This is a pre-production engineering summary, not the final legal Privacy Notice. Operator and counsel approval is required before WorkingPolicy collects real public or verification data.
A public verification label is derived from a restricted case. Precise addresses, raw identity or locality documents, device-risk signals, moderator notes, and private government drafts are never public.
Identity, expertise, government role, locality, organization authority, and proposal-specific affected status are separate dimensions. Raw evidence expires after decision and appeal needs.
The AI gateway classifies and redacts data before dispatch, controls provider retention and region policy, blocks restricted classes by default, and records the provider/model/prompt used.
Requests resolve ownership, public-record and legal-hold constraints, revoke access, delete primary and derived records, replay deletion tombstones after restore, and preserve content-free audit proof.
Credentials never enter source, browser bundles, application data, AI prompts, notifications, logs, or ordinary exports.
Labels describe the state of the record. They do not confer legal authority, certification, or government endorsement.
Published proposals, sources, decisions, and outcome reports after review.
Private drafts, membership, invitations, and unpublished reviews.
Identity/locality evidence, security investigations, and other high-impact records.
Until operator-approved controller, contact, legal basis, provider, and jurisdiction details exist, the application must use fictional data only.