Privacy Notice
Draft, version 0.1, 13 September 2026. Not yet approved.
Who is responsible
[StrategiHub legal name], [address], United States, is the controller of the personal data described here. Contact: [privacy email].
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Email address, display name or handle | To confirm your request, send status emails and show your name in the queue | Contract |
| Your submission (link, text) and note to the creator | To fulfil the request | Contract |
| Payment status and amounts | To run the queue, issue refunds and keep accounts | Contract, legal obligation |
| Language, market and technical logs | To show the site in your language and keep it secure | Legitimate interest |
| For creators: identity and bank details | Collected directly by Stripe for payouts and verification; InnerPortal only sees verification status | Legal obligation, contract |
Card numbers never reach InnerPortal; they are entered on Stripe's checkout. We do not use advertising cookies or third-party trackers. The only cookies are the sign-in session and your language choice.
Who sees your data
- The creator sees your display name, submission, note and payment status for requests you made to them. They do not see your email address in the queue.
- Other viewers see only display names and positions in the public queue.
- Processors: Supabase (database, authentication, realtime; hosted in the EU, Ireland), Stripe (payments), Vercel (hosting), Resend (email). Each processes data under a data processing agreement.
We do not sell personal data.
International transfers
InnerPortal is operated from the United States and stores its database in the European Union. Transfers between the two rely on standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.
Retention
Request and payment records are kept for as long as needed for accounting and dispute handling, [7] years for financial records. Guest tracking links do not expire during the Alpha. You can ask us to delete your account and non-financial data at any time.
Your rights
Depending on where you live (EU and UK GDPR, California CPRA and similar laws) you can ask to access, correct, delete or export your data, object to processing, or lodge a complaint with your supervisory authority (in the Netherlands: Autoriteit Persoonsgegevens). Email [privacy email]; we respond within 30 days.
Children
InnerPortal is not directed at children under 16. Creators must be 18 or older.
Changes
We will post changes here with a new version date.