Concernia Private Beta Privacy Notice

Candidate version: concernia-privacy-2026-09-08-r4-en Prepared: September 8, 2026 Status: internally approved as the operator's official candidate; not yet effective

1. Controller and contact

Selim David Musali, an independent operator established in Israel and the operator of Concernia, is the controller of the invitation, website, support and beta-administration data controlled by Concernia. Privacy contact: david@concernia.com.

Content that remains exclusively on the participant's device is not automatically received by the operator. When the participant chooses an external provider, that provider processes the content it receives according to its role, account, terms and privacy notice.

2. Scope

This Notice covers the Windows desktop application, the Microsoft Store private audience, concernia.com and direct support. The first beta is limited to invited people aged 18 or over using it from Israel.

3. Notice when information is requested

Providing information to participate or request support is voluntary and is not a legal obligation. Without a Microsoft account email address, the person cannot be added to the private audience. Without enough information about a request, Concernia may be unable to answer or investigate it.

The purposes, recipients, consequences of not providing the information, and access and correction rights are described in this Notice.

When your email address is requested for an invitation, you are told who will use it, for what purpose, to whom it will be disclosed, how long it will be kept or which retention criterion applies, and how to exercise your rights. This information will also be available before you hand a report to an email application. Providing data for the beta does not authorise marketing communications or uses incompatible with the disclosed purpose.

4. Information that remains local

The application may locally store:

• the workspace, offices, rooms, profiles, positions and linked sessions;
• messages, instructions, shared memory, decisions and selected files;
• authorisations, revocations, receipts, hashes and audit events;
• connection references, configuration and credentials entered for compatible routes;
• diagnostics prepared locally by the application.

The current release does not require a Concernia account, preload credentials, synchronise rooms to a Concernia server or include remote product telemetry. A support report is prepared locally, shown for review and leaves the device only after an express participant action.

Concernia-managed data is stored on the device using authenticated encrypted storage. In the Microsoft Store package, Concernia-managed secrets are protected for the current user with Windows DPAPI. These measures reduce risk but do not protect against every defect, an operating-system compromise, screenshots, exports or external backups.

That encryption covers only storage managed by Concernia. Codex and other runtimes, applications or external components may independently retain credentials, configuration, logs or history in their own files or in the system credential store. Concernia does not claim that DPAPI or its local encryption automatically covers those stores.

5. Beta invitation and Microsoft Store

Concernia uses the participant's Microsoft account email address, participation status and minimum join or removal dates to administer the private audience. No identity document, nationality, password, provider key or room content is requested to administer the invitation.

Microsoft administers the Store account, acquisition, distribution, signing and package updates. Concernia does not receive the Microsoft account password. Information processed by Microsoft is subject to Microsoft's own terms and notices.

6. Website and email

The website is served by Vercel. The domain and email forwarding use Porkbun, and messages sent to david@concernia.com arrive in a Gmail mailbox controlled by the operator. These services may process IP addresses, browser data, timestamps, delivery records and message content as necessary to provide, secure and diagnose their services.

Concernia.com uses Vercel Web Analytics to count visits and page views and understand aggregate website usage. According to Vercel, the service does not use third-party cookies, does not associate Analytics data with an identified individual or IP address, and may process a timestamp, page path, filtered query parameters, referrer, approximate location, browser, operating system and device type. Concernia does not configure custom events, use this data to reconstruct an individual visitor's browsing activity, or configure a separate Analytics export. Analytics data is available and retained according to Vercel's applicable reporting window and service policies. This is separate from infrastructure data: Vercel may also record network, cache and runtime requests according to the applicable configuration and plan.

The receiving mailbox is a personal/free Gmail account, not Google Workspace. Do not send sensitive information, other people's personal data or complete conversations to support; describe the issue using minimal data and fictional or anonymised examples.

7. Sends to selected providers

Linking a session does not by itself transmit a conversation. When the participant establishes an authorisation and sends, the instructions, categories and files visible within that boundary are transmitted to the selected provider or runtime. The authorisation may cover later sends while the recipient, session, provider, position, categories, files and policy remain unchanged. It can be revoked to prevent future sends; revocation does not recall information already transmitted.

Providers may process information in other countries and retain it under the applicable account, plan and policies. Concernia does not control or automatically delete those copies.

Disconnecting a route in Concernia prevents further use by Concernia, but does not guarantee provider sign-out or deletion of credentials, history or logs retained by the external component. The participant should use the provider's own controls where appropriate.

Credentials are used only for the relevant official interface and should never be placed in rooms, exports, screenshots or support messages.

8. Other people's personal data and sensitive data

You must have sufficient rights and a valid legal basis to use and disclose the selected data. Applicable law, Microsoft Store requirements and each provider's conditions apply together. Microsoft Store section 10.5.3 requires the affected person's express written consent and the ability to withdraw it at any time to disclose a non-customer's personal information through the product or its metadata to an outside service or third party. That provision also extends the requirement to a product giving a customer access to another person's personal information; this second situation is not limited by the non-customer condition in the first.

Highly sensitive data, such as health or financial information, may be collected, stored or transmitted only if related to the feature used, the product first obtains the express user consent required by Microsoft Store section 10.5.5 and the other applicable conditions are met, including the rights of affected people and confidentiality duties. General room authorisation does not replace any required specific consent.

If an authorisation is withdrawn, future uses relying on it must stop and requests concerning information already processed must be addressed according to each party's control and obligations. Concernia cannot automatically retrieve information already transmitted. The participant's duty to provide valid authority does not remove the operator's own obligations.

9. Purposes

Concernia uses data it receives only as necessary to manage invitations and eligibility, answer support and privacy requests, review AI reports and take proportionate action, serve and protect the website and email, understand aggregate website use through Vercel Web Analytics, investigate incidents, defend specific rights and comply with legal duties or valid orders. Participant lists and reports are not reused for marketing or model training merely because they were received. A new use requires the appropriate notice and legal basis.

administer invitations and document versions for this beta; acceptance and authorisation receipts retained by the application remain local and are not automatically sent to the operator. If a participant chooses to include a receipt in a support request, only what is necessary to address that request or meet an applicable obligation is used.

10. Recipients

Depending on the operation, information is received by Microsoft for Store audience management and distribution; Vercel for website hosting, security and Web Analytics; Porkbun for DNS and email forwarding; Google for Gmail; and the AI provider or runtime selected by the participant. Each service receives data that passes through its function, not automatically the complete contents of rooms. Selecting a provider does not place all of its processing under the operator's control.

Information may also be disclosed to an authority where a legal duty or valid order requires it and, where necessary for a specific matter, to an adviser subject to appropriate confidentiality duties. Every disclosure by the operator must have a valid basis, be limited to what is necessary and respect applicable rights.

11. International transfers

Microsoft, Vercel, Porkbun and Google services may process the data described in this Notice outside Israel, including in the United States and other countries where their facilities or providers operate. A company's location does not establish the sole storage location or guarantee Israeli data residency.

• Invitation: Microsoft receives the Microsoft account email to manage the private audience. The account, acquisition and distribution are also subject to Microsoft's terms and privacy statement.
• Website: Vercel Inc., a United States company, provides hosting and Web Analytics through distributed infrastructure. Its DPA distinguishes processor data from its own processing; it does not on that basis cover email or AI providers.
• Email: Porkbun LLC, a United States company, forwards messages to Gmail under its email terms and privacy policy. Google processes the mailbox under its privacy policy, using international infrastructure. The account is personal Gmail; no Google Workspace agreement or exclusive storage in Israel is attributed to this flow.
• Selected AI: locations, uses and retention depend on the participant's selected provider, account and route. Entirely local inference does not transmit that content abroad merely by using the runtime.

You may request information about relevant transfers and safeguards at david@concernia.com. Where a transfer relies on your consent, it will be requested before the relevant operation, with information about data, purpose, recipients, consequences of declining and withdrawal. Accepting the Terms or acknowledging this Notice does not replace that consent or authorise consent on behalf of other people. Provider policies do not remove the operator's own obligations.

12. Retention

Local workspace: it is stored on the device and can be managed through local controls. Preservation may be affected by failures, system changes and uninstalling; indefinite persistence and complete erasure solely through uninstalling are not promised. Local deletion reaches only the data managed by that control. Exports, backups and data retained by external components are managed separately.

• Local acceptance and authorisation receipts: remain in the local record until deleted through the relevant controls; they are not automatically sent to the operator.
• Invitations: the email is removed from the group without undue delay when requested, when participation ends or when the beta closes. The minimum administrative joining/leaving record is kept for up to 12 months after that event and then deleted or anonymised. If an invitation does not proceed, the correspondence is deleted 90 days after the last communication unless the person requests continued handling.
• Ordinary support: messages, attachments and copies under the operator's control are deleted no later than 90 days after case closure. Closure is communicated when the matter is resolved or notice is given that handling will not continue; if awaiting a response, closure is communicated after 30 days without a reply. A justified reopening may restart the period for information that remains necessary.
• Privacy and security: the minimum file needed to document a rights request or incident is retained for up to 24 months after closure. This does not mean retaining every message or attachment for that period: unnecessary material is deleted earlier.
• Exceptions: a legal duty, active investigation or specific claim may justify longer retention of relevant information. Access is restricted, the reason is recorded and reviewed quarterly. All correspondence is not retained because of an abstract possibility of litigation.
• Website and providers: metrics and logs remain available according to the relevant service windows and policies; the support period does not apply to Vercel Web Analytics or providers' own logs. Concernia does not create a separate Analytics export in the described release. AI copies, participant exports and external storage follow their own controls.

Unnecessary information is reviewed monthly. Files are reviewed within 30 days of the beta ending or being abandoned; the periods above continue even if no public sale occurs. Technical lessons that no longer allow individuals to be identified may be retained.

Deletion under our control includes relevant working copies and messages in Sent and Trash where present. It does not mean instant deletion from every provider system and backup. Google describes an additional deletion process and retention exceptions. No physical deletion timeframe outside the operator's control is promised.

13. Controls and rights

You can review and revoke authorisations to prevent future sends, access and export your local workspace, and use its deletion controls. Independent external provider accounts and copies are managed using their own controls.

Any person, whether or not participating in the beta, may request access to their personal data controlled by the operator and seek correction of inaccurate, incomplete, unclear or outdated information in the circumstances provided by Israeli law. In the circumstances covered by section 14 of Israeli law, they may seek correction or deletion of inaccurate, incomplete, unclear or outdated information. Other deletion or objection requests are addressed where an applicable right exists. Separately, where processing depends on consent that may be withdrawn, it may be withdrawn to stop future uses relying on it. Withdrawal does not by itself require deletion of all copies: whether deletion is required or another applicable legal justification permits retaining specific information will be assessed, without retrospectively invoking a basis that did not exist. Local export and deletion are product controls and do not imply a general right to erase every copy lawfully retained by third parties.

Requests should be sent to david@concernia.com. We may verify identity proportionately without requiring unnecessary documents. We will respond within applicable legal time limits and explain any restriction or refusal and available review or appeal routes. A retention duty or a specific claim may limit deletion but does not automatically remove access or correction rights. You may also contact Israel's Privacy Protection Authority.

14. Children

Participation in this beta is limited to people aged 18 or over. If Concernia learns that an invitation belongs to a minor, the account will be removed from the group and the relevant administration data will be reviewed for deletion.

15. Changes

Concernia accounts, remote synchronisation, telemetry, Concernia-owned analytics, payments, new markets or materially different flows require review of this Notice before the new processing begins. A material change receives a new version and is presented again in the application.

Contact: david@concernia.com.

Canonical R4 SHA-2560B743ED01D1DFF79485CF7F28A1834448ACB8DE793CD3317830CAF6AF54E9114