Home / Data Policy

Data Policy

Transparent data handling for federated architecture

Last Updated: January 23, 2025

Executive Summary

This Data Policy explains how MAGENTA and the broader CMYK ecosystem collect, process, store, and protect data. As a federated platform, we implement strict data isolation and privacy-by-design principles to ensure your data remains under your control.

Core Principle: Your data belongs to you. We are merely custodians providing infrastructure and tools to help you leverage that data effectively while maintaining complete control and privacy.

Data Architecture

Federated Model

Our federated architecture ensures complete separation between different organizations and clients:

┌─────────────────────────────────────────┐ │ CMYK ECOSYSTEM │ ├─────────────┬─────────────┬─────────────┤ │ CYAN │ MAGENTA │ YELO │ │ Analytics │ APIs │ Content │ ├─────────────┴─────────────┴─────────────┤ │ KEY │ │ Core Infrastructure │ └─────────────────────────────────────────┘

Data Isolation Levels

Level Isolation Method Access Control
Database Separate schemas per tenant Row-level security
API Tenant-specific endpoints API key + tenant validation
Storage Isolated S3 buckets IAM policies per tenant
Cache Namespaced Redis keys Key prefix isolation

Data Collection Methods

First-Party Collection

We prioritize first-party data collection through:

Automatic Collection

Certain data is collected automatically when you use our services:

No Third-Party Tracking: We do not use or allow third-party tracking pixels, cookies, or scripts on our platform. All tracking is first-party only.

Data Processing

Real-Time Processing Pipeline

Event → Validation → Enrichment → Storage → Analytics ↓ ↓ ↓ ↓ ↓ Rate Schema Geolocation Database Aggregation Limit Check Device Info + Cache + Reporting

Data Enrichment

We enrich collected data with:

Enrichment Type Data Added Purpose Can Disable?
Geolocation Country, city, region Geographic analytics Yes
Device Detection Device type, OS, browser Compatibility tracking Yes
Time Zone Local time, UTC offset Time-based analysis No
Session Linking Session ID, duration User journey tracking Yes

Data Storage

Storage Locations

Encryption Standards

At Rest: AES-256-GCM encryption for all stored data
In Transit: TLS 1.3 for all API communications
Key Management: AWS KMS with automatic key rotation
Secrets: AWS Secrets Manager with versioning

Backup and Recovery

Data Access Controls

Role-Based Access Control (RBAC)

Role Access Level Permissions
Owner Full All data, settings, billing, user management
Admin Administrative Data access, settings, user management
Developer Technical API access, webhooks, integrations
Analyst Read-only View analytics, export reports
Viewer Limited View dashboards only

API Authentication

Data Sharing

Within CMYK Ecosystem

Data sharing between CMYK services follows strict protocols:

Third-Party Sharing

We do not sell your data. Period. Data is only shared with third parties when:
  • You explicitly request an integration
  • Required by law (with notification when legally permitted)
  • Necessary for service operation (e.g., SMS delivery via Twilio)

Service Providers

We work with select service providers who process data on our behalf:

Provider Service Data Shared
AWS Infrastructure All data (encrypted)
Twilio SMS/OTP Phone numbers only
Stripe Payments Billing information
SendGrid Email Email addresses, content

Data Retention

Default Retention Periods

Data Type Active Retention Archive Period Total Retention
Analytics Events 90 days 2 years 2 years
QR Code Data Indefinite N/A Until deleted
API Logs 30 days 60 days 90 days
Error Logs 7 days 23 days 30 days
User Accounts Active 30 days post-deletion Until purged

Custom Retention

Enterprise customers can configure custom retention periods to meet compliance requirements. Options include:

Data Portability

Export Formats

You can export your data in multiple formats:

Export Methods

GDPR Compliance: We support full data portability as required by GDPR Article 20. Request your data at any time through the dashboard or by contacting privacy@comma.cm.

Data Deletion

User-Initiated Deletion

You can delete your data through:

Deletion Process

1. Soft Delete → Data marked for deletion (recoverable for 30 days) 2. Hard Delete → Data permanently removed from primary storage 3. Backup Purge → Data removed from all backups (within 35 days) 4. Confirmation → Deletion certificate provided

Right to be Forgotten

Under GDPR and similar regulations, you have the right to request complete erasure of your personal data. We will comply within 30 days unless:

Compliance & Certifications

Current Compliance

In Progress

Audit Reports

Annual compliance reports are available upon request for Enterprise customers. Contact compliance@comma.cm for access.

Incident Response

Security Incident Protocol

  1. Detection: Automated monitoring and alerting (< 5 minutes)
  2. Assessment: Severity evaluation and impact analysis (< 30 minutes)
  3. Containment: Isolate affected systems (< 1 hour)
  4. Eradication: Remove threat and patch vulnerabilities (< 4 hours)
  5. Recovery: Restore normal operations (< 8 hours)
  6. Notification: Inform affected users (< 72 hours if required)
  7. Review: Post-incident analysis and improvements (< 1 week)
Breach Notification: In the unlikely event of a data breach affecting your personal information, we will notify you within 72 hours via email and dashboard notification.

Data Protection Officer

Scott Derozic

Title: Data Protection Officer
Email: privacy@comma.cm
Phone: +1 (310) 907-6310
Office Hours: Monday-Friday, 9 AM - 5 PM PST
Response Time: Within 48 hours

For urgent data protection matters, please email urgent-privacy@comma.cm for priority handling.

Updates to This Policy

This Data Policy may be updated periodically to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes through:

You can always find the current version of this policy at magenta.comma.cm/data-policy with a complete revision history available upon request.