Privacy Policy
Last updated: 12 October 2026
This policy explains what personal data CivilOS™ (civilos.in) collects, why it is collected, how long it is kept and what rights you have. It is written to align with India's Digital Personal Data Protection Act, 2023 (DPDP Act).
1. Who we are
CivilOS is an independently developed civil-engineering platform operated from Jaipur, Rajasthan, India by Abhimanyu Tiwari, who acts as the Data Fiduciary for the purposes of the DPDP Act.
Contact for privacy questions: info@civilos.in · +91 8005983291
2. What we collect, and why
2.1 If you do not create an account
You can use most of CivilOS without signing in. In that case your drawings, plans, BOQs and models are stored only in your own browser (localStorage / IndexedDB) — they are never uploaded to us.
| Data | Why |
|---|---|
| A random visitor ID (stored in your browser) | To count visitors and distinguish new from returning, and to count how many visitors came back on how many days of a week or a month — shown to us only as totals, never as a list of visitors — without identifying you |
| Page views, time spent per section, how many times each section was opened, which section you started in, the hour you arrived, time zone | To understand which tools are actually useful, and when |
| Approximate city/country, derived from your IP address | Basic audience geography. Your IP address is never written to our records — only the resulting city/country label is retained. To avoid looking the same address up twice we keep a short-lived cache keyed by a one-way keyed hash of the address, so the address itself cannot be read back out of our files. See 2.1.1 for who performs the lookup. |
| Device class (mobile / tablet / desktop), operating system family, browser family, a band of your window width, your browser's language, and whether you opened CivilOS as an installed app | To know what CivilOS must run well on. These are stored only as counts against a date — for example “Android 3, Chrome 4, 400–639 px 2” for a given day. They are not kept against your visitor ID, and no fingerprint of your device is built or stored for visitor statistics. (If you send us feedback and fill in the form, that submission does carry your browser's user-agent string — see section 2.6.) |
| How long the page took to load, in milliseconds | To notice when CivilOS gets slower. Kept as a daily average only |
| The CivilOS app: that the “Get the app” box was opened and which button opened it, that Install was pressed and what your browser's own prompt answered, that the app was installed and what it was installed on (Android, iPhone/iPad or a computer), that the install link was copied or sent, and the first time CivilOS is opened as an installed app | To know whether people can find the app and finish installing it. Each is a count against a date — for example “Get the app opened 12, installed 3, Android 2” — and is not kept against your visitor ID. Your own browser remembers, on your device, that it has been counted today, so that we can count people and not presses |
| The text of an error, if CivilOS breaks while you are using it | To find and fix faults. This is the error message our own code produced — not your drawing, your project or anything you typed |
| Referring website (the site you clicked through from), if any | To know where visitors find us |
All of the above is first-party: it is recorded by our own server and shared with no advertising or analytics company. It is aggregated into daily counts, and the reports we look at are counts — never a list of individuals.
2.1.1 Who resolves the city/country
We do not maintain our own address-to-location database. To place a visit in an approximate city, your IP address is sent, over an encrypted HTTPS connection, to one of two specialist providers, which return an approximate city and country and nothing else:
- ipapi.co (Kloudend, Inc., United States) — primary lookup
- ipwho.is (ipwhois.io) — used only when the first does not answer
These are the only parties to whom we deliberately send your IP address for a lookup; they receive nothing else about you, and they receive it at most once per address — a repeat visit is answered from a cache keyed by a one-way hash, so no second lookup is made. We previously used a third provider that could only be reached over an unencrypted connection; it has been removed.
To be complete about it: any server your browser connects to necessarily sees your IP address, because that is how the internet delivers a reply. That includes our own host, the content-delivery network in front of it, the web-font service and the map-tile services — all named in section 4. We do not send them anything about you beyond the request itself, and we do not receive your address back from them.
Where our network provider has already told us the country, that country is used without contacting anyone whenever a city lookup is not made — if the lookup is switched off, if the daily lookup allowance is exhausted, or if neither provider answers. If you would rather this lookup did not happen at all, write to us at the address in section 6 and we will exclude you.
2.2 If you create an account
Since 5 September 2026 the engineering modules (IndoCAD, BIM, Indo-Revit, Interior Studio, Quantity Survey & BBS, BOQ, Cost Estimator, Scheduler, QA/QC, Live Site Audit, Indo MIS / DPR, Contract & Tender Evaluation, Team Workspace, Site Geo and Consult to Engineer) require a free account, and each plan carries a monthly allowance per module. The Dashboard, Knowledge Library, Training Corner, Space Planning and Feedback remain open without an account.
| Data | Why |
|---|---|
| Name and email address | To identify your account and let teammates recognise you; the email is your login id |
| Password | Stored only as a salted scrypt hash — we cannot read or recover your password |
| Company or organisation, location (city/country), and whether your use is professional or personal | Asked at sign-up so we can understand who CivilOS serves and plan the product; all three are optional and editable in My Account |
| Mobile number (optional) | Only for one-time codes: recovering a forgotten password or login id. Verified numbers are also how "forgot my login id" finds your email |
| Google account id and email, if you choose Continue with Google | Google LLC confirms that you own the email; we store Google's stable account id to recognise you next time. Your Google password never reaches us |
| One-time codes sent by email or SMS | Stored only as a salted hash for 10 minutes; at most 5 wrong guesses. After 15 wrong codes for one account within an hour, no code is checked for that account for the next hour — for this, the time of each wrong code is kept for an hour, against the account and against a one-way hash of the email or number the code was sent to |
| Session cookie | To keep you signed in. Strictly necessary; no advertising or tracking cookies are used. The cookie holds a random token; our database keeps only a one-way hash of it. A session lasts 30 days from the last time you used CivilOS |
| A device number: a random number given to your browser when you create an account or sign in, kept as a cookie and as a copy in the browser's storage, together with which accounts have been used with it | To apply the Free plan fairly: its allowance is counted once per device, across every free account used on it (section 2.2.4). The number is random — it is not worked out from your screen, fonts, hardware or anything else about the device, so no fingerprint is built. It is not used for advertising or to follow you across websites, and paid plans are not limited by it. Signing out leaves it in place, because it belongs to the device and not to the person |
| Your email address in its plain form — for example a.b+site@gmail.com read as ab@gmail.com | To keep one free account per mailbox. Addresses from throw-away email services are refused at sign-up |
| At sign-up: the time, the device number, and a one-way keyed hash of your network address | To notice a run of new accounts made from one network, and then ask for the email address to be confirmed by a one-time code. The address itself is never written down, and the entry is deleted after 35 days |
| Whether you use CivilOS as an installed app: the date you first and last opened it that way, the date it was installed, and the kind of system (Android, iOS, Windows, macOS, Linux or ChromeOS) | To know how many accounts use the app and on what, so that we build for it. One word for the system; nothing else about the device |
| Your consent: the date, the version of the Terms and this Policy you accepted, how (the sign-up form or “Continue with Google”), and that you confirmed you are 18 or older | To show what you agreed to, and when |
| On your device: your name, email and plan, remembered in the browser for up to 14 days | So the installed app can open with no signal. Signing out removes them — together with saved MIS passcodes and drafts, your signature image, the auditor details and the Assistant chat — so a shared phone keeps nothing of yours |
| Plan, subscription term, and usage meters (how many messages, drawing reads, exports; how many minutes a module was open) | To apply the allowance of your plan and show you what is left. Hours are counted only while a module is open and the tab is visible. We also email you a welcome note when you sign up, and a reminder a week before a paid term ends, the day before, and when it has ended |
| When you use CivilOS while signed in: for each day, how many visits you made (a visit ends after 30 minutes without use) and the first and last moment of use that day | To know how often CivilOS is used and by which accounts, so that we can plan the product and look after the people who rely on it. Nothing about what you did, and nothing about the device. Kept 400 days and deleted with your account; My Account → Download everything about me includes it |
| Use of the AI features: for each day and each module (Consult to Engineer, the drawing reads, Smart assist, and so on), how many requests your account made, their size in tokens — the unit the AI service charges in — and which AI model answered | To know what the AI costs to run, by module and by account, and to keep it within what a plan can carry. Counts only — never what you asked or what was answered. My Account → Download everything about me includes yours |
| Your letterhead (company, brand, logos, client name and logo, creator name) if you set one | Printed on your documents on paid plans in place of the CivilOS letterhead |
| Team name, role, membership, activity log | To operate teams, roles and permissions |
| Project data you choose to save to the cloud | Only when you press "Save my work" or "Save to team" |
2.2.1 Payments
Paid plans are billed through Razorpay Software Pvt. Ltd. (Bengaluru, India). When you choose a plan you are sent to a page hosted by Razorpay, and that is where you enter UPI, card or net-banking details — they are never entered on, sent to, or stored by CivilOS. Razorpay tells us that a payment succeeded, its reference number, the amount and the plan it was for; we keep that record with your account (it is your receipt and our accounting record) and Razorpay receives your name, email and, if you gave one, mobile number so the payment page can be pre-filled. Prices are set in Indian rupees; a daily exchange-rate lookup for the display of other currencies carries no data about you.
If a payment page you opened is not paid, we keep with that payment record what Razorpay reports about a failed attempt — whether you, your bank or the payment service stopped it, its reason code and its short description — and the next time you open CivilOS we may ask you, once, what stopped you. Answering is optional; your answer and any words you add are kept with the same record, to find faults in our payment page and to plan our prices.
If you give a GSTIN, business name and state at checkout, they are kept with the payment and printed on the GST tax invoice. Payment records and tax invoices are kept for as long as Indian tax and accounting law requires (currently 8 years) — also after you delete your account, when they are kept without the link to it.
2.2.3 Error reports
When CivilOS hits an error in your browser, a short technical report — the error message, the address of the page inside CivilOS and your browser type, never your project content — is sent to our own server so we can fix it. It is kept in our server logs, which our host keeps for a limited period.
Our pages tell your browser to run only the code our own site serves. If your browser blocks something because of that rule — most often a script a browser extension tried to add — it may send our server a short security report on its own. We keep only which rule was broken, the site the blocked item came from, and the page and file of ours it happened in (never anything after the “?” in an address), in the same server logs — nothing about you.
2.2.2 Security log
To protect accounts and the service we keep a log of refused requests: wrong passwords, too many sign-in attempts, wrong one-time codes, forged payment signatures, requests for paths that do not exist on this site (automated scanners), and similar. Each entry records the time, the kind of event, the network part of the IP address only (for example 49.36.x.x), a one-way keyed hash of the address, the browser's user-agent string, the country if our network provider supplies it, and — where the request was made from a signed-in account — that account's email. Entries are deleted after 180 days, the period India's cyber-security agency (CERT-In) requires logs of this kind to be kept.
2.2.4 One Free allowance per device
The Free plan's monthly allowance is meant for one person trying CivilOS, so it is counted once per device and once per mailbox. This is how, and what is kept for it:
- Per device. What counts against a Free allowance is what has been used this month by every free account that has been used on the same device, added together. A second free account on a device therefore starts where the first one stopped. An account on a paid plan is counted by itself alone.
- Per mailbox. One free account per mailbox; a second spelling of the same mailbox is refused.
- Confirming your email. A new account made with a password is asked to confirm its email address by a one-time code before it uses a Free allowance if the device already has an account, or if several accounts have just been made from the same network; we may also ask it of every new account. It is asked once. Accounts made with “Continue with Google” are not asked, because Google has already confirmed the address.
- If you delete your account. Your account and everything in it are deleted as section 6 says. So that deleting an account and making it again does not start a new allowance, the month's usage figures are kept for up to 45 days against a one-way keyed hash of your mailbox — not your address, which cannot be read back out of it — together with the device numbers the account was used with. If you make the account again within that time the figures are handed back to it and this record is deleted.
Refusals made under these rules — a throw-away address, a second account on a mailbox, a request to confirm an email, an allowance already used on the device — are written to the security log (section 2.2.2), with the email address that was typed. My Account → Download everything about me includes what is held under this section for your account.
2.3 Live Site Audits
| Data | Why |
|---|---|
| Site photographs you capture | Inspection evidence attached to your audit record |
| GPS coordinates and accuracy | To stamp where an inspection took place. Location is requested with your device's permission and can be refused — audits still work without it |
| Auditor name, designation, company; contractor name | To make the audit record meaningful and attributable |
| An approximate place name for the photograph you take | Site photographs are stamped with the coordinates, the date and time, and the name of the place. We do not hold a gazetteer, so your coordinates are rounded to about 11 m and sent from our server — never from your phone — to OpenStreetMap’s Nominatim service, which returns the name of the village, town, district and state. Nominatim never receives your IP address, your identity, or the exact fix. The name is optional: refuse it, be offline, or simply type the location yourself and the audit works unchanged. Your full-precision GPS fix is stamped on the photo on your own device and is never sent to the naming service |
An audit that cannot upload (no signal, or the server refused it) waits on your phone until it uploads or you discard it. It carries a random receipt number, so a retry is never filed twice, and your account id, so on a shared phone it is filed only under your name.
2.3.0 Site Geo: the search box
Coordinates, map links (Google Maps, OpenStreetMap, Apple Maps) and plus codes that you type or paste into Site Geo's search box are read on your own device and are not sent anywhere; so are the towns in its built-in list and the names of the shapes on your own map. Two things cannot be read on the device:
- A name — a road, a village, a landmark — when you press Enter. The words you typed are sent from our server to OpenStreetMap’s Nominatim, together with the rough area the map is showing (rounded to about 11 km) so that nearby answers come first. Nominatim never receives your IP address. Answers are kept on our server for a day so that the same search is not sent twice; the words are not stored with your account.
- A short Google Maps link (
maps.app.goo.gl/…). Only Google knows where it points, so our server asks Google and hands the long link back to your device. Our server only ever contacts Google’s own map addresses for this, and Google sees our server, not you.
The last eight places you found are remembered on your device only. The map pictures themselves come straight to your browser from the providers named in section 4.
2.3.1 Indo MIS / DPR
Daily progress reports and the weekly and monthly MIS are kept on our server so that the people on a project can work on the same report. They hold what you type into them: quantities, manpower and plant numbers, materials, hindrances, safety and quality counts, site photographs, and — in the Financial MIS — the budget, the bills and the payments of the project. They also hold the name, position, company and signature of the people who prepared, checked and approved each report, the names and logos of the client, consultant and contractor you enter, and a history of who saved, submitted or approved a report and when.
Who can see them. The members of your team whom your Admin has put on that project — and, for the Financial MIS, only those the Admin has allowed into it (for everyone else the financial part is removed on our server before the report is sent). If your Admin creates a passcode, anyone signed in to CivilOS who is given that passcode can see what the Admin ticked for it — the MIS, its financial part, or the inspection records — for the projects chosen, until the passcode expires or is switched off. Reports are not shared with anyone else and are not used for advertising or to train AI. Deleting a project deletes its reports; disbanding a team deletes all of them.
The camera and your location are used only to take the site photographs you choose to add. CivilOS keeps a note on your own device that the browser has allowed the camera or location before, so that it can tell you how to stop your phone asking every time; that note is never sent to us.
2.3.2 Reminders that reach your phone (notifications)
Reminders are off unless you switch them on. If you also switch on “Notify this phone even when CivilOS is closed”, your browser asks its own notification service for an address at which that one browser can be reached, and gives that address to us. We keep it against your account together with your time zone (so that “17:30” means 17:30 where you are) and a short description of the browser, and we use it for one thing only: to send you the reminders you have set, and a test message if you press “Send a test”.
The message is encrypted on our server for your browser alone before it leaves; the notification service carries it and cannot read it. Which service that is depends on your browser, not on us: Google (fcm.googleapis.com) for Chrome, Edge and every Android browser, Mozilla (updates.push.services.mozilla.com) for Firefox, Apple (web.push.apple.com) for Safari and for CivilOS installed on an iPhone or iPad, and Microsoft (notify.windows.com) for older versions of Edge. They see that a message was sent to that address and when; they do not see its contents, your name or your project. We send no e-mail and no SMS for reminders.
Switching it off on a device deletes that device’s address from our server at once. An address is also deleted when the notification service tells us the browser has unsubscribed (for example after the app is uninstalled), and when you delete your account.
2.3.3 Contract & Tender Evaluation
Tenders are kept on our server (compressed) so that the people preparing one can work on it together and open it from any device. A tender holds what you put into it: the client's bill of quantities you import, your quantities, rate analyses and rates, the quotations of your vendors and subcontractors with their names and terms, your overheads, profit and final rates, frozen versions of the tender, the documents register and your pre-bid queries. Your firm's rate library (resources with the history of each rate, analysis templates and imported schedules of rates) is kept the same way, together with an index of every priced item so that earlier rates can be searched. A short history records who created a tender, changed its status or froze a version, and when.
Who can see them. A personal tender (one you create without a team) is seen by you alone. A team tender is seen by the members your Admin has given tender access; if it is restricted, only by the people named on it, its creator and the Admin (a copy of a restricted tender is restricted to the same people). The commercial part — overheads, the escalation allowance, profit, the quoted rates and the prices of frozen versions — is sent only to those the Admin has allowed to see the margins; for everyone else it is removed on our server before the tender is sent, and the costs they receive are before any escalation allowance. Tenders and libraries are not shared with anyone else, not used for advertising and not used to train AI. Deleting a tender deletes it, its versions and its searchable rates; deleting your account deletes your personal tenders and library; disbanding a team deletes the team's. The download of your data (My Account) lists the tenders you created and includes your personal tenders in full.
2.4 Task management
If you assign a task to someone, you may enter their name, email and WhatsApp number. You are responsible for having a lawful basis to share their details with us. This information is used only to label the assignment and to let you send them their task list; we do not message them ourselves — WhatsApp and email are opened on your own device for you to send.
2.5 AI features
When you use the AI Engineer, quantity takeoff or drawing-reading features, the text and any file you attach are sent to Anthropic PBC (our AI provider) for processing, and the answer is returned to you. Do not paste confidential or personal data you are not permitted to share. See Anthropic's privacy terms at anthropic.com/legal/privacy.
2.6 Feedback & Rewards
CivilOS asks for feedback — from a link in the app, and occasionally from a prompt that appears as you are leaving a page. Everything on that form is optional, including every contact field. If you choose to fill them in, we store what you wrote (what you liked, what should improve, what you would like built, and which parts of CivilOS you have used) together with:
| Data | Why |
|---|---|
| Your name, email address, phone number, city, your role and your employer — each optional | To reply to you, and to enter you in the Prime User rewards pool if you asked to be. We do not use these for marketing and we do not share them |
| An optional screenshot or PDF you attach | To see the problem you are describing |
| If you are signed in when you send it: your account (its number, name and email) | So that we can reply, and a reward can reach your account without asking for your address again |
| The section of the app you were in, and your browser's user-agent string | To reproduce a fault on the same kind of device. The user-agent is stored with your submission, so unlike our visitor statistics this record is not anonymous |
If we reward your feedback — for example with a free term of a paid plan — we keep a record of what was promised or given and when, against your email address, so that it reaches you and is not given twice. A plan given this way is switched on for that email address, now or when it signs up. The record is deleted with your account, and My Account → Download everything about me includes it.
You can ask us to delete a feedback submission, and everything in it, at any time — write to the address in section 6 and we will remove it.
3. What we never do
- We do not sell your personal data, ever.
- We do not use advertising or third-party tracking cookies.
- We do not share your data with third parties for marketing.
- We do not read your password — it is technically impossible for us to do so.
4. Where your data is stored
Account and project data is stored on servers operated by Render Services, Inc. in the United States, on an encrypted persistent disk. Backups are taken at every restart and every six hours; the two newest and one for each of the last seven days are kept on the same encrypted disk. Because of this, your data is transferred outside India. Sub-processors we rely on:
- Render Services, Inc. — application hosting and database storage
- Anthropic PBC — AI processing of prompts you submit
- Razorpay Software Pvt. Ltd. (India) — payment processing for paid plans (see 2.2.1); it receives your name, email and optional mobile number, and handles your payment details itself
- Google LLC — only if you sign in with Google: confirms your email and gives us a stable account id (see 2.2)
- Brevo (Sendinblue SAS, France) or Resend, Inc. (United States) — delivers one-time codes, receipts and account emails; receives your email address and the message
- MSG91 (Walkover Web Solutions, India) — delivers one-time codes by SMS; receives the mobile number and the code
- Your browser’s notification service — Google (
fcm.googleapis.com), Mozilla (updates.push.services.mozilla.com), Apple (web.push.apple.com) or Microsoft (notify.windows.com) — only if you switch on “Notify this phone”: carries your reminders to your device, encrypted so that it cannot read them (see 2.3.2) - ipapi.co (Kloudend, Inc., United States) and ipwho.is — approximate city/country from an IP address, for visitor statistics (see 2.1.1)
- OpenStreetMap Foundation (Nominatim) — turns a rounded coordinate into a place name for site-photo geo-tags (see 2.3). It receives a coordinate rounded to about 11 m and nothing else. It also answers Site Geo's search by name (see 2.3.0): the words searched and the map's rough area, from our server, never your IP address
- Google LLC (Google Maps) — only when you paste a short Google Maps link into Site Geo's search: our server asks Google where the link points (see 2.3.0)
- Google Fonts — web fonts; OpenStreetMap / Esri / Carto / OpenTopoMap — map tiles in the GIS module
- Cloudflare, Inc. — the content-delivery network that sits in front of our host. Every request to civilos.in passes through it, so it sees your IP address and the address you asked for. It does not receive your account data or anything you type
5. How long we keep it
| Data | Retention |
|---|---|
| Account, teams, cloud projects, audits, tasks | Until you delete them or ask us to delete your account |
| Login sessions | 30 days after you last used CivilOS (renewed while you use it); a password change ends every other session |
| Earlier saves of a cloud project | The last five saves of each project, deleted with the project |
| Password reset codes (team Leader codes) | 30 minutes |
| One-time codes by email / SMS | 10 minutes, stored as a hash; the times of wrong codes, one hour |
| Usage meters | Per calendar month (or week); kept as history while the account exists |
| Visits of a signed-in account (how many a day, first and last moment) | 400 days; deleted with the account |
| AI usage counts (requests and tokens, per day and module) | 400 days. If you delete your account they stay in our totals with no link to you |
| Payment records and tax invoices | As long as Indian tax and accounting law requires (currently 8 years), also after the account is deleted — then without the link to it |
| Subscription terms | While the account exists |
| Your consent record | While the account exists |
| Security log (section 2.2.2) | 180 days |
| Safety backups of the server (to recover from a failure) | Up to 7 days: the two newest copies, plus the newest of each of the last seven days. Anything you erase — a record, a module (Format) or your account — leaves them within that time |
| Device number and the accounts used with it (section 2.2.4) | 400 days after the device was last used with CivilOS; the link to your account is deleted with the account |
| Sign-up entry: time, device number, keyed hash of the network address | 35 days |
| Usage figures of a deleted free account, against a keyed hash of its mailbox | Up to 45 days, or until the account is made again |
| Use of the installed app, on your account | While the account exists |
| Team activity log (who in a team did what, and when) | Two years; older entries, and any beyond the newest 50,000, are removed. Each entry is sealed with a hash of the one before it so the team's Admin can check that nothing in it was altered. Deleted with the team |
| 7-day cloud vault (passcode-protected temporary storage) | 7 days, then automatically deleted |
| Locally saved projects in your browser | 180 days from last opening (on your device only) |
| Aggregate visitor statistics | Retained as anonymous totals; not linked to any identified person |
| Feedback submissions (section 2.6), including any contact details and attachment you chose to give | Kept while we act on them; deleted on request |
| Rewards for feedback (section 2.6) | While the account exists; deleted with it |
6. Your rights under the DPDP Act
You have the right to:
- Access the personal data we hold about you — in the app: My Account → Download everything about me gives you one file, straight away
- Correct or complete inaccurate data
- Erase your data and close your account — My Account → Delete my account (records the law requires us to keep, such as payments and tax invoices, stay without the link to you)
- Keep your own copy, and erase a part — every module's Backup & Format button, and My Account → Backup centre, download that module's work (what this device holds and your records on our server) as one file on your own device; Format erases a module's data on purpose, after three confirmations and your password
- Withdraw consent at any time (note that some features will stop working)
- Nominate another person to exercise your rights in the event of death or incapacity
- Grievance redressal — raise a complaint with us first; if unresolved, you may approach the Data Protection Board of India
To exercise any of these, email info@civilos.in with the subject "DPDP request". We aim to respond within 30 days.
Grievance Officer: Abhimanyu Tiwari, founder — info@civilos.in, subject “Grievance”.
7. Children
CivilOS is a professional engineering tool intended for users aged 18 and above. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
8. Security
We use HTTPS everywhere, hashed passwords, optional two-step sign-in with an authenticator app, HttpOnly session cookies, rate limiting, a strict Content Security Policy, and AES-256-GCM encryption for the passcode vault. No system is perfectly secure; if we become aware of a personal data breach we will notify affected users and the Data Protection Board as required by law.
9. Changes to this policy
We may update this policy as CivilOS develops. The "last updated" date at the top always reflects the current version, and material changes will be announced in the app's Training Corner.