Operations
Legal and privacy launch checklist
Track the owner, privacy, regulatory, retention, vendor, and deployment decisions required before a public or customer-facing release.
Publication gate
Before a public release
- Name the legal entity, public address, privacy contact, governing law, effective date, target markets, and complaint route.
- Have qualified counsel review the privacy policy, terms, cookie notice, disclaimers, consumer disclosures, IP position, and any lending or credit-intermediation classification.
- Inventory every personal-data field, processor, hosting region, wallet/explorer dependency, model provider, log, backup, and public-chain disclosure.
- Approve retention periods and deletion/exception procedures for auth nonces, sessions, audit events, worker data, support requests, and backups. Public-chain records require a separate minimisation and rights analysis.
- Complete vendor terms and data-processing agreements, international-transfer safeguards, incident response, access review, and data-subject request handling before collecting customer information.
- Decide whether a real production product needs KYC/AML, lending, outsourcing, fair-lending, consumer-credit, payments, sanctions, tax, or sector-specific controls; do not infer this from a testnet demo.
- Add a public software license or keep the repository’s no-license position deliberate and counsel-reviewed. Confirm third-party and reference-asset rights.
Current implementation boundary
| Implemented now | Still required |
|---|---|
| Public legal routes, footer links, essential-session-cookie notice, and server-side owner metadata fields. | Populate and approve owner details, then publish only counsel-reviewed text. |
| Wallet address, nonce, session, and audit records are handled by the current single-instance SQLite auth store. | Define retention/deletion schedules, production access controls, shared storage, and incident procedures. |
| Public testnet hashes and contract addresses are shown as immutable evidence artifacts. | Minimise personal data before anchoring anything and document public-chain rights/notice limits. |
| Browser demo is local fixture-only and does not request model, bank, KYC, or document data. | Complete a separate regulated-product analysis before onboarding real counterparties or making credit decisions. |
Configure owner details
LEGAL_ENTITY_NAME=
LEGAL_CONTACT_EMAIL=
LEGAL_ENTITY_ADDRESS=
LEGAL_GOVERNING_LAW=
LEGAL_EFFECTIVE_DATE=YYYY-MM-DDDocumentation is generated from the current repository contract. For the recorded testnet evidence, inspect the live proof console.