// Legal
Privacy policy.
Template policy aligned with NDPR/GDPR principles. Review with counsel before launch.
What we collect
Contact details, identity documents, financial transactions and security logs (IP address, device).
How we store it
Operational data is kept in Cloudflare D1. Identity documents are encrypted with AES-GCM before being stored in a private Cloudflare R2 bucket. Personal data is never written to IPFS or any public network; only hashes are.
Your rights
You can request access, correction or deletion of your personal data, subject to record-keeping obligations for financial transactions. Contact compliance@gotham.example.