360REV — Privacy Policy

Effective 2026-05-11

Document version: 2026-05-11.1

1. What we collect

Account info: name, email, organization, role
Usage data: pages visited, features used, performance metrics (anonymized where possible)
Content you create: CRM records, social posts, campaigns, etc. — your data, processed on your behalf
Cookies + similar tech: see our Cookie Policy

2. How we use it

To deliver and improve the Service
To bill you and prevent fraud
To respond to support requests
To send service updates (transactional email)
To send product news, only if you opt in

3. Who we share it with

Our sub-processors — see the current list. We don't sell your personal data.

4. International transfers

We use Standard Contractual Clauses (SCCs) for EU/UK data transfers outside the EEA. The Data Processing Addendum at /legal/dpa-template documents the safeguards.

5. Your rights (GDPR + CCPA)

Right to access — request a copy of your data via Settings → Privacy → Export
Right to erasure — request deletion via Settings → Privacy → Delete account
Right to rectification — edit your data in-app or contact us
Right to portability — JSON export of all your records
Right to object / restrict processing — contact us

6. Retention

We retain your data while your account is active. After deletion: 30-day recoverable window, then 60-day retention for legal/forensic needs, then hard-purge. Audit logs are retained 7 years for SOC 2 compliance.

7. Security

Encryption in transit (TLS 1.3) and at rest (AES-256). Sensitive credentials (OAuth tokens, LLM API keys) are encrypted with a separate key. We follow OWASP Top 10 mitigations across the platform.

8. Children

360REV isn't intended for users under 16. We don't knowingly collect data from children.

9. Contact

Data protection officer: privacy@360rev.com

This document is a working draft pending counsel review and will be replaced before general availability.