Privacy, consent and deletion

1. §1

   Information collected and purpose

   Support requests store your name, contact preference and contact details, selected country, scam category, incident date and description, optional loss/currency, consent and optional evidence. Case content and evidence filenames are encrypted in the application database; limited routing/status metadata is not. Staff use this information to review and coordinate support. Do not send passwords, recovery phrases or unnecessary identity or account details.

2. §2

   Private evidence and processing

   Optional evidence requires an owner account with the existing Clerk service; request-only intake remains available without an account. File bytes are kept in private object storage, not a public download directory. Servers check file type, bytes and limits and sanitize images. Malware scanning is used only when a real scanner is configured; unscanned PDFs and scanning failures stay quarantined. Only administrators and currently assigned coordinators can review case evidence through access-checked delivery.

3. §3

   Retention and erasure

   Cases and linked evidence expire 90 days after intake. Unattached uploads expire after 24 hours. Privacy requests, replies and export approvals expire after 30 days, or earlier when a linked case expires or is erased. Exports are generated from current records when you download; extra personal-data snapshots are not kept. Cleanup runs at startup and approximately hourly while the server is running; an idle server may delay physical removal. Expired data is blocked from access. Storage failures remain queued for retry, with identifying upload metadata scrubbed; staging deletion is retried beyond the 15-minute signed-upload window. Audit records are retained for at most 180 days; linkable case/request history is removed on erasure.

4. §4

   Access, correction and deletion

   Your case reference plus private deletion token proves ownership for access and correction requests and immediate case deletion. A reference alone is insufficient. Staff review access/correction requests; a private receipt lets you check their response and download an approved export. Exports cover submitted case information, consent, status, evidence inventory and related privacy requests, not automatically internal staff notes or attachment bytes; use a concern to ask about additional records. Each privacy receipt can also erase that privacy request without deleting the case. Erasing a case removes all associated privacy requests, replies and export approvals, so their receipts stop working.

5. §5

   Providers and AI

   The application uses Replit hosting, PostgreSQL and private App Storage, Clerk for account/session services, and OpenAI through Replit AI Integrations for optional assistant messages and conversation context you choose to submit. SASN does not currently store assistant conversation text in its database; the browser holds the current interaction. The AI provider processes submitted text under its own terms. Case files and privacy requests are not automatically sent to AI. Optional SMTP and malware-scanning services process only the information needed when configured; their operator-specific identities and agreements must be confirmed.

6. §6

   International transfers

   Hosting, identity, AI, email and scanning providers may process information in countries different from yours. The actual deployment region, provider locations, contracts and transfer safeguards must be confirmed by the operator; no residency guarantee or legal transfer certification is claimed. Use the published privacy contact or save a concern to ask for verified details before sharing sensitive information.

7. §7

   Cookies and browser storage

   SASN uses essential Clerk authentication/session technology when you sign in and a first-party language-preference cookie, normally lasting up to one year. Clerk may also use browser storage for authentication and abuse prevention; its duration follows the configured session/provider settings. Form contents and privacy tokens are not saved in local storage or token URLs. No analytics, advertising or non-essential tracking was added. A tracking-consent banner is therefore not used; adding non-essential tracking requires a fresh inventory and appropriate consent first.

8. §8

   Privacy inquiries and complaints

   Operator identity and contact information come from the maintained published organization record, not invented addresses. A saved privacy concern receives an encrypted database record and private receipt; it is not an external email or regulator submission. Administrators handle unlinked concerns; assigned coordinators can handle linked-case requests. Keep the receipt private and check the recorded response before expiry. Applicable legal rights and complaint routes depend on your jurisdiction and require verified operator/legal guidance.

9. §9

   Stored support conversations

   Signed-in support conversations store encrypted message text, language, country, status, assignment and timestamps for 30 days from creation, or until an earlier linked-request expiry or deletion. Owners can access, download, correct their own messages and delete conversations through signed-in controls. Only administrators and eligible assigned coordinators may read transcripts. Incoming queues reveal limited metadata before an authorized claim. AI mode requires separate consent and sends only AI-consented visitor messages and AI replies to OpenAI through the configured Replit integration, never staff replies, linked case details or uploaded files. Provider processing and retention follow the provider's terms; deleting SASN records does not certify erasure of provider-held data. Real staff availability expires after 90 seconds without renewal and never promises acceptance or a response time. The existing standalone assistant remains separate and does not store its transcript in SASN's conversation database.

10. §10

    Security metadata and account records

    Rate limits use a keyed hash of the connecting IP address, not a stored raw IP, in counters that expire within about one hour. Application request logs record request identifiers, method, route and response status, not form bodies or private tokens. Hosting and identity providers may process IP addresses and other operational/security metadata under their own settings; the operator must confirm their retention. Case erasure does not automatically delete your separate Clerk account, staff authorization records or provider-held operational records. Use the published contact or a privacy concern to request a separate review of those records; no unverified provider-erasure guarantee is made.

The operator must obtain appropriate legal review, confirm provider contracts and international-transfer safeguards, and verify these disclosures before launch.