Ω SYD OMEGA 91717 — Privacy Centre

YOUR DATA RIGHTS · GDPR ART. 15–22 · CCPA/CPRA

LEGAL BASIS: Legitimate Interest (progression, security audit) + Consent (analytics, marketing).
DATA CONTROLLER: S.Y.D · Lebanese Order of Engineers No. 30875
CONTACT: info@sydomega.com · privacy requests, data-rights requests and complaints
RETENTION: Profile data until erasure request. Event log: 5 years. Consent records: 10 years.
TRANSFERS: Data is stored with Supabase in its Singapore region (ap-southeast-1). No third-party data sales. Platform is ad-free.

IDENTITY DOCUMENTS

WHAT: One image or PDF of a government ID or passport, only if you choose to submit one from your Passport.
WHY: To confirm you are who your account says. Nothing is verified automatically: a person decides.
WHO SEES IT: You and the platform owner only, through a link that expires after 60 seconds. It is stored in your private folder and never shared, sold or sent to a third party.
HOW LONG: Only while it waits for review. When a decision is recorded the document is deleted; what stays is the decision and its dates, never the image. A deletion that fails stays on the owner’s list until it succeeds.
WITHDRAW: While your submission is pending you can withdraw it from your Passport. That deletes the document at once.
YOUR RIGHTS: Access, correction and erasure apply as below. Erasing your account deletes any document still stored.

⚠ PERMANENT ERASURE CONFIRMATION

This action is IRREVERSIBLE. All your progression data, axis values, task completions, and account information will be permanently deleted within 30 days per GDPR Article 17. Type CONFIRM to proceed.

LEGAL FRAMEWORK · APPLICABLE STANDARDS

GDPR 2016/679

EU General Data Protection Regulation. Articles 5, 6, 7, 15–22, 25 applied. Right of access, erasure, portability.

CCPA/CPRA 2020/2023

California Consumer Privacy Act. No dark patterns. Right to know, delete, opt-out. No sale of personal information.

ISO 27001:2022

Information security management. 93 Annex A controls. Annual risk assessment. Supabase holds SOC 2 Type II.

OWASP ASVS 2025

Application Security Verification Standard. Level 2 compliance target. RLS enforced on all tables.

PRIVACY BY DESIGN

GDPR Art. 25 mandates privacy-by-design. All features built consent-first. Default is privacy-on, not privacy-off.

DATA MINIMISATION

Only data necessary for platform function is collected. No third-party trackers. No advertising infrastructure.

SOVEREIGN PRIVACY ARCHITECTURE

ROW-LEVEL SECURITY

Every table in the Supabase database has RLS (Row-Level Security) policies enforced at the database layer. No matter what API call is made from the client, a user can only read or write their own data. Platform owners have elevated access enforced by the platform_owners table, not the profiles table, to prevent infinite recursion.

CONSENT AS SOVEREIGN ACT

Consent is not a checkbox buried in a terms page. It is a first-class data structure stored in the consent_records table with timestamps, versions, and revocation records. Every consent state is auditable. You can revoke any consent at any time and it takes effect immediately.

DATA PORTABILITY (ART. 20)

Your data is yours. The export function collects your profile, axis values, task completions, journey logs, consent records, and all sovereign metadata into a portable JSON file. You can take your data and leave at any time. The platform does not create data lock-in.

THE ERASURE PROTOCOL

GDPR Article 17 grants the right to erasure. The request_account_erasure RPC creates an erasure record and queues a 30-day deletion job. The platform sends a confirmation email. After 30 days, all personal data is permanently and irreversibly deleted from the database and all backups within the retention window.