--- /dev/null
+++ b/privacy-policy-v1.md
@@ -0,0 +1,58 @@
+This Policy explains how HOPPRGG LLC, doing business as Platyn ("Platyn", "we"), handles personal information in the Platyn Service. It is a notice, not an agreement, and nobody is asked to accept it.
+
+## 1. Whose information
+
+- **Platyn users:** people with a Platyn login who work for an Org.
+- **Org customers:** people an Org sells to through Platyn, including shoppers, invoice payers and portal users.
+- **Visitors:** anyone using platyn.io or our contact form.
+
+For Org customers, the Org decides what it collects and why. Platyn processes that information for the Org as its service provider, and the Org's own privacy policy also applies.
+
+## 2. What we collect
+
+- **Account:** name, email, phone, role, login and security events, from Platyn users.
+- **Business verification:** business name, tax ID, owner names, dates of birth and addresses, from Org owners. These are passed to our payment processor and not kept by Platyn beyond what is needed to show an Org its own setup.
+- **Customer records:** names, contact details, addresses, orders, designs, sizes and personalization, from Orgs and their customers.
+- **Payments:** card brand, last four digits, payment status, payout and dispute records, from our payment processor.
+- **Technical:** IP address, browser, device, pages used, and the cookies needed to keep you signed in, from everyone who uses the Service.
+
+Platyn never stores full card numbers, security codes or full bank account numbers. Those go directly to our payment processor, Finix.
+
+## 3. How we use it
+
+- To run, secure and support the Service, and to process payments for Orgs.
+- To verify businesses and prevent fraud, money laundering and other misuse.
+- To send service messages, such as receipts, order updates and changes to our terms.
+- To meet legal obligations and enforce our agreements.
+
+Platyn does not sell personal information and does not use Org customer data for its own marketing.
+
+## 4. Who we share it with
+
+- **Payment processing:** Finix Payments and its partner banks, for payments, verification and fraud checks.
+- **Infrastructure:** hosting, storage and email providers (including Amazon Web Services and Hetzner) that process data for us under contract.
+- **Sign-in:** Google, if you choose to sign in with Google.
+- **The Org:** an Org's customer records are visible to that Org's users.
+- **Legal:** authorities where the law requires, and a buyer if Platyn's business is sold.
+
+## 5. Retention
+
+We keep information while the Org's account is active. After an Org closes its account, we delete or anonymize its data within 90 days, except records we must keep longer, such as payment, tax, verification and dispute records (generally 7 years) and terms acceptances.
+
+## 6. Your choices and rights
+
+- Platyn users can update their profile in the Service.
+- Org customers should contact the Org first; we help Orgs answer requests.
+- Anyone can ask to access, correct or delete their information at admin@platyn.io. Depending on where you live, including California, you may have further rights; we will not treat you differently for using them.
+
+## 7. Security
+
+We use encryption in transit, access controls, separation of each Org's data and audit logging. No system is perfectly secure; we will notify affected people as the law requires if a breach occurs.
+
+## 8. Children
+
+The Service is not directed to children under 13. Org customers who are minors (for example, team-store buyers) are the responsibility of the Org and their parents or guardians.
+
+## 9. Changes and contact
+
+We post each version of this Policy at platyn.io/privacy with its date. Questions: admin@platyn.io, or HOPPRGG LLC, 2716 Powell Ct., Monroe, GA 30656.