Skip to main content
    SpectraEYE

    Data Protection

    Last updated: 24.06.2025

    At Spectra EYE, the security of your data is a top priority. This page details the technical and organizational measures we have implemented to protect your personal information from unauthorized access, alteration, disclosure, or destruction.

    # SpectraEYE Data Protection #

    Last updated: PLACEHOLDER_effective_date

    This Data Protection page describes the technical and organizational approach used by PLACEHOLDER_company_name to protect personal data in SpectraEYE.

    This document is an implementation-ready draft and should receive final legal review before production publication.

    ## 1. Contact

    Privacy and data protection requests: privacy@spectraeye.app

    General contact: contact@spectraeye.app

    ## 2. Protection principles

    SpectraEYE is designed around:

    - data minimization;

    - purpose limitation;

    - consent by category for optional processing;

    - role-based administrative access;

    - auditability of sensitive operations;

    - retention limits;

    - secure handling of support and contact data;

    - careful use of third-party processors.

    ## 3. Security controls

    SpectraEYE uses or is intended to use:

    - secure admin authentication and session cookies;

    - MFA/passkey support where enabled;

    - role-based permissions for admin pages;

    - audit logs for sensitive admin actions;

    - hashed/masked IP display for privacy audit views;

    - explicit reveal action for full IP access;

    - input validation and upload restrictions;

    - private handling of sensitive uploads such as support attachments;

    - secure headers and production security configuration;

    - database backups before production migrations;

    - operational monitoring and system health alerts.

    ## 4. Consent records

    Consent audit records help demonstrate privacy choices. They include the consent version, action, source, selected categories, timestamp, visitor/session identifiers where available, IP hash display, full IP stored securely where required, and user-agent summary.

    The admin UI displays hashed IP by default. Full IP reveal should require an explicit action and should be audited.

    ## 5. Support chat and attachments

    Live support chat may process email identifiers, messages, attachments, timestamps, and session continuity identifiers. Support chat records and attachments are intended to be retained for up to 1 year unless a longer retention is required for legal, security, or dispute reasons.

    Users should avoid submitting unnecessary sensitive information in chat messages or attachments.

    ## 6. Newsletter and email campaigns

    Newsletter subscriptions and campaign emails are processed with SendGrid for outbound delivery and inbound parse. Data may include email address, subscription preferences, delivery metadata, bounce information, replies, and unsubscribe/suppression records.

    ## 7. Internal analytics

    SpectraEYE uses internal analytics only when the Analytics category is enabled. Analytics may include page views, click tracking, scroll depth, visitor/session identifiers, referrer, user-agent summary, and performance/SEO signals. External analytics tools such as Google Analytics, Meta Pixel, Hotjar, or Cloudflare Analytics are not used unless this page is later updated.

    ## 8. Access and least privilege

    Administrative access should be limited to users who need it. Sensitive pages such as Privacy & Consent, access management, reports, chat, contact messages, and system settings should be protected by role permissions.

    ## 9. Retention and deletion

    Retention periods should be reviewed periodically. Where data is no longer required, it should be deleted, anonymized, or minimized. Unsubscribe/suppression records may be retained to honor opt-out requirements.

    ## 10. Incident handling

    If a security incident affects personal data, SpectraEYE should assess impact, contain the issue, preserve relevant logs, notify affected users or authorities where legally required, and document corrective action.

    ## 11. International safeguards

    Where data is processed outside the EEA or the user's country, appropriate safeguards should be used where required by law.

    ## 12. Reference materials

    This data protection statement was prepared with reference to the following public legal, regulatory, and processor materials. These references support drafting and review, but they are not legal advice and do not replace final legal review before production publication.

    ## 13. Reference materials

    - Regulation (EU) 2016/679 (General Data Protection Regulation), including principles, controller/processor duties, security, breach notification, and international transfer provisions: https://eur-lex.europa.eu/eli/reg/2016/679/oj

    - Directive 2002/58/EC (ePrivacy Directive), including rules relevant to terminal equipment storage/access and communications confidentiality: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32002L0058

    - European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679: https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf

    - European Commission, data protection rules for business and organisations: https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations_en

    - European Commission, Standard Contractual Clauses for international data transfers: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en

    - Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP): https://www.dataprotection.ro/

    - Twilio Data Protection Addendum, relevant to SendGrid email processing: https://www.twilio.com/en-us/legal/data-protection-addendum

    - Twilio Website Privacy Notice: https://www.twilio.com/en-us/legal/privacy