Welcome to Inoleap. In today’s digital landscape, we believe that safeguarding your data is not just a technical requirement, but our strategic priority. This Privacy Policy explains how we collect, use, and fiercely protect your personal information.

1. Information We Collect

• Account Information: Name, email address, and authentication credentials (securely hashed).
• Usage & Device Data: IP addresses, browser types, API request logs, and platform interactions to ensure system integrity and prevent malicious activities.
• Cookies & Sessions: We use secure, strictly configured cookies (with HttpOnly and Secure flags) to manage user sessions and prevent unauthorized access.

2. How We Use Your Data

• Provide, operate, and maintain the Inoleap platform.
• Improve platform functionality and business logic.
• Monitor security events, detect anomalies, and prevent fraudulent access or privilege escalation.

3. Enterprise-Grade Data Protection

Based on comprehensive security audits and "Least Privilege" principles, we implement multi-layered security measures:

• Encryption: All data in transit is encrypted using modern protocols (TLS 1.3). Passwords and sensitive data at rest are protected using advanced cryptographic hashing algorithms (e.g., Argon2).
• Access Control: We utilize strict Role-Based Access Control (RBAC) and Multi-Factor Authentication (MFA) to prevent unauthorized access.
• Infrastructure Security: Our cloud infrastructure is protected by advanced firewalls, strict Security Groups, and continuous SIEM (Security Information and Event Management) monitoring.

4. Data Sharing & Your Rights

We do not sell your personal data. We only share information with trusted third-party cloud and security providers strictly necessary for operating our platform, under rigid confidentiality agreements.

You have the right to access, update, correct, or request the deletion of your personal data. You can manage your preferences directly in your account settings or by contacting our support team.

5. Data Retention (GDPR Art. 5(1)(e))

We retain your personal data only for as long as necessary for the purposes described in this policy, or as required by applicable law (e.g., tax and accounting regulations may require retention of financial records for 5–7 years).

Retention Periods

• Active accounts: Your data is retained while your account is active.
• Inactive accounts: If you have not logged in, made a booking, or conducted any financial transaction for 36 months, your account is considered inactive. Inactive accounts are scheduled for anonymization after a 30-day grace period, during which you can prevent it by simply logging in.
• Financial records: Transaction records, invoices, and ledger entries are retained indefinitely for accounting compliance. Only personal identifiers (name, email, phone) are anonymized; financial data remains for audit purposes.
• Consent logs: Records of your consent decisions are retained as evidence of compliance with GDPR Art. 7(1).

“Inactivity” is determined by the most recent of: your last login, your last platform activity, your last booking, or your last financial transaction.

6. Your GDPR Rights

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

• Right of Access (Art. 15): You can request a complete export of your personal data. This is available in your Privacy Dashboard under “Data Export.” The export is delivered as a structured JSON file within 72 hours.
• Right to Rectification (Art. 16): You can correct inaccurate or incomplete data in your account settings.
• Right to Erasure / Anonymization (Art. 17): You can request anonymization of your personal data from your Privacy Dashboard. Your personal identifiers are replaced with anonymized values, while financial records are retained for legal compliance. A 30-day grace period applies before anonymization is executed.
• Right to Data Portability (Art. 20): Your data export is provided in a structured, machine-readable JSON format.
• Right to Object (Art. 21): You can object to certain types of data processing.
• Right to Withdraw Consent (Art. 7(3)): You can withdraw your consent for marketing communications at any time from your Privacy Dashboard. Withdrawal does not affect the lawfulness of processing before withdrawal.

7. Consent Management (GDPR Art. 7)

When you register on Inoleap, we record your consent for the following processing activities:

• Terms of Service acceptance: Required to use the platform.
• Marketing communications: Optional. You can opt in or out at any time from your Privacy Dashboard.
• Data use for service delivery: Required to provide booking, messaging, and payment services.

Each consent decision is logged with a timestamp, your IP address, and the version of the Terms of Service you agreed to. If we update our Terms of Service, you will be asked to re-consent upon your next login. You can view your full consent history in your Privacy Dashboard.

8. Data Breach Notification (GDPR Art. 33–34)

In the event of a personal data breach, Inoleap maintains a breach notification registry and follows these procedures:

• Authority notification (Art. 33): We notify the relevant supervisory authority within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to individuals.
• User notification (Art. 34): If a breach is likely to result in a high risk to your rights and freedoms, we will communicate the breach to you without undue delay, describing the nature of the breach and the measures we are taking.
• Documentation: All breaches are documented in our internal registry, including the facts, effects, and remedial actions taken.

Georgia does not yet have a GDPR-equivalent supervisory authority. However, if EU users' data is affected, notification to an EU Data Protection Authority is required under GDPR Art. 3 (territorial scope).