Understand the data boundaries and release prerequisites before considering AGINDOW. No operative legal policy is published here.
Draft disclosure
Not effective. No approved legal entity.
Version
draft-1
Source inventory reviewed
Effective date
Not effective; no approved policy date.
Responsible entity
Legal entity: unconfirmed. AGINDOW is the project name.
Contact
Legal contact: unconfirmed. General project contact: support@agindow.com; not a verified rights-request channel.
No deployed inventory approval, policy approval or provider/transfer approval is recorded. These pages describe project implementation boundaries, not an operative privacy policy, binding terms or a production assurance. The public site may be served while this record stays incomplete; trust paths stay noindex until a source-reviewed release replaces the draft.
What the local implementation handles
Processing depends on the selected SDK, capture, sink and host configuration. Nothing here qualifies production traffic. The inventory below distinguishes data and purposes from unapproved retention.
Call payloads and evidence
Explicit inspection can process request/response payload bytes, field paths, changes and verification evidence. Audit artifacts and deliberately opted-in raw samples can contain sensitive data; there is no blanket no-payload guarantee.
Purpose
Detect drift, constrain selective repair and explain call decisions.
Retention and limits
Inspection capture is bounded (8 MiB default). Guest audit is an opt-in in-memory FIFO requiring host drain. Durable archive retention is host-configured; no production period is approved.
Bounded statistical profiles, hashed value buckets, outcomes, review evidence and contribution metadata. The corpus is tenant private by default; prospective minimized sharing needs explicit opt-in and raw samples need separate opt-in.
Purpose
Compare distributions and support background investigation without an in-path database or LLM dependency.
Retention and limits
Window partitions, rollups, caches and contribution retention need an approved host policy. Revoking sharing retracts shared access; it does not erase private evidence or change pinned contracts.
Email, account/authentication records, sessions, organization memberships, invitation digests, key verification digests and attributed security receipts in the private backend.
Purpose
Authenticate, authorize tenant access and record security-sensitive changes.
Retention and limits
Host policy is unconfigured. Shared identity and append-only receipts are retained by the local governance implementation; organization deletion is not global person erasure.
Customer/subscription identifiers, approved commercial terms, usage incidents, signed event reconciliation, notification destinations and delivery history. The public site collects no payment details.
Purpose
Reconcile commercial state and deliver requested notifications through explicitly configured hosts.
Retention and limits
Commercial accounting and delivery retention require approved policy. Provisional pricing history is not a legal retention schedule; live billing and mail delivery remain unqualified.
Track approved owner instructions, scoped access and actual enforcement progress.
Retention and limits
Export expiry, backup expiry, retained audit evidence and legal holds must be accounted for in an approved policy. Missing owners or policy leave jobs pending, never completed erasure.
Public pages use no analytics scripts, browser storage or cookies. Contact, demo and launch-interest forms submit only the fields shown to an explicitly configured durable intake destination; no destination is configured in this checkout, so submissions are refused. Optional conversion analytics is unchecked by default and may receive only an allowlisted event name, never a URL, email, message or other field value. A hosting platform can process request metadata such as IP address, headers and timestamps. Deployment configs enable platform logs/traces; application code makes no third-party analytics call.
Purpose
Serve pages, accept only explicitly configured intake and diagnose operation. No advertising or behavioral tracking is implemented.
Retention and limits
Intake records carry a source-bounded 180-day deletion deadline that the configured destination must honor. Actual hosting log fields, redaction, access, destinations, regions and retention remain unapproved and must be inventoried before release.
No public rights-request form or approved legal response deadline exists. Before launch, the responsible owner must publish a verified contact and review access, correction, objection, restriction, portability, withdrawal and deletion workflows applicable to the deployed service.
The local private backend accepts organization owner export and deletion jobs after session authorization. Missing approved policy or enforcement leaves work pending. Desired consent differs from effective acknowledgements. Shared identities, append-only evidence, legal holds and backups prevent a promise of immediate or complete erasure. Export downloads are scoped and expire under approved host policy; no public dashboard workflow is claimed.
