Security and Data Handling Policy

Confirmed Safeguards

Confirmed today: the public website and the app are served over HTTPS with HSTS; secrets are server-side only, including AI provider keys and the Supabase service-role key; the browser uses the Supabase publishable anon key with row-level security and server authorization protecting sensitive data; evidence tables and evidence audit events use row-level security with anon access revoked and authenticated, scoped policies; public buckets are used only for approved public campaign and press assets, never for confidential legal evidence; and authenticated, scoped server APIs enforce user or admin scope.

Data Flow

You sign up and accept the terms; payment is processed through SureCart and its processors; account and product-lane records are created in the app and Supabase; approved public assets may live on WordPress or public Supabase storage; the app runs on Vercel using Supabase database, authentication, and storage; selected materials may be sent to OpenAI’s ChatGPT, Anthropic’s Claude, and Google’s Gemini per configuration and your approved workflows; and email may use Resend.

Commitments

HTTPS and TLS for the site, app, API calls, and vendor connections; service-role and AI keys server-side only; row-level security and authenticated access for legal and evidence records; public storage only for approved public media; legal matter access limited to you, your assigned team, authorized Good Creative Media operators, and required sub-processors; archived materials retained unless you request deletion or we correct a mistaken entry, subject to legal obligations. The account lifecycle is live: accounts move through active, disabled, archived, pending-deletion, and deleted states, with permanent deletion after a 30-day reversible grace period, run by an automated, logged process.

Additional private evidence storage, compliance inheritance language, regulated health or education compliance language, and premium AI account controls are in preparation or under review unless Julie and counsel confirm the exact settings in writing.