Last updated: [DATE]
Draft — not yet approved for publication. This policy describes what the Retirement OS platform actually collects and stores, verified against the live database. It has not been reviewed by an attorney. Every highlighted item needs a real value, and the whole document requires legal review before this site accepts registrations in production. Delete this notice once approved.
This policy explains what information [LEGAL ENTITY NAME] (“Retirement OS,” “we,” “us”) collects when you use retire.matladu.com, why we collect it, who can see it, and what control you have over it.
Retirement OS operates The Retirement Readiness Resource Center and provides educational retirement resources, self-diagnostic calculators, and a member portal. We are not a bank, broker-dealer, registered investment adviser, or government agency.
| What | Required | Why |
|---|---|---|
| First name | Yes | To address you in the portal and in emails |
| Last name | No | To identify your account and label your reports |
| Email address | Yes | Your sign-in, and how we send your resources and reports |
| Password | Yes | Stored only as a one-way hash. We never see or store the password itself |
| Mobile number | No | Only used to arrange a review, if you request one |
| State | No | Determines which licensed agent could assist you, if you request a review |
The figures you enter are used to produce your result. If you choose to save that result, the figures and the result are stored against your account so you can return to them.
You are never required to enter real figures. The calculators work equally well with estimates, and nothing you enter is verified against any external source.
We record your name, email, phone, state, your contact preference, the times that suit you, and any topics or notes you provide.
| What | Why |
|---|---|
| Consent record: the wording version you agreed to, the date and time, and your IP address | Evidence that consent was given, which we are required to keep |
| Referral details: which page and campaign brought you here, and any UTM parameters in the link you clicked | To understand which resources people find useful |
| Account activity: sign-ins, failed sign-in attempts, password changes, reports saved or deleted, preference changes | Security, and to give you a record of your own consent history |
| A session cookie | Keeps you signed in. Removed when you sign out |
We use one strictly necessary cookie, named nmsid, which keeps you signed in during a
session. It contains no personal information and expires when your browser session ends.
[CONFIRM: as built, the platform sets no analytics or advertising cookies. If you add Google Analytics, Meta Pixel, or similar, this section and the cookie-banner requirement both change.]
Authorised staff can see your account details, your consent record, and the titles and summary results of reports you have saved. Access is limited by role and is logged.
If you request a Retirement Readiness Review, your name, email, phone, state, and the topics you said you wanted to discuss are provided to a licensed insurance agent so they can contact you. This only happens if you request a review. Requesting one is voluntary and is not required to use any part of your membership.
| Who | What they handle |
|---|---|
| [HOSTING PROVIDER] | Hosts the website and database |
| Brevo (Sendinblue) | Delivers our emails |
| GoHighLevel | Manages the educational email campaign, where connected |
We may disclose information where we are legally required to, or to protect the rights or safety of our members or of Retirement OS.
| What | How long |
|---|---|
| Your account and saved reports | Until you delete your account |
| Consent records | [RETENTION PERIOD — advertising and insurance record-keeping rules apply. Confirm with counsel.] |
| Password reset tokens | One hour, then invalid |
| Email delivery logs | [RETENTION PERIOD] |
| Security and activity logs | [RETENTION PERIOD] |
When you delete your account, your account record and every report saved against it are removed from the live database. [CONFIRM: whether consent evidence must be retained after account deletion for regulatory reasons, and for how long. If so, say so plainly here.]
Write to [PRIVACY CONTACT EMAIL] and we will respond within [RESPONSE PERIOD].
Regional rights sections — pending scope decision. If members outside your state or country are in scope, this policy needs additional sections: California residents (CCPA/CPRA: right to know, delete, correct, opt out of sale or sharing, plus a “Do Not Sell or Share” link), other US state privacy laws, and UK/EU visitors (UK GDPR and GDPR: lawful basis, international transfers, right to complain to a supervisory authority). Confirm your intended audience before this is finalised.
No system is perfectly secure. We cannot guarantee absolute security, and you should use a password you do not use anywhere else.
This service is intended for adults planning for retirement. It is not directed at children, and we do not knowingly collect information from anyone under 18. If you believe a child has given us information, write to [PRIVACY CONTACT EMAIL] and we will delete it.
If we change this policy we will update the date at the top. If a change materially affects how we use your information, we will tell you by email or through the portal before it takes effect.
[LEGAL ENTITY NAME]
[REGISTERED BUSINESS ADDRESS]
[PRIVACY CONTACT EMAIL]
[PHONE]