# Privacy Policy

**Hoshin Kanri — Strategic Planning Platform**

*Last updated: February 9, 2026*

## 1. Data Controller

Animam Technologies
Email: contact@animam-technologies.com

## 2. Data Collected

### 2.1 Account Data
- Email address
- Display name
- Password (stored as bcrypt hash)
- Organization name

### 2.2 Usage Data
- Matrices, objectives, initiatives, and KPIs created
- Ideas and actions
- Meeting cadences and minutes
- Correlations and completeness scores

### 2.3 Technical Data
- IP address
- Browser User-Agent
- Audit logs of actions (change journal)
- Login timestamps

## 3. Purpose of Processing

Your data is processed to:
- Provide and improve the Service
- Account authentication and security
- Manage your organization and matrices
- Transactional communication (verification emails, password reset)
- Audit and action traceability

## 4. Legal Basis

- **Contract execution**: providing the Service following your registration
- **Legitimate interest**: security, fraud prevention, Service improvement
- **Consent**: marketing communications (if applicable)

## 5. Data Retention

- **Account data**: retained while the account is active, deleted within 30 days of account deletion
- **Usage data**: retained while the account is active
- **Audit logs**: retained for 90 days
- **Technical data**: retained for a maximum of 12 months

## 6. Data Sharing

Your data is not sold to third parties. It may be shared with:
- **Resend**: transactional email delivery
- **OVH**: server hosting (VPS in France)

## 7. Security

We implement technical and organizational measures to protect your data:
- HTTPS/TLS encryption in transit
- Hashed passwords (bcrypt, cost 12)
- JWT tokens with expiration
- Rate limiting on sensitive endpoints
- Multi-tenant isolation per organization
- Regular encrypted backups

## 8. Your Rights (GDPR)

Under the GDPR, you have the following rights:

### 8.1 Right of Access
You can request a copy of all your data via `GET /api/auth/export-my-data` or from your account settings.

### 8.2 Right to Rectification
You can update your personal information from your profile.

### 8.3 Right to Erasure
You can delete your account via `DELETE /api/auth/delete-my-account` or from settings. Deletion is effective within 30 days.

### 8.4 Right to Portability
Data export is available in JSON format via the Service's export functions.

### 8.5 Right to Object
You may object to the processing of your data for marketing purposes.

### 8.6 Right to Withdraw Consent
You may withdraw your consent at any time without affecting the lawfulness of prior processing.

## 9. Cookies

The Service uses only technical cookies required for operation:
- `auth_token`: JWT authentication (httpOnly, secure)
- `refresh_token`: session renewal (httpOnly, secure)

No third-party tracking or advertising cookies are used.

## 10. Data Transfers

Your data is hosted in France (OVH). No transfers outside the EU are made, except for email delivery via Resend (United States, standard contractual clauses).

## 11. Changes

Any substantial changes to this policy will be communicated by email and/or notification within the Service.

## 12. DPO Contact

To exercise your rights or ask a question:
- Email: contact@animam-technologies.com
- You may also file a complaint with the CNIL (www.cnil.fr)