Draft Privacy Notice

Historical source 2026-09-27.command5-controlled-beta-v1 · Command 10 approval evidence not recorded

Scope and information handled

External admission is currently closed. NovaBastion retains authorized Owner operations and historical controlled-beta records for security, audit, and privacy fulfillment. This draft describes data categories that could apply to a future United States private beta, including identity, invitation, session, MFA, revocation, consent, support, and security metadata.

Why it is used

Current processing supports Owner operations, security, audit, support, and privacy fulfillment. No new external application, invitation, enrollment, or account is authorized while Command 10 certification remains incomplete.

Access and disclosure

Access is limited to the Owner and authorized administrators, plus the minimum hosting, identity, security, and support processors needed to operate the service. Provider credentials stay server-only. Customer market data is not exposed in the zero-real-data beta.

Retention and requests

Information is retained only while needed for controlled-beta evaluation and operation, security, legal obligations, or verified request fulfillment. Limited immutable audit and trial-consumption evidence remains where required to prevent replay, preserve revocation, and enforce one trial per tier per account. Send access, correction, export, or deletion requests to privacy@novabastion.ai. A request is verified before action, and NovaBastion will not claim completion without processor evidence.

Security and launch boundary

Controls include Google identity, server-required MFA architecture for Owner, Admin, and future external users, short sessions, exact authorization revisions, rotation, recovery, revocation, no-store protected responses, bounded inputs, and audit events. Live external-user MFA certification and professional legal approval remain separate open requirements. No system can guarantee absolute security.