{"gdpr_summary":{"art_13_information":"This privacy policy (Art. 13 \u2014 Information to be provided)","art_15_right_of_access":"GET /users/me \u2014 view all your data","art_17_right_to_erasure":"DELETE /users/me \u2014 delete your data","art_20_right_to_portability":"GET /users/me/export \u2014 structured data export","art_7_3_withdraw":"POST /auth/consent/withdraw \u2014 withdraw consent","art_7_consent":"POST /auth/consent \u2014 grant/record consent"},"privacy_policy":{"controller":{"contact":"admin@debvisor.com","name":"Debvisor"},"data_collected":["PAM authentication (username, password verification)","OTP email verification (email address only)","OAuth providers \u2014 minimal user info (email, name)","Session management (session ID, creation time, providers)","API key management (metadata only, never full key after creation)"],"data_retention":{"api_keys":"24 hours (SESSION_TIMEOUT env var)","consent_records":"5 years from recording","otp_codes":"5 minutes (OTP_EXPIRY_SECONDS env var)","rate_limit_data":"5 minutes (in-memory, not persisted)","sessions":"24 hours (SESSION_TIMEOUT env var)","user_profiles":"Until deletion or 5 years inactivity"},"data_sharing":["OAuth: minimal user info to this service only","Email OTP: via local Postfix MTA only","No personal data sold or shared with third parties"],"effective_date":"2026-09-30","legal_basis":{"api_keys":"Performance of contract (Art. 6(1)(b))","authentication":"Performance of contract (Art. 6(1)(b))","consent_records":"Legal obligation (Art. 6(1)(c))","otp_verification":"Performance of contract (Art. 6(1)(b))"},"rights":{"art_15_access":"GET /users/me","art_16_rectification":"PATCH /users/<id>","art_17_erasure":"DELETE /users/me","art_20_portability":"GET /users/me/export","art_7_withdraw_consent":"POST /auth/consent/withdraw"},"security":["Passwords hashed with bcrypt (cost 12)","Sessions in Redis with TTL","Cookies: HttpOnly, Secure, SameSite=Lax","Rate limiting on auth endpoints","TLS encryption (HTTPS via nginx)"],"version":"1.0"}}