Privacy Policy & Sovereign Data Governance

1. Introduction & Scope

eullect ("eullect", "Platform", "we", "our", or "us") provides sovereign data collection infrastructure and cryptographic credential synthesis services to institutional clients, regulatory agencies, research councils, and enterprise organizations worldwide.

This Privacy Policy describes how eullect processes, collects, uses, and protects personal data when individuals or organizations interact with our cloud platform, hosted forms, public verification terminals, and administrative consoles hosted at https://eullect.site and authorized subdomains.

2. Identity of the Data Controller

3. Categories of Personal Data Collected

We strictly adhere to data minimization principles. Depending on how you interact with eullect, we may collect:

• Account & Workspace Profile Data: Full name of administrators, professional email addresses, organization legal name, operational sector, and cryptographic password hashes.
• Form Submissions Data: When respondents complete forms hosted on eullect, the responses entered (e.g., identity details, questionnaire responses, uploaded documents, digital stylus signatures, and geospatial coordinates) are collected on behalf of the subscribing tenant.
• Document Synthesis Information: Candidate full names, identifiers (e.g., student ID, registration number), certification titles, and dates embedded into vector PDFs.
• Technical & Device Telemetry: Anonymized server logs, browser user-agent strings, IP addresses (for rate-limiting and DDoS mitigation), and session timestamps.
• Financial & Payment Data: Credit card brand, last four digits, expiry dates, and tokenized authorization references returned by our PCI-DSS Level 1 certified payment gateway (Paystack). Raw card numbers and CVVs are never received or stored on eullect servers.

4. Purpose and Legal Basis for Processing

We process personal data under the following lawful bases:

• Performance of a Contract: Providing secure data collection, generating certificates, authenticating credentials, and managing tenant accounts.
• Legitimate Interests: Enforcing zero-trust file inspection (preventing malicious binary uploads), monitoring daily burst throughput, and platform optimization.
• Legal & Regulatory Compliance: Conforming to statutory data privacy frameworks, including the Nigeria Data Protection Act (NDPA/NDPR) and the EU General Data Protection Regulation (GDPR).

5. Third-Party Data Processors

We do not sell, rent, or trade personal data to advertising networks or third-party brokers. We partner strictly with enterprise cloud infrastructure providers:

• Google Cloud Platform (GCP): Container hosting (Cloud Run), persistent databases (Firestore), task queues (Cloud Tasks), and encrypted asset storage (Google Cloud Storage) located in isolated regions (e.g., us-west1).
• Paystack Payments: Processing institutional subscription payments and recurring card-on-file tokenization in compliance with PCI-DSS standards.
• Transactional SMTP Providers: Nodemailer and secure email dispatch relays for official credential deliveries.

6. Field-Level CII/PII Redaction & Multi-Tenancy

eullect implements field-level data governance. Subscribing organizations can enforce blind review policies that automatically mask or omit Confidential Identity Information (CII)—such as telephone numbers, personal email addresses, and identification numbers—from reviewer and agent desks, preventing unauthorized internal disclosure.

7. Cryptographic Records & Immutable Ledgers

Official vector certificates, accreditation letters, and permits synthesized via our audocx engine are sealed with an irreversible SHA-256 verification hash. This hash proves the document's authenticity on our public verification terminal (/verify) without disclosing unredacted personal identifiers to the general public.

8. Data Retention & User Rights

In accordance with international privacy laws, you possess the right to:

• Access, inspect, or request an export of your stored personal data.
• Request rectification of inaccurate or outdated information.
• Request permanent erasure (Right to be Forgotten) of your account and associated form responses, subject to legitimate institutional record-keeping requirements.
• Revoke consent for automated recurring payment charges at any time from your account settings.

To exercise any of these rights, contact our Data Protection Officer at compliance@eullect.site. All requests are acknowledged and addressed within 30 calendar days.

9. Security Architecture

All data in transit is encrypted using Transport Layer Security (TLS 1.3). Data at rest in Google Cloud Firestore and Cloud Storage is encrypted with AES-256. Media uploads bypass client-supplied MIME strings and undergo binary header (magic-byte) inspection to eliminate malicious script execution.