Who controls the data?
Malek Dumaini, operator of XPScerpto
Privacy and data rights
Privacy should match the runtime
This center explains the data XPScerpto actually processes across the public site, account identity, contributor workflows, security reporting and audit. It does not treat a policy page as proof of deletion, export or retention.
At a glance
What data?
Identity, sessions, contributor records, work artifacts, communications and audit evidence
Why?
Operate, secure and verify the service and contributor lifecycle
Who may access?
Authorized roles and admitted providers only for a stated purpose
How long?
According to runtime retention rules; unapproved periods remain blocked
What can I do?
Access, export, correct, restrict, object and request closure or deletion where applicable
Processing by service
Choose a service context. Each item is generated from the central processing register installed in the runtime.
Account and session
Account identity and sessions
Authenticate users, maintain sessions, enforce CSRF and MFA assurance, and revoke access when required.
Data categories
- username
- email verification state
- password hash
- session metadata
- MFA state
- security events
Collection sources
- account holder
- authentication runtime
Recipients
- authorized identity and security operators
ADMIN_OPERATIONS
Administrative operations
Authorize privileged administration, record configuration changes and investigate operational failures.
Data categories
- administrator identity
- role and capability
- configuration mutation
- operational and error logs
Collection sources
- authorized administrator
- runtime diagnostics
Recipients
- authorized administrative, security and audit personnel
API_INTEGRATIONS
API and integration usage
Authenticate scoped API use, apply rate and authority controls, and preserve security-relevant request evidence.
Data categories
- API principal
- scope
- request metadata
- rate-limit events
- integration provider references
Collection sources
- API client
- integration configuration
- authorization runtime
Recipients
- authorized platform operators
- explicitly configured integration provider when approved
Applications and capabilities
Applications, capabilities and evidence
Evaluate contributor applications and claimed or verified capabilities without treating capability as access authority.
Data categories
- application answers
- drafts
- capability claims
- restricted evidence
- verification decisions
Collection sources
- applicant
- reviewer
- scanner and verification systems
Recipients
- authorized independent reviewers
Contact and security disclosure
Contact requests and security reports
Receive concise contact requests and restricted vulnerability reports, triage them and coordinate responses.
Data categories
- message content
- optional contact address
- security evidence
- triage and remediation records
Collection sources
- visitor or security researcher
- security team
Recipients
- authorized support or security operators
Contributor portal
Contributor profile and agreements
Maintain a versioned contributor profile, field visibility, security settings and agreement receipts.
Data categories
- profile data
- availability
- languages
- public links
- agreement acceptances
Collection sources
- contributor
- administrative policy
Recipients
- authorized contributor operations staff
- public visitors for fields explicitly marked public
Notifications and activity
Notifications and contributor activity
Deliver actionable notifications and expose a contributor-only activity projection linked to audit receipts.
Data categories
- notification metadata
- delivery attempts
- preferences
- activity events
Collection sources
- domain events
- contributor preferences
Recipients
- the contributor
- configured mail transport when approved
Opportunities and trials
Opportunities, matching and trials
Show approved opportunities, calculate eligibility signals and operate bounded trial assignments.
Data categories
- eligibility reasons
- interest registrations
- availability
- trial assignment and evaluation
Collection sources
- contributor profile
- verified capabilities
- operator assignments
Recipients
- authorized opportunity and trial operators
ORGANIZATIONS_WORKSPACES
Organizations, workspaces and invitations
Create organization membership, deliver scoped invitations and enforce workspace role boundaries.
Data categories
- organization membership
- invitation address and token metadata
- workspace role
- acceptance and revocation events
Collection sources
- authorized organization operator
- invitee
- membership runtime
Recipients
- authorized organization operators
- the intended invitee
- configured mail transport when approved
Privacy rights
Privacy-rights requests
Receive, verify, review and fulfil privacy requests with minimal data and immutable receipts.
Data categories
- request type and scope
- contact verification
- decision and fulfilment records
- download grants
Collection sources
- data subject
- authorized privacy operator
Recipients
- authorized privacy operators
- the verified data subject
Public website
Public website delivery
Deliver requested pages, protect availability and preserve language or theme preferences.
Data categories
- request metadata
- security logs
- language and theme preference
Collection sources
- browser request
- runtime security controls
Recipients
- authorized platform operators
Security audit
Security and authority audit
Prove authoritative commands, agreement acceptance, access decisions, downloads, deletion or anonymization without using the audit stream as marketing analytics.
Data categories
- actor reference
- command metadata
- target reference
- outcome
- cryptographic receipt hashes
Collection sources
- runtime authority commands
Recipients
- authorized security and audit personnel
Contributions and verification
Submissions, verification and reviews
Bind submissions to identity and scope, run source-bound verification and preserve review history.
Data categories
- submission metadata
- commit or patch hashes
- CI results
- review comments
- integrity receipts
Collection sources
- contributor
- source provider
- CI and reviewers
Recipients
- authorized reviewers and verification operators
Tasks and access
Tasks, workspaces and access authority
Materialize scoped workspaces and access grants, read provider truth, enforce expiry and revocation.
Data categories
- task assignment
- scope
- access approvals
- provider references
- expiry and revocation events
Collection sources
- authorized operators
- workspace and access providers
Recipients
- authorized operators
- configured workspace or repository provider when approved
UPLOADS_BACKUPS
Uploads, backups and recovery
Store admitted files, quarantine restricted evidence, create operational backups and restore service state under controlled recovery.
Data categories
- uploaded content and metadata
- evidence classification
- database backup content
- restore audit records
Collection sources
- authorized user
- security reporter
- backup runtime
Recipients
- authorized service, security and recovery operators