Incivia Privacy Policy

DRAFT — not legal advice, not yet reviewed by counsel. This is an AI-assisted first draft grounded in Incivia's actual data practices (see docs/product/incivia_prd.md and docs/guides/backend-launch-plan.md), written to give a lawyer a real starting point instead of a blank page. Every bracketed [ ] item is a fact only the business can supply, and the state-privacy-law section in particular needs a real applicability analysis. Do not publish until a qualified attorney has reviewed it.

Effective Date: [DATE] · Version: Draft 1

1. Who This Policy Covers

This Policy describes how [LEGAL ENTITY NAME], doing business as Incivia ("Incivia," "we," "us"), handles personal information across two different relationships:

• Employers — the businesses that create an Incivia account, subscribe to a plan, and use the Service; and
• Hires — the individuals an Employer invites to complete onboarding through Incivia's hire portal, who never create an account or log in.

Where this Policy applies differently to each, it says so explicitly.

2. Two Roles: Who Controls Hire Information

If you are a Hire: the company that invited you (your prospective or new employer) decides what information is collected about you, why, and for how long — Incivia is not that decision-maker. Incivia processes your information as a service provider, on your Employer's instructions, to operate the onboarding platform they chose to use. If you have a question about your own data — why a field is required, how it will be used, or a request to correct or delete it — the fastest path is your Employer, who controls that decision. Incivia will still honor a direct request from you consistent with Section 8, and will route it to the Employer where the Employer must be the one to act.

If you are an Employer: you control the information you and your Hires submit through the Service, and you are responsible for having the legal right to direct Incivia to collect and process it, including any required notices or consents to your Hires. Incivia is the processor of that information on your behalf.

3. Information We Collect

3.1 From Employers (account holders)

• Account and contact information: name, work email, password (stored hashed, never in plain text), phone number if provided.
• Company profile: company name, industry, address, work state, website, contact email, logo, and brand color.
• Billing information: handled directly by our payment processor, Stripe — Incivia stores a reference to your Stripe customer record, not your raw card number.
• Usage information: actions you take in the dashboard (templates created, hires invited, documents edited), for the purpose of operating and improving the Service.

3.2 About Hires (collected through the onboarding portal, at the Employer's direction)

• Identity and contact: legal name, preferred name, email, phone number, home address, date of birth.
• Employment details: job role, department, manager, start date, work state, work arrangement, employment schedule, pay type, compensation and frequency, exemption status, and which policies/agreements the Employer has assigned.
• Tax withholding: Social Security number and W-4 elections (filing status, dependents, additional withholding), and state-withholding elections. Social Security numbers and bank account/routing numbers are encrypted at the field level (an envelope-encryption scheme with per-record keys) and are masked everywhere they are displayed — they are never shown or exported in full within the dashboard.
• Direct deposit: bank account and routing numbers, verified through a one-time code sent to the Hire's email on every submission and resubmission.
• Signed documents and signature records: the content of any document a Hire signs (offer letter, NDA, handbook acknowledgment, etc.), plus an audit record of that signature — typed legal name, timestamp, IP address, browser user-agent, and the associated phone-verification event.
• Uploaded documents: files an Employer's template asks a Hire to upload (for example, proof of address or a professional license) — capped at 25MB per file. Incivia never collects a Form I-9 or any immigration/employment-eligibility document, in any format, through any part of the Service.
• Emergency contact information, if the Employer's template includes that step.

3.3 Automatically collected

• Security and audit logs: IP address and user-agent recorded at the moment of signing or consent (Section 3.2), and standard server logs. Portal access tokens are never written to logs in full.
• Error and performance data: if an error occurs while using the Service, technical details (the error, the page, a general device/browser description) may be sent to our error-tracking provider to help us fix it. We do not use this to build an advertising profile.

We do not use cookies or trackers for advertising, and the hire portal requires no account or login of its own — access is by a unique link the Employer sends.

4. How We Use Information

We use the information above to:

• Operate the Service — build and render onboarding templates, run the hire portal, calculate and display default withholding information, generate and store signed documents, and route reminders;
• Verify identity and attribute actions at the moments that legally matter (phone verification before a first signature, email verification before direct deposit changes — Section 3.2);
• Communicate with you — transactional email (invites, reminders, receipts, security notices) and, if you opt in, product updates;
• Bill Employers for paid plans, through Stripe;
• Maintain security, detect abuse, and enforce our Terms of Service;
• Comply with legal obligations and respond to lawful requests.

We do not sell personal information, and we do not use Hire information collected through onboarding for advertising, for any purpose unrelated to the onboarding the Employer initiated, or for any Employer other than the one that invited that Hire.

5. Who We Share Information With

We share information with the following categories of service providers, each engaged to perform a specific function and each bound by contract to use information only for that purpose:

| Provider | Role |

|---|---|

| Supabase | Our database, file storage, and authentication infrastructure. Nearly all Employer and Hire data described in Section 3 is stored here. |

| Mailgun | Sends transactional email (invites, reminders, one-time codes, receipts) on our behalf. |

| Stripe | Processes subscription payments for Employer accounts. Stripe receives your billing details directly; Incivia does not store full card numbers. |

| [SMS provider — TBD] | Delivers the one-time verification code used before a Hire's first signature in a portal visit. [This integration is not yet live at the time of this draft; the provider will be named here once selected.] |

| Sentry | Error-tracking, to help us detect and fix bugs. Receives technical error details, not the content of your documents or hire records. |

We may also disclose information: to comply with a valid legal process; to protect the rights, property, or safety of Incivia, our users, or the public; or in connection with a merger, acquisition, or sale of assets, subject to this Policy continuing to apply to previously collected information.

6. Data Security

• Encryption in transit: all traffic to and from the Service is encrypted (TLS).
• Encryption at rest for the most sensitive fields: Social Security numbers and bank account/routing numbers are encrypted individually with per-record keys managed through a key-management service, not just at the disk level — so access to the database alone is not sufficient to read them.
• Tenant isolation: every Employer's data is isolated at the database level (row-level security), so one organization's account can never read or modify another's records.
• Access controls: access to production data is limited to what's needed to operate the Service; sensitive service-level credentials are confined to a small, reviewed set of backend operations.
• Portal link protections: a Hire's onboarding link is not indexed, does not leak through outbound links a Hire might click (no-referrer policy), is never written to logs in full, and expires automatically 30 days after onboarding is completed or cancelled.

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you as required by applicable law.

7. Data Retention

• While onboarding is active or recently completed, Hire data remains accessible through the hire portal and the Employer's dashboard.
• A Hire's portal link deactivates 30 days after onboarding is completed or cancelled; a fresh link can be issued by the Employer after that point if onboarding needs to resume.
• An Employer can permanently delete a Hire's record at any time from the dashboard. This is an irreversible action that removes the Hire's personal information, uploaded documents, and signed records, along with the underlying files in storage — not a soft delete.
• If an Employer's account is closed, we retain Customer Data for [30] days to allow export, then delete it, except where we are required to retain specific records for longer (for example, financial records related to billing) or where immediate deletion has already occurred at the Employer's direction.

8. Your Choices and Rights

Hires: Because your Employer controls what is collected about you and why, requests to access, correct, or delete your information should generally go to your Employer first. If you contact Incivia directly, we will assist and, where the request requires the Employer's action (for example, deleting your record), we will direct it to them.

Employers: You can access, edit, and export most Hire information directly from your dashboard, and permanently delete a Hire's record at any time (Section 7). You can access and update your own account and company information from Settings, and cancel your subscription at any time.

[Placeholder — confirm applicability with counsel: if Incivia has users in California, Colorado, Virginia, or other states with comprehensive privacy statutes, or in the EU/UK, add the specific rights language, request-verification process, and any required "Do Not Sell or Share" mechanism those laws require. The rights described above are a plain-language summary, not statutory language, and should not be relied on as such.]

9. Children's Privacy

The Service is intended for use by employers and working adults. It is not directed to, and we do not knowingly collect personal information from, anyone under 18. If we learn that we have collected such information without appropriate consent, we will delete it.

10. International Data Transfers

[Placeholder: state where the Service's infrastructure is hosted (region) and whether Incivia currently serves or intends to serve users outside the United States. If so, this section needs the applicable transfer-mechanism language (e.g., Standard Contractual Clauses) — not included in this draft since the current product is US-market-focused per the PRD.]

11. Changes to This Policy

We may update this Policy from time to time. If we make a material change, we will notify Employers by email or an in-product notice before it takes effect. The "Effective Date" above always reflects the version currently in force.

12. Contact Us

Questions about this Policy, or a request concerning your personal information: [PRIVACY@INCIVIA.COM] · [MAILING ADDRESS]