Privacy notice – user accounts

Controller: SJR Consulting Oy / SignaNatura Research. Contact: info@signanatura.com.

Data processed

We process email address, one-way password hash, account creation and verification times and privacy acceptance time. Verification and reset token hashes, and technical abuse-prevention identifiers, are stored temporarily.

Purpose and legal basis

Data is used to create and manage accounts, verify email addresses, and control access. The basis is provision of the service requested by the user (GDPR Article 6(1)(b)). Account registration does not constitute marketing consent.

Retention and rights

An account is held until the user deletes it or requests deletion. Verification links expire after 24 hours, password reset links after one hour, and login rate limits use a 15-minute window. Users may request access, rectification or erasure by email.

Cookies and security

Sign-in uses an essential secure session cookie. Passwords are stored as hashes. The database must be placed outside the public web root.

This notice is a launch draft. The controller must review it before registration is enabled.