Legal · Review draft
Privacy policy
How information is used across this website and browser verification.
Draft updated
Review draft. This document is not yet an effective public policy or agreement.
Scope and responsibilities
MANDATE is operated by Complete Freedom Solutions LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, US. This draft describes MANDATE’s current website preview and the browser-verification service offered to website operators (“Customers”). Those are separate contexts. The website’s illustrative route decisions are examples, not observations of your visit.
For browser signals processed on a Customer’s instructions, the Customer determines the purpose of processing and acts as controller; MANDATE acts as processor. MANDATE acts as controller for its own account administration and, where enabled and approved, site measurement. Your Customer’s privacy notice and applicable agreement describe the protection used on their website.
This website
These legal pages do not activate MANDATE browser verification or MANDATE’s own site measurement. Cloudflare Web Analytics, described below, counts visits to every page of this website, including these legal pages and the blog. The marketing preview is separate from a Customer’s protected application. Hosting and other infrastructure may process ordinary request information as described below.
Delivering a page still exposes your source IP address, requested URL, and ordinary request headers to the serving infrastructure. Infrastructure access logs are separate from browser measurement. Their retention and provider details must be confirmed before public release; this page does not promise that visiting creates no records.
Information used by the service
When a Customer enables browser verification, the service uses technical browser and device characteristics, IP addresses or derived network information, connection metadata, and limited timing and session-continuity signals. These support request integrity, abuse prevention, rate limiting, and grouped security reporting.
The collector is not designed to read page content, passwords, or form entries. Some integrations bind proof to a particular request using a digest of the request body. Account administration is separate and can include a name, email address, organization membership, authentication records, and information you supply for support. The collector’s limited scope is not a promise that account or support systems never process identifying information.
Customer-facing reports present grouped evidence. Browser verification does not establish whether a human is operating the browser, and Customers remain responsible for their own access decisions.
Website analytics
This website uses Cloudflare Web Analytics to count page views and visits and to measure page-load performance. Cloudflare delivers a small script with each page that reports the page address, referring page, and load timing to Cloudflare.
Cloudflare states that Web Analytics does not use cookies or browser storage to track visitors and does not fingerprint individuals by IP address or user-agent string. As with any request, Cloudflare receives the IP address and request headers. MANDATE sees aggregated counts only, such as pages visited, referrers, countries, browser types, and load times.
Optional site measurement
A separate staging capability provides cookieless, observe-only security measurement. It is not active in this website candidate. Production activation requires privacy and legal review, a geography assessment, and a separate operator decision.
Where this capability is enabled on MANDATE-owned sites, MANDATE acts as the data controller for the limited site measurement. One grouped observation contains coarse categories for viewport size, display density, processor capacity, device memory, touch support, timezone direction, navigation type, page-load duration, and availability of selected performance and cryptography APIs.
Measurement is suppressed when the browser reports Global Privacy Control or Do Not Track. It does not read page content, form entries, credentials, or account identifiers; set cookies or browser storage; create a verification credential; collect a raw fingerprint or behavior trace; or score, enforce, or change access to the site.
The grouped record does not copy a raw IP address or user-agent string. As with any network request, the serving infrastructure necessarily receives a source IP address and request headers.
Purposes and lawful processing
Browser-verification signals support protection of a Customer’s high-value routes, consistency checks, and grouped evidence for reviewing abuse and false positives. The product is not designed for advertising or cross-site behavioral advertising.
Customers must identify the lawful basis and provide the notices or obtain the consent required for their deployment. A security purpose does not automatically establish that a particular deployment is lawful. This draft does not claim that a legitimate-interest assessment has been completed or that every deployment qualifies for a consent exemption.
Retention
Verification credentials are short-lived. Expiry of a credential does not mean all related logs, decisions, or account records have been deleted. Customer dashboard retention depends on the record type, current configuration, and applicable agreement; an account-wide deletion guarantee is not established by this draft.
For the separate staging measurement capability, accepted grouped observation records become eligible for deletion after 30 days. A dedicated retention worker runs hourly and deletes eligible records in bounded batches. Eligibility is not a guarantee of deletion at exactly 30 days. This policy does not describe infrastructure access-log retention.
Provider-specific retention, backup handling, and deletion commitments for a public service must be confirmed in the applicable notice and agreement before release.
Providers and international transfers
Service operation can involve hosting, authentication, and other infrastructure providers. Cloudflare provides content delivery, security filtering, and Web Analytics for this website. A reviewed provider list, processing locations, and applicable transfer safeguards must be confirmed before public release. This draft does not assert that standard contractual clauses or agreements with every provider have been executed.
A Customer’s processing agreement should identify the instructions, subprocessors, security responsibilities, and applicable transfer arrangements. This page does not incorporate an unavailable online data processing agreement.
Privacy requests and choices
Depending on the law that applies, you may have rights to access, correct, delete, or obtain a portable copy of personal information; restrict or object to processing; and withdraw consent where processing relies on consent. You may also be entitled to complain to your local data protection authority.
Where California privacy law applies, rights can include knowing, deleting, and correcting personal information, opting out of sale or sharing, limiting certain uses of sensitive information, and receiving non-discriminatory treatment for exercising rights. The availability of a right depends on the processing and applicable exceptions.
For processing on a Customer’s website, direct your request to that website’s operator. For an existing MANDATE account or pilot, contact your existing MANDATE representative. You can also send privacy requests to [email protected] or write to Complete Freedom Solutions LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, US. Do not send passwords, API keys, or verification credentials with a request.
The grouped site measurement does not assign a visitor identifier, so MANDATE may be unable to locate a particular observation from a name or email address alone.
Policy updates
This is a review draft dated September 27, 2026. Its only new collection is the Cloudflare Web Analytics measurement described above. The final policy must identify its effective date and explain material changes when it is approved for publication.