Comigence

1. Overview & Contracting Entity

This Privacy Policy explains how Comigence (“Comigence”, “we”, “us”, or “our”) collects, uses, and safeguards information when you visit our website at comigence.com or access our feature request management and product prioritization software platform.

[Founder Input Required]: Exact legal contracting entity name, corporate registration number, registered jurisdiction, and registered office address.

2. Information We Collect

We limit data collection strictly to what is required to provide the Comigence service, evaluate access requests, and secure our systems:

Early Access & Inquiries: When you submit a Request Access form, we collect your business email address, and optionally your job title/role and company name.
Customer Account & Workspace Data: Authorized administrators may input customer organization names, corporate domain names, customer account tiers, and contract revenue metrics (MRR/ARR) to enable commercial prioritsation evaluation.
Voter Identity & Verification: When a user submits or votes on a feature request, we collect their corporate email address and issue a 15-minute cryptographically signed verification link to establish authentic account affiliation via domain heuristics.
Administrator Credentials: Workspace administrator emails and passwords (the latter stored solely as irreversible scrypt cryptographic hashes with 16-byte random salts).
Security & Abuse Telemetry: IP addresses and Cloudflare Turnstile challenge tokens are processed ephemerally to enforce rate limits, prevent brute-force authentication, and prevent denial-of-service attacks.

3. How We Use Information

Information is processed strictly for the following operational purposes:

Evaluating and responding to private beta access applications.
Associating feature requests with verified customer accounts to calculate commercial context.
Authenticating administrators and maintaining immutable decision audit records.
Protecting platform availability via automated rate-limiting and security controls.

We do not sell personal or organizational data, do not license customer data to third parties, and do not utilize customer data to train public commercial AI models.

4. Cookies & Local Storage

Comigence uses strictly necessary first-party cookies and local storage items required for software operation:

Identifier	Category	Duration	Purpose
vantage_admin_session	Strictly Necessary	7 days	HTTP-only signed session cookie for authenticated administrators.
comigence_voter_session	Strictly Necessary	30 days	HTTP-only cookie preserving authenticated voter identity across sessions.
theme	Functional	Persistent	Stores user interface theme preference (light, dark, or system).

Comigence does not deploy advertising tracking pixels, cross-site profiling trackers, or third-party behavioral analytics cookies on the marketing website.

5. Third-Party Infrastructure & Data Hosting

To provide the service reliably and securely, Comigence engages the following vetted cloud infrastructure providers:

Vercel Inc.: Application hosting and serverless execution (deployed in Singapore, sin1 region).
Neon Inc.: Serverless PostgreSQL database storage (hosted on AWS in the Singapore ap-southeast-1 region).
Cloudflare, Inc.: DNS routing, edge SSL termination, and Turnstile automated bot challenge verification.
Resend / Sendwithus Inc.: Transactional email delivery for voter verification tokens.

6. Data Retention & Security

We implement technical safeguards including SSL/TLS encryption in transit, scrypt password hashing, parameter-bound database isolation, and structured audit logging. Voter verification tokens automatically expire after 15 minutes.

[Founder Input Required]: Specific customer workspace data retention terms, export procedures, and account deletion response timelines.

7. Inquiries & Privacy Requests

For questions regarding this policy, data subject requests, or early access data removal, contact our privacy contact point directly:

hello@comigence.com