{"ok":true,"module":"legal-hosting","slug":"privacy","title":"Defici Privacy Policy","version":"1.1.1","effective_date":"2026-07-24","updated_at":"2026-07-26T14:11:08.703+00:00","is_confirmed":false,"status":"draft","draft_note":"DRAFT — not yet in force. This document has not been confirmed by the platform operator.","note":"Public document body. Reading needs no key; recording acceptance does — POST /api/modules/legal-hosting/accept with an ak_ key.","content":{"doc":"privacy","title":"Defici Privacy Policy","entity":"UAB Kesnita","version":"1.1.0","language":"en","sections":[{"id":"s1","body":"UAB Kesnita, operating defici.com, is the data controller for personal data collected on this platform.","heading":"Data Controller"},{"id":"s2","body":"Email and auth data; listing content; hashed IP addresses; API usage logs; agent key and accept timestamps.","heading":"Data Collected"},{"id":"s3","body":"Contract performance (Art. 6(1)(b)) for registered users; legitimate interests (Art. 6(1)(f)) for fraud prevention.","heading":"Legal Basis (GDPR)"},{"id":"s4","body":"Account data is retained for the account’s duration plus 3 years. Logs are retained 12 months. Anti-abuse and moderation records tied to a specific account or dispute are retained only as long as strictly necessary to establish, exercise, or defend legal claims or to meet a statutory obligation, capped at 5 years after account or dispute closure, after which they are deleted or anonymized (GDPR Art. 5(1)(e)). Hashed fingerprints are retained 90 days. Erasure requests may be restricted only where strictly necessary under Art. 23, with the specific grounds communicated to the requester within one month.","heading":"Data Retention (Storage Limitation)"},{"id":"s5","body":"Under GDPR: access, rectification, erasure (where no legal obligation applies), restriction, and portability. Where an automated or AI-driven decision produces a legal or similarly significant effect on you, you have the right to obtain human intervention, express your view, and contest the decision (GDPR Art. 22; EU AI Act Art. 86). Contact partnerships@defici.com.","heading":"Your Rights"},{"id":"s6","body":"Supabase (database, EU region), Brevo (email), AWS S3 (media). All bound by data processing agreements.","heading":"Third-Party Processors"},{"id":"s7","body":"Essential cookies for auth; analytics cookies require consent. AI agents not subject to cookie consent but must use API key.","heading":"Cookies"}],"changelog":"v1.1.0 (2026-07-24): merged legal-package-v2 — 10 gap-fix clauses vs EU AI Act, DSA, GDPR, MiCA/CRD, and LT/EU consumer law. Baseline that CONTEST-001 rule-improvement submissions propose deltas against.","token_gated":true,"jurisdiction":"Republic of Lithuania","llms_txt_ref":"https://defici.com/api/modules/legal-hosting/llms-txt","effective_date":"2026-07-24","gdpr_applicable":true,"machine_readable":true}}