Ownward Hub Privacy Policy

1. Controller, Scope, and 18+ Audience

Adrian Obed Rojas Holdings LLC operates Ownward Hub. This policy covers account and service use across Ownward websites/apps. Services are intended for adults 18+.

2. Categories of Data We Process

• Account/authentication data, profile details, and business identity records.
• Workspace and listing data (public listings and private drafts).
• Bookkeeping records (revenue, expenses, invoices, receipts, categories, notes).
• Valuation inputs, adjustments, estimates, scenarios, confidence scores, and report snapshots.
• Business-health and sale-readiness responses, evidence, and generated recommendations.
• CRM leads/contacts, activities, revenue records, and pipeline opportunities/offers.
• Messages, blocks, reports, and conversation metadata.
• Deal-room invitations, members, files, requests, checklist/activity events, access/download events, IP/user-agent logs where captured by service infrastructure.
• Support requests, Academy progress (optional local), planner progress (optional local), and community pulse submissions with optional name/email.
• Subscription, Stripe customer IDs, payment status, and transaction/billing records.
• Device/browser/log/diagnostic analytics data and generated inferences from user-provided business information.

3. Categories of Sources

• Directly from you.
• From collaborators, buyers, sellers, and deal-room participants you invite or interact with.
• Automatically from browser/device/service usage.
• From providers such as Stripe, Supabase, and Vercel.
• From other users who communicate or transact with you.

4. Purposes and Legal Bases

• Provide, secure, maintain, and improve services (contract/performance and legitimate interests).
• Authenticate users and prevent abuse/fraud/security threats (legitimate interests and legal obligations).
• Process subscriptions, billing, and support operations (contract and legal obligations).
• Generate informational scores, valuations, recommendations, and workflow insights (contract and legitimate interests).
• Respect consent choices for optional analytics/functionality processing (consent).

5. Disclosures and Recipients

• Supabase (auth, database, storage).
• Stripe (checkout, subscriptions, payment processing, billing records).
• Vercel (hosting and consent-controlled web analytics).
• Google Analytics 4 (consent-controlled web analytics with advertising and personalization disabled).
• Advisors, authorities, or counterparties where required by law, legal process, abuse/security response, or corporate transaction.

6. Public vs Private Content and Participant Access

Published listing fields are publicly visible. Draft/private workspace content is access-controlled. Users, collaborators, buyers, sellers, and deal-room participants with granted access may view/download/retain data shared with them. Ownward may access content where reasonably necessary for support, security, abuse prevention, legal compliance, and operations.

7. Upload Authority and Sensitive Data Guidance

• Upload data about others only when you have lawful authority.
• Redact Social Security numbers, government ID numbers, full bank details, card details, passwords, authentication credentials, and unnecessary sensitive data before upload.
• Stripe handles payment-card details; Ownward should not be used to store full card numbers.

8. Cookies, Local Storage, and Consent Controls

• Necessary: Supabase auth/session cookies, security/session operations, NEXT_LOCALE preference cookie, and consent-state storage.
• Functionality consent gates optional local persistence keys: ownward_academy_progress_v1, ownward_start_business_plan_v1, ownward_visitor_token.
• Analytics consent gates both Vercel Web Analytics and Google Analytics 4 loading/event flow.
• Ownward analytics sanitization strips fragments, keeps only allowed campaign parameters, and redacts known private dynamic IDs/tokens before events are sent.
• Google Analytics consent mode is configured with security storage granted, analytics storage denied by default, and advertising/personalization storage denied.
• Google explains partner-site data processing here: https://policies.google.com/technologies/partner-sites
• Ownward does not currently sell personal data or share for cross-context behavioral advertising/targeted advertising based on current implementation.

9. Automated Outputs

Valuations, scores, and recommendations are informational workflow outputs and are not used as significant automated eligibility decisions for credit, employment, housing, insurance, or similar legal effects.

10. Retention Criteria

Retention depends on account status, feature usage, support/security needs, billing/dispute/fraud prevention, legal obligations, and enforcement needs. Fixed retention timers are not universally implemented across all records.

11. Security and International Processing

Ownward uses technical/organizational safeguards and provider controls, but no system is perfectly secure. Processing may occur in jurisdictions outside your own through infrastructure providers and service operations.

12. Privacy Rights, Verification, and Appeals

• You may request access, correction, deletion, export, restriction, or objection where applicable law grants those rights.
• Submit requests to ownwardhub@gmail.com; we may verify identity before fulfilling requests.
• If we deny or limit a request, you may reply to request reconsideration/appeal and we will review according to applicable law.
• We may retain data needed for billing, disputes, fraud prevention, security, legal obligations, or terms enforcement.

13. Policy Changes and Contact

We may update this policy. Material updates may require acknowledgment/notice in-product. Optional new processing still requires separate consent when applicable.

Contact: ownwardhub@gmail.com. Correspondence address: 5900 Balcones Drive STE 100, Austin, TX 78731 (mail only, not walk-in).