POL-001 — Customer Data Rights

1. You own your data and your record. Evidence, claims, history — yours. We are custodians.
2. Full export, always, in open formats (JSON claims + manifest + originals), within 30 days, at no charge beyond media-scale costs, including after termination.
3. Read-only, least-privilege access. Our integrations cannot write to your systems; access scopes are listed before you grant them.
4. We don't keep your source code. Reviews extract facts; code is discarded after fact extraction; retained snippets require explicit per-snippet consent.
5. We never collect credentials or secrets (redacted on sight), production end-user personal data, or anything outside the declared scope. Accidental ingestion is a disclosed incident: quarantined, deleted, reported to you.
6. Instant revocation. Kill any access you granted, yourself, effective immediately, with no retaliation in product behavior.
7. Deletion that means deletion. On request or termination: your evidence and claim content is deleted (backups within 35 days), certified in writing. What survives: the issuance log — artifact hashes, dates, claim-type counts, approver roles — retained for record integrity and containing no confidential content. Its schema is disclosed to you up front.
8. No training of shared models on your content without explicit, informed, revocable, granular opt-in — default off, permanently (CON-001 P4).
9. No sale or licensing of customer-derived intelligence. Aggregated benchmarks only with opt-in, a k≥20 anonymity floor, published methodology, and a retroactive exit right (CON-001 P7).
10. Access transparency. Every human and system access to your data is logged and available to you; our subprocessors are published with advance change notice and an objection right.
11. We tell you when the law comes. Legal or government requests for your data are disclosed to you unless we are legally prohibited; we challenge overbroad requests; request counts appear in the transparency report.