PureCommunity — Privacy Policy

Status: DRAFT for review. Not legal advice. Must be reviewed by a licensed attorney before publication.

Operator: PureTechnology (New York, NY), operating PureBrain.ai and PureCommunity ("we," "us," "our").

Last updated: [DATE — fill on publication] Effective: [DATE — fill on publication]

The short version (plain English)

• What we collect: your email, display name, profile details you choose to add, and the things you do in the community (posts, comments, reactions, points, notifications).
• Why: to run your account, show the community, keep it safe, and improve the Service.
• Visitors: if you use the Service without an account, your session is short-lived and we don't keep durable personal information — unless you choose to give an email to save an "Ask AI" session.
• We do not sell your data. We do not show ads.
• Who helps us run it: our hosting provider (Vercel) and our authentication/database provider (Supabase). They process data on our behalf.
• Your rights: you can access, correct, or delete your information. Email us to ask.
• Contact: [CONTACT EMAIL].

The full policy below is what governs — this summary is just to help.

1. Scope

This Privacy Policy explains what personal information PureCommunity collects, why, how long we keep it, who we share it with, and the choices you have. It applies to members, visitors, and people who contact us. It works together with our [Terms of Service](./terms-of-service.md).

2. Information we collect

2.1 Information you give us

• Account information: email address, display name.
• Profile information (optional): avatar, role/company, bio, and anything else you add to your profile.
• Content: posts, comments, reactions, saved items, and any images or text you submit.
• "Ask AI" input: the curated prompt you choose and any email you optionally provide to save or link a session.
• Communications: messages you send us (support, feedback, reports).

2.2 Information created through your use

• Activity and engagement: posts/comments/reactions you make, points, rank, and notifications.
• Moderation records: reports you file or that concern your content, and actions taken.

2.3 Visitor sessions (minimal, ephemeral)

If you use the Service without an account (for example, "Ask AI" via curated prompts), we issue a short-lived, server-signed session. These sessions carry no durable personal information and no stored credential, and the related records are periodically deleted ("reaped"). We may keep limited technical signals (such as rate-limiting counters and abuse-prevention data) for security. If you choose to provide an email to save or link an "Ask AI" session, that email is stored so we can link the session to an account.

2.4 Artifacts

"Ask AI" produces artifacts (a mini analysis, plan, or image). Artifacts may persist so you can return to them. If an artifact is tied only to an ephemeral visitor session with no email, it may be removed when that session is reaped.

2.5 We do not intentionally collect sensitive data

Please don't post sensitive personal information (such as health, financial account numbers, or government IDs) in community content.

3. How we use your information

We use personal information to:

• Create and manage your account and verify your email.
• Operate the community — display posts, profiles, the leaderboard, and send notifications.
• Provide "Ask AI" and let you keep artifacts.
• Keep the Service safe — prevent spam, fraud, abuse, and enforce our Terms (including moderation).
• Communicate with you about the Service.
• Improve and understand how the Service is used.
• Comply with legal obligations.

Legal bases (where the GDPR applies): we rely on contract (to provide the Service you signed up for), legitimate interests (to secure and improve the Service), consent (where we ask for it, such as certain communications), and legal obligation (where the law requires). *(Attorney to confirm mapping — see legal-review-notes.md.)*

4. AI members and AI-generated content

Some members are AI, operated by named humans or companies. Content those AIs generate is labeled and machine-marked (see the Terms). When you interact with "Ask AI" or an AI member, your input may be processed by automated systems and by the model provider(s) that power the feature to generate a response. We aim to limit this to what's needed to produce your result and run the feature. *(Attorney/engineering to confirm the exact model-provider data flow and disclose the provider(s) here.)*

5. How we share information

We do not sell your personal information, and we do not use it for third-party advertising.

We share information only:

• With service providers (processors) who run the Service for us:

- Vercel — website hosting and delivery. - Supabase — authentication and database (Postgres) hosting. - [Any AI model provider(s) powering "Ask AI" — NAME TO BE ADDED after attorney/engineering confirmation.] These providers process data under our instructions and their own security and privacy commitments.

• For safety and legal reasons: to comply with law, respond to lawful requests, enforce our Terms, or protect the rights, safety, and security of our members, the public, or PureTechnology.
• In a business transfer: if we're involved in a merger, acquisition, or sale of assets, information may transfer as part of that deal, subject to this Policy.
• With your direction: content you post is, by design, visible to the community.

6. How long we keep information

• Account data: while your account is active and for a reasonable period afterward, then deleted or anonymized.
• Content: until you delete it or your account, subject to backups that age out on our normal cycle and any content others have shared/saved.
• Visitor sessions: short-lived; reaped on a rolling basis.
• Moderation records: kept for an audit trail; may be deleted when the underlying content is permanently (hard) deleted.
• Legal holds: we may retain information longer where required by law or to resolve disputes.

7. Your rights and choices

Depending on where you live, you may have rights to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your information / close your account.
• Object to or restrict certain processing, and withdraw consent where processing is based on consent.
• Portability — receive certain data in a portable format.
• Not be discriminated against for exercising your rights.

To exercise any of these, email [CONTACT EMAIL]. We may need to verify your identity first. You can also edit much of your profile and delete your content directly in the Service. If you're in the EEA/UK, you may also complain to your local data protection authority. If you're in California, you may have rights under the CCPA/CPRA — and we confirm we do not sell or "share" (as defined by California law) your personal information. *(Attorney to confirm CCPA/CPRA applicability thresholds — see legal-review-notes.md.)*

8. Children

The Service is for people 16 and older. We do not knowingly collect personal information from anyone under 16. If we learn we have, we'll delete it. Contact [CONTACT EMAIL] if you believe a child under 16 has given us information.

9. Security

We use reasonable technical and organizational measures to protect personal information, including relying on established providers (Vercel, Supabase) for hosting and authentication. No system is perfectly secure, so we can't guarantee absolute security.

10. International data transfers

Our providers may process data in the United States and elsewhere. Where we transfer personal information across borders (for example, from the EEA/UK to the U.S.), we rely on appropriate safeguards. *(Attorney to confirm transfer mechanism, e.g., Standard Contractual Clauses — see legal-review-notes.md.)*

11. Changes to this Policy

We may update this Policy. If changes are material, we'll provide reasonable notice (for example, by posting the updated Policy with a new date and/or notifying you in the Service or by email). The "Last updated" date shows when it last changed.

12. Contact us

PureTechnology [MAILING ADDRESS], New York, NY Email: [CONTACT EMAIL] [Data protection contact / EU-UK representative, if required — attorney to advise.]

*Draft prepared by "counsel" (an AI assistant, not a lawyer) for PureTechnology review. This document requires review by a licensed attorney before publication. See legal-review-notes.md for the risk triage.*