PRIVACY POLICY

Opinionan processes personal data only where legally justified, strictly purpose-limited, and fully accountable — from collection through deletion.

Commitment & Governing Principles

We commit to lawful, transparent, and proportionate handling of personal data. Every processing activity must satisfy at least one legal basis under applicable law — with no exceptions. Where consent is required, it is obtained prior to processing and remains freely withdrawable. We do not treat privacy as optional compliance; it is embedded in how we design systems, structure partnerships, and govern internal access.

Data Collection: What Enters Our Systems

Data enters our systems only when necessary to deliver or support a defined function — never by default or speculation. This includes information you actively provide (e.g., account details, payment data, contact preferences), technical identifiers (IP address, device ID, browser type), and usage signals (interaction patterns, diagnostic logs, approximate location derived from IP or GPS). We do not collect biometric, genetic, or similarly sensitive categories unless explicitly required for an authenticated service function — and even then, only under strict purpose limitation and documented justification.

Data Use: Purpose-Limited Processing

We process personal data solely to fulfill the specific, declared purposes for which it was collected — including account verification, fraud detection, service delivery, product improvement, and communication about transactions or policy updates. Any secondary use — such as analytics, research, or advertising optimization — remains bound to those original purposes unless separately justified under a lawful basis and, where required, supported by your prior express consent. Processing for safety and security (e.g., monitoring suspicious activity) relies on our legitimate interest, balanced against your rights and freedoms.

Data Sharing: Controlled Disclosure Framework

Personal data is shared outside Opinionan only under tightly constrained conditions: it may be disclosed to strategic partners exclusively to provide, improve, or advertise our products and services — never for their independent marketing initiatives without your prior express consent. Disclosures also occur where mandated: by law, legal process, litigation, and/or requests from public and governmental authorities; or where necessary for national security, law enforcement, or other issues of public importance.

Data Protection & Security Measures

We implement technical, administrative, and physical safeguards appropriate to the risk profile of the data processed — including access controls, encryption in transit and at rest, regular vulnerability assessments, and staff training on data handling obligations. These measures are reviewed periodically and adapted in response to evolving threats, but they do not override the foundational requirement that data should only be collected and retained where strictly needed.

Data Retention & Lifecycle Management

We retain personal data for as long as it is necessary to fulfill the purposes outlined in this Privacy Statement — no longer. Once those purposes are achieved, data is either securely deleted or irreversibly anonymized. A longer retention period applies only if required or permitted by law — and such extension is documented, justified, and subject to periodic review.

Your Control: Rights & Actions You Can Take

You control key aspects of how your data is handled. You have the right to access, correct, or delete your personal data; to restrict or object to its processing; to receive your personal data in a structured and standard format; and to lodge a complaint with the competent data protection authority. These rights apply across all processing activities, subject only to instances where applicable laws or regulatory requirements allow or require us to refuse to provide or delete some or all of the personal data.

Special Protections: Children & Jurisdictional Safeguards

We do not intentionally collect personal data from children under 16 — nor from individuals below the equivalent minimum age depending on the jurisdiction. If we learn that we have collected the personal data of a child under 16, we will take steps to delete that data as soon as possible. For residents within the European Economic Area (EEA), our processing of personal data requiring consent is justified pursuant to Article 6(1) of the General Data Protection Regulation (EU) (“GDPR”). This does not extend GDPR applicability beyond its territorial scope — nor does it imply global alignment where local law differs.

Policy Updates & Accountability

This Privacy Statement may be updated to reflect changes in law, technology, or business practice. Revisions take effect upon publication at https://www.opinionan.com/. Continued use of our products or services after the effective date constitutes acceptance of the revised terms. Where updates materially affect your rights, we will provide notice via email or prominent site messaging — but responsibility for reviewing changes rests with you.

How to Enforce Your Rights

To exercise any right under this policy — including access, correction, erasure, restriction, or portability — submit a verified request to cs@opinionan.com. We will acknowledge receipt within 3 business days and fulfill valid requests within less than 30 days, unless law permits or requires otherwise. For any use requiring prior express consent, you may withdraw your consent by contacting us — and we will cease that processing without undue delay.