Privacy Policy — FutureProof

Last updated: April 2026 Effective date: April 2026

This is a working draft for legal review before public publication. LE-1: Updated to reflect two-entity structure. CEO/legal sign-off required before merge.

1. Who We Are

The FutureProof platform is operated jointly by Future Proof Products Inc. (a Canadian corporation, "FP Canada") and Future Proof Products USA (a Delaware C corporation, "FP USA") (together, "FutureProof," "we," "our," "us"). Both entities are joint controllers of your personal information under this policy. FP Canada is the lead controller for Canadian users; FP USA is the lead controller for US users. The controller for your data is determined by which entity processes your transactions.

For privacy inquiries: [privacy@futureproofproducts.com]

2. What Information We Collect

Information you provide directly

• Account information: email address, password (stored as a one-way hash — we never store your plaintext password), name
• Brand/vendor application information: company name, contact email, facility location, manufacturing description, website
• Order information: products purchased, selected configuration options, shipping address, billing address
• Creator information: your public handle (if you create a creator profile)
• Buyer identity verification documents: government-issued photo ID (e.g. driver's license, passport) uploaded when you request buyer verification status. See Section 8 for the retention and destruction policy. [draft for counsel review — do not publish as final]

Information collected automatically

• Device and session data: IP address (hashed where used for fraud detection — see Section 4; remaining raw-IP write paths are being eliminated under AUDIT-PRIV-2), browser type, operating system, referring URL
• Referral and attribution data: referral codes used, timestamp of referral link click, destination postal code category (domestic vs international)
• Cookie identifiers: a randomly generated browser fingerprint token (fp_cid) used for referral attribution and fraud prevention
• Tax jurisdiction data: your country and postal code as provided during checkout, used for tax calculation

Information from third parties

• Stripe: payment status, Stripe customer ID. We do not store your full card number — Stripe handles payment processing.

3. How We Use Your Information

4. Referral Tracking and Attribution

Future Proof Products operates a creator referral program. When you click a referral link shared by another user:

• A cookie named fp_ref is set in your browser containing the referral code. This cookie expires after 30 days.
• A cookie named fp_cid is set containing a randomly generated identifier for your browser session. This is used for fraud detection only.
• A record of the click is created containing: the referral code, a one-way hash of your IP address (not the raw IP), your browser's cookie identifier, and the timestamp.

Your IP address is never stored in its raw form. It is immediately converted to a keyed one-way cryptographic hash (HMAC-SHA-256) before any database write. This hash cannot be reversed to recover your IP address. [draft for counsel review — do not publish as final]

If you complete a purchase within 30 days of clicking a referral link, the purchase is attributed to the referring user and a commission is calculated. The referral attribution is product-specific.

If you are logged in when you click a referral link, the attribution is also bound to your account, which means it persists even if you clear cookies before purchasing.

5. Cookies

We use the following cookies:

Essential cookies are required for the platform to function. They cannot be disabled without breaking core functionality including login and checkout.

Tracking and functional cookies are used for referral attribution and fraud prevention. Depending on your location, you may be asked to consent to these cookies before they are set.

If you are located in the European Union or European Economic Area, tracking and functional cookies will not be set until you provide explicit consent.

If you are located in Canada or the United States, a cookie notice will be displayed. By continuing to use the platform, you acknowledge our use of cookies as described in this policy.

6. Third-Party Services

Draft for counsel review — do not publish as final. Updated by AUDIT-PRIV-3: IP geolocation row removed; jurisdiction is now derived from Vercel/CDN edge headers without transmitting visitor IPs to any third party.

We share data with the following third parties to operate the platform:

We do not sell your personal information to third parties. We do not use your data for advertising.

7. Creator Earnings and Wallet Data

If you participate in the referral program as a creator:

• We maintain a record of your earnings, their status (pending, cleared, paid, revoked), and associated orders
• Your wallet balance (cleared earnings available for withdrawal) is stored and accessible from your account
• Earning records are retained for a minimum of 7 years for tax reporting purposes
• Revoked earnings (due to refunds or fraud) are retained in an immutable audit log

8. Data Retention

Unreconciled retention figures — pending counsel/CPA decision (do not publish as final): the financial-record rows above (Order/Creator earning/Payment) state 7 years here but 6 years in docs/DELETION-POLICY.md (CRA basis), and Audit log entries read 7 years here while the enforcement is Permanent (immutable audit trail, no destruction job). These figures are intentionally left divergent — AUDIT-PRIV-4 implements only the destruction jobs, not the policy numbers. The exact retention periods are a legal/CPA decision (the newer PRIVACY-POLICY draft is unreviewed, so CLAUDE.md's "follow the newer doc" rule does not apply). Reconcile before this policy is published.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: request a copy of the personal information we hold about you
• Correction: request correction of inaccurate information
• Deletion: request deletion of your account and personal information (subject to retention obligations above)
• Portability: request your data in a structured, machine-readable format
• Objection: object to certain processing activities
• Withdraw consent: where processing is based on consent, withdraw it at any time

To exercise these rights, contact us at [privacy@futureproofproducts.com]. We will respond within 30 days.

Note: Certain data cannot be deleted due to legal obligations (order records, tax records, audit logs for financial transactions).

10. Account Deletion

You can request deletion of your account from Account → Settings on the platform. When you request deletion:

• Your account is immediately deactivated and you are signed out
• Your personal data (name, email, phone number, avatar, bio) is anonymized
• Your email is replaced with a non-functional placeholder address
• Marketing emails are stopped immediately
• Your public profile is hidden

What is retained: Order records, payment records, tax records, payout records, and audit logs are retained for a minimum of 6 years as required by Canadian tax law (CRA) and financial compliance obligations. These records are associated with your anonymized account and cannot be linked back to your identity.

Staff accounts (Admin, Super Admin) cannot self-delete. Contact the platform owner for staff account management.

Blocking conditions: You cannot delete your account while you have open orders, pending withdrawals, open return requests, active vendor listings, or active collaboration agreements. Resolve these first, then request deletion.

If you are unable to use the self-service deletion feature, contact [privacy@futureproofproducts.com] and we will process your request within 30 days.

11. Data Portability

You have the right to receive a copy of your personal data in a structured, machine-readable format. To request a data export:

1. Go to Account → Settings on the platform
2. Click Request Data Export
3. You will receive an email with a download link when the export is ready
4. The download link expires after 48 hours

What the export includes:

• Account information (name, email, role, created date)
• Order history (items, amounts, status, tracking)
• Financial records (earnings, withdrawals — amounts only)
• Marketing consent history
• Creator referral links (if applicable)
• Collaboration agreements (if applicable)
• 3D Partner profile (if applicable)
• A list of third-party services your data was shared with

What the export does NOT include:

• Tax identification numbers (TIN/SSN/BN) — for your security
• Payment card details — these are handled exclusively by Stripe
• Raw IP addresses — these are never stored

The export is delivered as a ZIP file containing JSON and CSV files with a README explaining all fields. Only one export request can be active at a time.

12. Security

We implement the following safeguards:

• Passwords stored as one-way bcrypt hashes — never recoverable
• Session tokens signed with HMAC-SHA256
• All data transmitted over HTTPS
• IP addresses hashed (keyed HMAC-SHA-256) before storage — never stored in raw form [draft for counsel review — do not publish as final]
• Admin access logged in an immutable audit trail
• Payment data handled exclusively by Stripe — we never store card numbers
• Government ID documents stored in a dedicated private storage store (access: "private") with no public URLs; accessible only to authorized platform staff via an authenticated proxy route [draft for counsel review — do not publish as final]

13. Children

This platform is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at [privacy@futureproofproducts.com].

14. Changes to This Policy

We may update this policy as the platform evolves. Material changes will be communicated to registered users by email or prominent notice on the platform. The "last updated" date at the top of this page reflects the most recent revision.

Continued use of the platform after notice of changes constitutes acceptance of the updated policy.

15. Contact

Future Proof Products Inc. (FP Canada) Future Proof Products USA (FP USA) [privacy@futureproofproducts.com]

For users in Canada: You have the right to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca).

For users in the EU/EEA: You have the right to lodge a complaint with your local data protection authority.

FutureProof — Privacy Policy Draft v1.1 — April 2026 (LE-1 update) This document requires legal review before publication.