Privacy & Data Boundary Contract

1. Local-First Financial Privacy Principle

ValueChainCFO is engineered on a fundamental architectural tenet: Sensitive corporate balance sheets, subledger journals, working capital scenarios, and payroll allocations belong solely to your enterprise.

All financial calculators labeled browser-local (such as the Working Capital Liquidity Trajectory Engine) perform 100% of arithmetic evaluations entirely inside client browser memory via isolated WebAssembly and JavaScript threads. No figures, cash cycle inputs, or exported scenarios are transmitted over the network or persisted to any cloud database.

2. YouTube Facade Player & Third-Party Video Boundary

Our video briefing hub employs a strict Click-to-Load YouTube Facade Player. When you browse video catalogues or view technical briefing pages, zero external scripts or network sockets are opened to YouTube or Google servers. Third-party video streams and player cookies are only instantiated when you explicitly click the "Play Briefing" action. All embeds resolve exclusively to the youtube-nocookie.com privacy-enhanced origin.

3. Payment Gateways, Card Security & Statutory VAT Receipts

Commercial license purchases (such as the GCC Corporate Tax & Transfer Pricing Master Pack) are transacted via PCI-DSS Level 1 compliant gateway infrastructure (Stripe / Checkout.com).

• Zero Cardholder Data Storage: Credit card numbers, CVVs, and banking secrets are tokenized by the gateway and never traverse or store on ValueChainCFO web servers.
• Statutory Tax Records: Pursuant to UAE Federal Decree-Law No. (8) of 2017 on Value Added Tax, we retain legal billing entity details (Company Name, TRN, billing address, and transaction amount) for the statutory audit retention window.
• Signed Webhooks: Payment confirmations and license provisioning are authenticated via cryptographic HMAC-SHA256 signed webhooks.

4. Hosted SaaS Isolation & Short-Lived Signed Downloads

For downloadable models and hosted engines:

• Protected Asset Storage: Master spreadsheets and OpenXML templates are housed in private server storage inaccessible via public HTTP URLs.
• Temporary Signed URLs: Download links expire automatically after 15 minutes and are cryptographically bound to the authenticated purchaser's session.
• Multi-Tenant SaaS Boundary: If you utilize hosted calculation engines, each enterprise workspace is isolated at the database level with explicit tenant ID segmentation, encrypted database connections, and scheduled automatic backup retention.

5. Cloud AI Advisory Services (Google Gemini Enterprise)

ValueChainCFO incorporates optional assisted AI diagnostics. In strict adherence to our Fiduciary Boundary Agreement:

"Cloud-Assisted Advisory Engine powered by Google Gemini Enterprise. Do not submit non-public financial records, personal identification, or confidential transaction ledgers."

Prompt transmissions occur exclusively over TLS 1.3 encryption to enterprise Google Cloud endpoints. Data is processed solely for generating real-time responses and is not utilized for foundational LLM training.

6. Member Submissions & Editorial Review Governance

When members contribute links, technical notes, or calculation prototypes via the Community Sharing Window:

• Private by Default: All submissions remain strictly private to the contributing author and authorized editorial staff until explicit editorial approval and publication.
• Mandatory Fiduciary Warranty: Contributors legally warrant that submitted materials contain no proprietary non-public employer ledger data or copyrighted property without rights.
• Community Reporting & Auto-Quarantine: Any published contribution flagged 3 or more times by community members is automatically pulled from public indexing into an administrative quarantine queue for legal review.

7. Session Cookies & Zero-Profiling Telemetry

We employ first-party, HTTP-only session cookies managed by our Laravel API backend (`vcfo_session`, `XSRF-TOKEN`). We do not use third-party behavioral advertising trackers, data brokers, or cross-site profiling scripts.