LEGAL

Privacy Policy

Pre-launch draft. Custodian is currently in development. This Privacy Policy will be reviewed and finalized before public launch once the production infrastructure, analytics providers, payment providers, subprocessors, retention periods and account-deletion procedures have been confirmed.

Last updated: September 24, 2026

1. Introduction

This Privacy Policy explains how Custodian collects, uses, stores, discloses and otherwise processes personal information when individuals use the Custodian mobile application, website, support services and other related products or services.

Custodian is being developed as a business contact-management platform that allows organizations and authorized users to organize professional contacts, companies, notes, tags, reminders, follow-ups, relationship information and other business-related records.

This Privacy Policy applies to personal information processed directly by Custodian in connection with the operation of the service.

Additional terms may apply where Custodian processes information on behalf of a business customer.

2. Who is responsible for your information

The legal entity responsible for operating Custodian will be identified in this Privacy Policy before the public launch of the service.

Depending on how Custodian is used, Custodian may act in different capacities with respect to personal information.

For information relating directly to Custodian accounts, website visitors, support requests, subscriptions and the operation of the platform, Custodian may determine how and why that information is processed.

For business contact information uploaded or entered into a workspace by a customer, the business customer may determine the purpose for which that information is used, while Custodian provides the technology used to store and process the information.

Where required, the relationship between Custodian and business customers may be governed by additional data-processing terms.

3. Information we collect

The information Custodian processes will depend on how the service is used and which features are enabled.

4. Account information

When a user creates or manages a Custodian account, we may process information such as:

• Full name.
• Email address.
• Telephone number, if provided.
• Profile photograph.
• Password-related authentication information.
• Account identifiers.
• Account preferences.
• Language preferences.
• Workspace membership.
• User role and permissions.
• Account creation and modification dates.

Passwords should not be stored in readable form. Authentication systems may instead store secure password hashes or rely on specialized authentication providers.

5. Workspace and organization information

Business customers may provide information concerning their organization or workspace.

This may include:

• Business or organization name.
• Business logo.
• Industry.
• Business contact information.
• Workspace settings.
• Workspace membership.
• User roles and permissions.
• Subscription information.
• Administrative preferences.

6. Contact records entered by users

Custodian is designed to allow authorized users to store business contact records.

These records may contain personal information relating to individuals who do not themselves have a Custodian account.

Depending on what a user chooses to store, a contact record may include:

• First and last name.
• Job title or professional role.
• Company or organization.
• Email address.
• Telephone number.
• Professional social-media profile or website.
• Country, city or business location.
• Profile photograph.
• Industry.
• Business category.
• Relationship stage.
• Priority level.
• Tags and classifications.
• Professional interests.
• Business relationship information.
• Notes entered by authorized users.
• Follow-up information.
• Interaction history.

Custodian does not require users to store every category listed above. Users and organizations determine what information they enter into the service.

7. Notes and user-generated content

Users may be able to create notes, reminders, comments, tags or other information associated with contacts or companies.

These fields may contain personal information depending on what the user chooses to enter.

Users should avoid entering unnecessary sensitive information into free text fields.

8. Contact photographs and uploaded files

Custodian may allow users to upload profile photographs or other supported files.

Uploaded files may be stored using cloud-storage infrastructure and may contain metadata associated with the uploaded file.

Users are responsible for ensuring that they have the right to upload and use any images or materials they provide to Custodian.

9. Follow-ups and reminders

When users create follow-ups or reminders, Custodian may process information including:

• Reminder title.
• Date and time.
• Associated contact or company.
• Notes.
• Reminder status.
• Notification preferences.

10. Technical and device information

When Custodian is accessed, certain technical information may be collected automatically to operate, protect and improve the service.

This may include:

• Internet Protocol address.
• Device type.
• Operating system.
• Application version.
• Browser type and version.
• Language settings.
• Approximate location derived from an IP address.
• Date and time of access.
• Authentication events.
• Crash information.
• Error logs.
• Security events.
• Basic usage and performance information.

11. Precise location information

Custodian's current product concept does not require continuous precise location tracking for its core contact-management functionality.

If a future feature requires access to precise device location, Custodian will request any required device permission and update this Privacy Policy where appropriate before such processing is introduced.

12. Device contacts

Custodian may in the future provide an optional feature allowing users to import selected contacts from their device.

If this feature is introduced, access to device contacts will require the relevant device permission where required.

Custodian will describe how imported contacts are processed before the feature is made publicly available.

13. Business-card scanning

Custodian may introduce optional business-card scanning functionality in a future version.

Such functionality could process images and text contained on business cards in order to create or update contact records.

If third-party optical-character-recognition or artificial-intelligence services are used for this purpose, relevant information about those providers will be added to this Privacy Policy before the feature is released.

14. Information collected through the website

Visitors to the Custodian website may provide information through forms or other interactive features.

For example, an early-access form may collect an email address so that a person can receive product or launch information.

The website may also generate standard technical information such as IP addresses, browser information and server logs.

15. Cookies and similar technologies

Custodian may use cookies, local storage or similar technologies where necessary to operate the website, maintain sessions, remember preferences, protect the service or understand how the website is used.

If optional analytics, advertising or other non-essential tracking technologies are introduced, appropriate information and consent controls will be implemented where required.

A separate Cookie Policy may be published if necessary.

16. Information from third-party integrations

Custodian may in the future allow users to connect third-party services such as email providers, calendars, cloud-storage providers or other business tools.

If a user chooses to connect an integration, Custodian may receive information authorized by the user through that integration.

Custodian will only request permissions reasonably necessary for the relevant integration.

Third-party integrations may also be governed by the privacy policies and terms of the relevant service provider.

17. How we use personal information

Custodian may process personal information for purposes including:

• Creating and maintaining user accounts.
• Authenticating users.
• Providing access to authorized workspaces.
• Storing and displaying contact records.
• Organizing companies, tags, notes and segments.
• Providing search and filtering functionality.
• Managing follow-ups and reminders.
• Synchronizing information across authorized devices.
• Providing collaboration functionality.
• Responding to support requests.
• Providing requested account or privacy services.
• Detecting and preventing fraud, misuse and unauthorized access.
• Monitoring security and reliability.
• Diagnosing technical problems.
• Improving product performance and usability.
• Complying with applicable legal obligations.
• Establishing, exercising or defending legal claims.
• Communicating important service information.
• Sending marketing communications where permitted.

18. Legal bases for processing

Where applicable privacy law requires Custodian to identify a legal basis for processing personal information, the applicable basis will depend on the circumstances.

Processing may be based on:

• The need to provide a service or perform a contract requested by the user.
• Legitimate interests in operating, protecting, improving and supporting Custodian, provided those interests are not overridden by applicable privacy rights.
• Compliance with legal or regulatory obligations.
• Consent, where consent is required or otherwise appropriate.
• Other lawful grounds available under applicable privacy legislation.

19. Business customers and uploaded contact information

Businesses using Custodian are responsible for determining whether they are legally permitted to collect, store and use the personal information they enter into the service.

Business customers should provide any notices, obtain any permissions or consents, and establish any other lawful basis required for their own processing activities.

Custodian does not independently verify the legal basis used by every business customer for every contact record submitted to the service.

20. Sensitive personal information

Custodian is intended primarily for ordinary professional and business contact information.

Users should not use Custodian to store highly sensitive personal information unless such use is expressly supported by the service and the user has an appropriate lawful basis for doing so.

Depending on applicable law, sensitive information may include categories such as medical information, biometric information, political opinions, religious beliefs, sexual orientation or other specially protected data.

21. How we share information

Custodian does not intend to sell private workspace contact databases as public contact lists.

Personal information may nevertheless be disclosed where reasonably necessary to operate the service.

22. Service providers

Custodian uses third-party infrastructure and service providers to operate its application and website.

Current technology providers include:

• Supabase: Authentication, database services, private file storage, and server-side application functions.
• Netlify: Hosting the Custodian website and supporting website forms where those features are enabled.
• Apple: Distribution of the iOS application and operation of relevant Apple device and application services.

These providers process information according to their respective roles in delivering the services used by Custodian.

Custodian may introduce additional providers for services such as support, analytics, email delivery, or payment processing in the future.

Material changes affecting how personal information is processed will be reflected in this Privacy Policy where required.

23. Workspace members

Information stored in a business workspace may be visible to other authorized members of that workspace depending on their role and permissions.

Users should understand that information they enter into a shared workspace may be accessible to their organization and other authorized members.

24. Legal and safety disclosures

Custodian may disclose information when reasonably necessary to:

• Comply with applicable law.
• Respond to lawful requests from authorized authorities.
• Protect the rights, property or safety of Custodian or others.
• Investigate fraud, abuse or security incidents.
• Enforce applicable agreements.
• Establish, exercise or defend legal claims.

25. Corporate transactions

Information may be transferred as part of a merger, acquisition, financing, restructuring, sale of assets or similar business transaction.

Where required, appropriate notice or other protections will be provided in connection with such a transaction.

26. We do not make private contacts public by default

Contact information stored inside a private Custodian workspace is not intended to become publicly searchable merely because it has been entered into Custodian.

If Custodian introduces public profile, directory, sharing or networking features in the future, such features will be separately designed and appropriate privacy controls will be implemented before launch.

27. International data transfers

Custodian may use service providers or infrastructure located in countries different from the country in which a user resides.

As a result, personal information may be transferred to or processed in other jurisdictions.

Where applicable law requires safeguards for international transfers, Custodian will implement appropriate mechanisms for those transfers.

Additional information concerning production hosting locations and transfer mechanisms will be added once the final infrastructure has been selected.

28. Data retention

Custodian intends to retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to provide the service and meet legitimate legal, accounting, security or operational requirements.

Retention periods may vary depending on the type of information and the reason it is processed.

Factors considered may include:

• The length of the customer relationship.
• Whether an account remains active.
• The instructions of a business customer.
• Legal and regulatory requirements.
• Security and fraud-prevention needs.
• Dispute-resolution requirements.
• Backup and disaster-recovery processes.

29. Backups

Information deleted from active systems may remain temporarily in secure backups until those backups are automatically overwritten or deleted in accordance with applicable retention procedures.

Backup copies are generally maintained for recovery, resilience and security purposes rather than ordinary operational use.

30. Account deletion

Custodian provides an account-deletion process within the mobile application under Profile, Privacy & Security, and Delete Account.

Users must verify their identity and complete the required deletion confirmation.

Account deletion removes the user's authentication account, profile, applicable personal settings, workspace memberships, and associated personal profile images, subject to successful completion of the deletion process.

Business information contained in another owner's shared workspace may remain available to its authorized members. Such information is also subject to applicable privacy rights and the responsibilities of the relevant business customer.

Workspace owners may need to transfer ownership or separately delete their owned workspaces before deleting their personal accounts.

Additional cleanup procedures may be required for stored contact photographs.

Records held for legal compliance, security, dispute resolution, or backup purposes are subject to the retention rules described in this Privacy Policy and applicable law.

Read Account & Data Deletion →

31. Data security

Custodian intends to use reasonable technical and organizational measures designed to protect information against unauthorized access, alteration, loss, misuse or disclosure.

Depending on the production architecture, measures may include:

• Encrypted network communications.
• Secure authentication mechanisms.
• Role-based access controls.
• Database-level authorization controls.
• Restricted administrative access.
• Secure development practices.
• Logging and security monitoring.
• Backup and recovery procedures.

No electronic system can guarantee absolute security.

Users are also responsible for maintaining the confidentiality of their login credentials and protecting devices used to access Custodian.

32. Data breaches and security incidents

Custodian intends to maintain procedures for investigating suspected security incidents.

If a security incident creates notification obligations under applicable law, Custodian will take appropriate steps to provide required notices to affected customers, users, authorities or other relevant parties.

33. Your privacy rights

Depending on where you live and the circumstances of the processing, you may have rights relating to your personal information.

These may include rights to:

• Request access to personal information.
• Request correction of inaccurate information.
• Request deletion of personal information.
• Request restriction of certain processing.
• Object to certain processing.
• Request portability of certain information.
• Withdraw consent where processing relies on consent.
• Opt out of certain marketing communications.
• Lodge a complaint with an appropriate regulatory authority.

These rights are not absolute and may be subject to exceptions under applicable law.

34. Requests involving business workspace data

If a privacy request concerns information entered into Custodian by a business customer, Custodian may need to refer the request to that organization.

This is because the organization may be responsible for deciding how and why that information is processed.

Custodian may assist business customers with privacy requests where required by applicable agreements or law.

35. Verification of privacy requests

Custodian may need to verify the identity or authority of a person making a privacy request before disclosing, changing or deleting information.

Verification procedures are intended to prevent unauthorized individuals from gaining access to another person's information.

Only information reasonably necessary to verify the request should be requested.

36. Authorized representatives

Where permitted by applicable law, an individual may be able to authorize another person to make a privacy request on their behalf.

Custodian may request evidence that the representative has appropriate authority to act for the individual.

37. Marketing communications

Custodian may send product announcements, launch information, educational content or other marketing communications where permitted.

Marketing emails will include a reasonable method for unsubscribing where required.

Users may still receive non-marketing messages necessary for the operation of their account, such as security notifications or important service communications.

38. Automated decision-making

Custodian's current V1 concept does not rely on automated decisions that produce significant legal or similarly significant effects on users.

If materially different automated decision-making functionality is introduced in the future, this Privacy Policy will be updated where required.

39. Artificial intelligence features

Custodian may introduce optional artificial-intelligence features in the future, such as intelligent search, contact enrichment, summarization or relationship assistance.

Before such features process user or workspace information, Custodian will evaluate the relevant privacy implications and update this Privacy Policy where appropriate.

The current Privacy Policy should not be interpreted as authorization for Custodian to use private workspace contacts for unrelated artificial intelligence training purposes.

40. Children

Custodian is a business-oriented service and is not designed for use by children.

Custodian does not intentionally seek to collect personal information directly from children through personal accounts.

Minimum age requirements and any additional age-related restrictions will be finalized before public launch based on the jurisdictions in which the service is made available.

41. Links to third-party websites

Custodian may contain links to websites, social-media profiles or services operated by third parties.

Custodian is not responsible for the privacy practices of independent third-party services.

Users should review the privacy policies of those services before providing information to them.

42. App stores

Custodian may be distributed through third-party application stores.

App-store providers may independently process information associated with application downloads, purchases, devices or user accounts under their own privacy policies.

43. Payment information

Custodian does not currently offer paid subscriptions or in-app purchases and does not require payment-card information to use the application.

If paid Custodian subscriptions are introduced, payment processing may be handled by an external payment provider or application-store platform.

Custodian does not intend to store complete payment-card numbers directly unless specifically required and supported by appropriate payment infrastructure.

The relevant payment providers will be identified before paid subscriptions become publicly available.

44. Changes to this Privacy Policy

Custodian may update this Privacy Policy when the service, legal requirements, infrastructure or business practices change.

The updated version will be published on the Custodian website with a revised "Last updated" date.

Where required or appropriate, users may also receive additional notice of material changes.

45. Privacy contact

A dedicated privacy contact address and the legal identity of the entity responsible for Custodian will be added before public launch.

Once available, users will be able to use that contact method for privacy questions, requests concerning personal information and complaints about Custodian's handling of personal data.

46. Complaints

If you believe Custodian has processed personal information improperly, you may contact Custodian using the privacy contact method that will be published before launch.

Depending on applicable law and your location, you may also have the right to raise a complaint with an appropriate privacy or data-protection authority.

47. Related documents

You may also review the following Custodian documents:

• Terms & Conditions →
• Support Center →
• Account & Data Deletion →

48. Pre-launch status

Custodian has not yet reached its final production configuration.

Before public launch, this Privacy Policy should be reviewed against the actual application and website to confirm that it accurately describes:

• The legal entity operating Custodian.
• The countries in which Custodian operates.
• The final hosting provider.
• The final authentication provider.
• The production database infrastructure.
• The storage infrastructure.
• Analytics tools.
• Error-monitoring services.
• Email providers.
• Notification providers.
• Payment processors.
• Customer-support services.
• International data transfers.
• Retention periods.
• Account-deletion procedures.
• Data-export procedures.
• Cookie and tracking technologies.
• Any artificial-intelligence functionality.

The final policy should reflect Custodian's actual data practices rather than relying on assumptions made during development.