Security & Data-Retention Summary

We use commercially reasonable administrative, technical, and organizational measures designed to protect information appropriate to its sensitivity and the risk. Security is an ongoing practice, not a one-time state, and no system can be guaranteed completely secure.

• Encryption in transit (HTTPS/TLS) for our website and application traffic.
• Reputable infrastructure and platform providers for hosting, database, storage, and payments (see our Subprocessor List).
• Access controls and least-privilege practices so personnel access only what they need.
• Payment details are handled by our payment processor; we do not store full card numbers on our own systems.
• Routine platform backups provided by our infrastructure providers.

This is a representative summary, not an exhaustive specification, and specific controls may change as our tools and providers evolve.

We retain records for as long as your account is active and thereafter as needed for legitimate business, legal, tax, and recordkeeping purposes, until they are removed by our automated data-retention processes.

Where you ask us to delete information, we will do so subject to records we must keep for legal, tax, or recordkeeping purposes and copies that persist in routine backups until they age out in the ordinary course.

This summary is provided for transparency. It is not a warranty, a certification (such as SOC 2 or ISO 27001), or a representation that any particular standard is met, and it does not create obligations beyond those in your signed agreements and applicable law.

Security questions or to report a concern: Office@JustTechTurtleIt.com.