The licensing backend will receive only the information described below. Connected AI and rendering providers independently process data under their own terms and privacy policies.

## 2. Information collected

Depending on enabled services, we may collect:

- Account and contact data: name, email, organization, support communications.
- Commercial data: selected plan, subscription status, invoices, tax location, payment-processor identifiers, and transaction history. Full payment-card data should be handled by the payment processor and not stored by Inchframe.
- License and device data: installation identifier, license key or token, app version, tier, entitlement status, activation/verification times, coarse operating-system information, and security/fraud signals.
- Usage and diagnostics: feature events, crash data, error logs, performance data, and support diagnostics only if enabled and accurately disclosed.
- Customer Content: local project data is not uploaded to Unus Mundus LLC unless the user deliberately sends it for support or uses a hosted Inchframe feature that requires upload. Content sent directly to third-party providers is governed by their policies.
- Website data: IP address, browser/device information, cookies, referral information, and account-session data if the website or checkout uses them.

## 3. Sources and purposes

Information comes from the user, the desktop app, payment and licensing providers, support interactions, and connected services. We use it to provide and secure licenses; operate accounts and billing; prevent fraud and demo abuse; provide support; comply with law; maintain, debug, and improve the Service; and communicate material subscription or policy changes.

## 4. Disclosure and service providers

We may disclose information to contracted service providers for hosting, licensing, payment processing, email, support, security, analytics, and legal compliance; to connected providers at the user’s direction; in a corporate transaction; or when legally required. List actual vendors before launch: [PAYMENT PROCESSOR], [LICENSING/HOSTING], [EMAIL], [SUPPORT], [ANALYTICS].

State whether personal information is sold or shared for cross-context behavioral advertising: [WE DO NOT SELL OR SHARE / ACTUAL PRACTICE]. Do not make this statement until vendor contracts and tracking are verified.

## 5. Retention

Retain data only as long as needed for the stated purpose, legal obligations, disputes, security, and fraud prevention. Define production schedules before launch: account records [PERIOD], billing/tax records [PERIOD], licensing and consent records [PERIOD], support records [PERIOD], security logs [PERIOD], backups [PERIOD]. Local project data remains controlled by the user.

## 6. Security

Use reasonable administrative, technical, and physical safeguards appropriate to the data. License and account traffic should use TLS; secrets should not be logged; access should be least-privilege; payment data should remain with the processor; and retention/deletion controls should be tested. No security method is perfect.

## 7. Choices and rights

Users may update account details, cancel subscriptions, deactivate an installation, and choose whether to connect third-party providers. Depending on location and applicable thresholds, users may have rights to know/access, correct, delete, obtain a portable copy, opt out of sale/sharing or targeted advertising, limit certain sensitive-data uses, and receive nondiscriminatory service. Provide request methods: [PRIVACY WEBFORM], [EMAIL], [TOLL-FREE NUMBER IF REQUIRED]. Describe identity verification and authorized-agent procedures.

## 8. California disclosures

If the CCPA applies, add a table covering categories collected in the preceding 12 months, sources, business/commercial purposes, retention criteria, categories disclosed, and sale/sharing status. Provide “Your Privacy Choices” mechanisms if required. State how requests to know, delete, correct, opt out, and limit are handled. Update this policy at least annually and provide a Notice at Collection at or before collection.

## 9. Children

The Service is not directed to children under [13/16]. We do not knowingly collect children’s personal information. Add the process for deletion requests and any age-gating required by counsel and target markets.

## 10. International transfers

If offered outside the United States, identify transfer mechanisms, representatives, lawful bases, and region-specific rights required by GDPR, UK GDPR, or other law. Do not launch globally on this US-first draft alone.

## 11. Changes and contact

Post the effective date, notify users of material changes where required, and preserve prior versions. Contact: [PRIVACY EMAIL], [POSTAL ADDRESS].