Privacy Policy

Contact

Privacy enquiries

The service is operated under the public-facing name International Toilet Brush Institute (ITBI). Privacy-related requests may be sent to privacy@toiletbrushinstitute.com.

The record

Data collected

Account records include login name, email address, preferred language, password hash, verification and activity timestamps, role and account status. Passwords are not stored in readable form.

Registry filings may include Brush Registration, Territorial Enclave and Citizenship applications, statements, oath affirmations, review information, Brush and Enclave identifiers, uploaded photographs and the territorial information supplied by applicants.

The service also processes authentication and account-security information, transactional email delivery information and ordinary technical or security logs needed to operate and protect the website.

Use

Purposes and legal bases

Data is used to create and secure accounts, authenticate access, receive and review applications, maintain Registry records, publish records that have been approved for publication, send transactional notices, prevent abuse and operate the service.

Processing is carried out as necessary to provide requested account and application services, to operate the Registry and to pursue legitimate interests in service security, review integrity and record continuity. Where a particular operation relies on consent, it may be withdrawn at any time.

The site does not use personal data for advertising, marketing email or behavioural profiling. Recognition decisions are reviewed by authorized Institute personnel.

Public boundary

Applications, photographs and territorial precision

Pending and rejected application dossiers remain private to the applicant and authorized reviewers. Once recognition is approved, selected Brush or Enclave photographs and public record fields may be published under opaque public identifiers.

Territorial publication follows the declared CITY, DISTRICT or EXACT precision. CITY uses a representative locality point, DISTRICT reduces coordinate precision, and EXACT publishes the position expressly declared for publication.

Uploaded JPEG and PNG files are decoded and re-encoded before storage, which removes embedded EXIF and GPS metadata. The original filename is retained with the media record and should not itself contain private information.

Recipients

Access and service providers

Authorized Institute administrators and reviewers can access the dossiers required for their duties. The service also depends on its database, application hosting, file storage and transactional email infrastructure.

Hosting, storage and transactional email services process the information needed to provide their technical functions. Public maps request tiles from OpenFreeMap and OpenStreetMap infrastructure, which receives ordinary network information such as IP address and browser request headers.

Instagram, Facebook and X are ordinary outbound links rather than embedded social trackers. Those platforms receive information only when a visitor chooses to open a link.

Retention

How long information is kept

Authenticated server sessions expire after 12 hours of inactivity. Email-verification codes expire after 10 minutes and password-reset links after 30 minutes; their protected technical records are automatically removed seven days after expiry.

Other personal data is retained only for as long as reasonably necessary for the purposes for which it was collected, taking account of operational, security and applicable legal requirements.

Individual rights

Access and control

Depending on the applicable law and circumstances, individuals may request access, rectification, erasure, restriction, objection or portability, and may withdraw consent where processing relies on consent.

Requests may be sent to privacy@toiletbrushinstitute.com. Individuals may also lodge a complaint with the competent data-protection supervisory authority.

Safeguards

Account and data security

Passwords are protected using one-way cryptographic hashing and are never stored in readable form. Verification and reset secrets are stored only as secure hashes, reset links are time-limited and single-use, and a successful password reset invalidates existing sessions.

Authentication uses server-side sessions, protected security tokens and role-controlled access. The public service uses HTTPS, and session cookies are protected with appropriate browser security attributes. No internet service can promise absolute security.