Draft Privacy Policy

This draft explains the information expected to be processed when a business owner requests and verifies a trial account for Washly.

The signup flow may collect the following information:

• Business name, type, email, and optional CVR number.
• Owner name, email, optional phone number, and a securely hashed password.
• Selected plan, locale, timezone, and accepted legal-document versions.
• Verification and email-delivery status, timestamps, and security attempt counters.

Information is used to validate the request, prevent duplicate trials, send and verify a secure email link, provision an authorised tenant in a later step, protect the service, and maintain required legal evidence.

Passwords are hashed before storage. Verification tokens are stored only as cryptographic hashes, expire after a limited period, and are subject to resend and attempt limits.

The current technical default expires and redacts unverified signup secrets after 30 days. Final retention periods for verified, provisioned, rejected, billing, and support records require legal approval.

Email and infrastructure providers may process limited data to operate the service. A final policy must identify approved processors, data locations, safeguards, and any international transfers.

Depending on applicable law, individuals may have rights to access, correct, erase, restrict, or object to processing and to lodge a complaint. The final policy must explain how to exercise these rights.

This draft will be replaced. The signup API records the accepted document version so a changed version can require renewed review and acceptance.