1. Data Controller

🏢 Company	ASSISTROVIA LLC
🏷️ Operating as	SAPEO (sapeo.org)
📍 Address	2705 Cardenas Dr NE, Albuquerque, NM 87110, USA
🌐 Website	www.sapeo.org
📧 Email	sapeo@sapeo.org
💬 WhatsApp	+1 (418) 476-7254
👤 DPO	dpo@sapeo.org

↑ Haut

2. Data Collected

👤 Identity

Full name
Email address
Profile photo (optional)
Date of birth

🆔 KYC Data

Identity document (front/back)
Proof of address
Bank details (IBAN)
Phone number

💳 Financial

Donation amounts (via Stripe)
Transaction history

🌐 Browsing

IP address
Browser type
Pages visited

⚠️ Card data is never stored on our servers — handled exclusively by Stripe (PCI DSS Level 1).

↑ Haut

3. Legal Basis

Processing	Legal Basis
Account creation and management	📜 Contract performance (CCPA — contractual necessity)
Payment processing	📜 Contract performance
KYC verification	⚖️ Legal obligation (AML/BSA)
Marketing emails	✅ Explicit consent (CCPA opt-in)
Fraud prevention	🎯 Legitimate interest (CCPA)

↑ Haut

4. Processing Purposes

✅ Service delivery: account management, campaign publishing and tracking;
✅ Transaction processing: donation collection, creator payouts, receipt generation;
✅ Legal compliance: KYC, anti-fraud, regulatory obligations;
✅ Communication: important account/campaign notifications;
✅ Service improvement: anonymized usage analytics;
✅ Marketing (with consent): newsletters.

Your data is never sold to third parties or used for commercial profiling.

↑ Haut

5. Data Sharing

💳 Stripe

Payment processor for secure transactions. Data shared: email, amounts.

⚖️ Authorities

Only upon legal request (judicial, tax, regulatory authorities).

↑ Haut

6. Retention Periods

Data Category	Retention Period
Active account data	Account lifetime
Post-deletion data	3 years (legal requirement)
KYC documents	5 years (AML/CFT)
Transaction data	10 years (accounting)
Analytics cookies	13 months maximum

↑ Haut

7. Your Privacy Rights (CCPA/COPPA)

👁️

Right of Access

Get a copy of all your data

✏️

Right to Rectification

Correct inaccurate data

🗑️

Right to Erasure

Right to be forgotten

⏸️

Right to Restriction

Limit processing of your data

📦

Right to Portability

Receive your data in structured format

🚫

Right to Object

Object to certain processing

Contact our DPO at dpo@sapeo.org. You may also file a complaint with the FTC.

↑ Haut

8. Data Security

🔒 TLS/SSL 256-bit encryption of all communications;
🔑 bcrypt password hashing;
🛡️ Restricted access (least-privilege principle);
📊 Access logging and monitoring;
🔄 Encrypted daily backups;
🏅 Stripe PCI DSS Level 1 for all payment data.

↑ Haut

9. International Transfers

SAPEO is hosted in the United States (AWS, Seattle WA). All data processing by sub-processors (Stripe, emailing) is governed by CCPA/COPPA-compliant Data Processing Agreements (DPA).

↑ Haut

10. Minors

SAPEO is intended for users aged 18 and over. We do not knowingly collect data from minors. If you believe a minor has provided data without consent, contact privacy@sapeo.org.

↑ Haut