Municipal Compliance Pipeline — Privacy Policy (DRAFT v00)

NOT LEGAL ADVICE — ATTORNEY REVIEW REQUIRED. Non-attorney working draft. Have counsel confirm coverage for your actual data flows and any state privacy-law obligations before publishing.

Operator: Winschel Environmental, LLC. Effective: [DATE].

1. What we collect

• Account / authentication: your email address. MCP uses passwordless magic-link login; we do not store passwords.
• Billing: subscription and payment processing is handled by Stripe. We do not store your full card number; we retain a Stripe customer/subscription identifier and basic billing status. See Stripe's privacy policy for their processing.
• Usage: saved filters/searches, pages viewed, query/chat activity, and rate-limit counts, used to operate and improve the Service.
• Technical: IP address, browser/user-agent, and standard server logs for security and reliability.

2. What we do NOT do

• We do not sell your personal information.
• We do not share your account or usage data with third parties except the processors needed to run the Service (e.g., Stripe for billing, our email-sending provider for magic links and alerts, our hosting provider).

3. Email

We send: (a) magic-link sign-in emails, (b) subscription/billing notices, and (c) the compliance alert emails you subscribe to. Alert emails are a core function of a paid subscription; transactional and account emails are not marketing. Any optional marketing email will include an unsubscribe link.

4. Subprocessors (current)

• Stripe — payments. Resend — transactional/alert email delivery. [Hosting provider] — application hosting. Cloudflare — DNS and network. (Keep this list current.)

5. Data retention

We retain account and subscription data while your account is active and as needed for legal, tax, and accounting obligations. You may request deletion of your account; some records may be retained where law requires.

6. Your choices

Request access to, correction of, or deletion of your personal data by contacting us at the address below. (Counsel: confirm whether VA/other state privacy laws (e.g., VCDPA) impose specific rights/response timelines for your customer base.)

7. Security

We use reasonable technical and organizational measures (TLS in transit, least-privilege access, gitignored secrets). No method is perfectly secure.

8. Children

The Service is for business users and not directed to anyone under 18.

9. Contact

Winschel Environmental, LLC — P.O. Box 453, Powhatan, VA 23139 — [privacy contact email].

Changes to this policy will be posted here with an updated effective date.