Your information, clearly explained.

• We collect only what is needed to run your account and handle your requests.
• We do not sell personal information and we do not run advertising or tracking.
• Your information is stored in Frankfurt, Germany. Only the service providers listed below handle it for us. Email you switch on is delivered by Resend, which keeps its own delivery record.
• Request information is not automatically sent to AI, outreach or payment providers.
• You can ask to see, correct or delete your information at any time. See your rights below.

Corridra is operated by Corridra Pte Ltd, 101 Robinson Road, Singapore 180239, with operations in Gulshan, Dhaka, Bangladesh. Corridra Pte Ltd decides why and how personal information in this service is used. In data protection terms it is the organisation responsible for that information (the controller under the GDPR, the organisation under Singapore’s Personal Data Protection Act).

For account help, privacy questions, corrections, a deletion request or to contact our data protection contact, write to sadat@obsidianglobal.studio.

This notice describes the application’s current handling of information. A programme may also have its own terms and participation choices. Those terms do not replace this notice.

Customer account names, email addresses, password hashes and sessions are stored through Neon Auth in Frankfurt, Germany. Verification and password recovery emails, and the request emails you switch on, use Resend, with sending configured in Ireland.

Your password goes to the account provider. It is not saved in mission requests, request drafts, receipts or application events. Necessary session cookies keep account access working.

You can create an account before starting a request or at the final contact step. Verify your email and sign in to submit a saved request and access it privately.

Invited staff use a separate operator identity and an authenticator. A customer account does not grant staff access.

We save the information you submit: your objective, company and contact details, target market, timing, product or service requirements, desired outcomes and any optional notes or budget details.

We also record the notice version you acknowledge, submission time and identifiers needed to handle retries, ownership and request history. Submitted business information remains self-declared.

Request records are stored in the Frankfurt application database. Authorized Corridra operators use them to review the request, clarify the work and record progress and replies. Request information is not automatically sent to AI or outreach providers.

• Account information (name, email address, sign-in and session details). To create and secure your account and let you sign in. Basis: providing the service you asked for, and keeping it secure.
• Request and company information (what you submit about your business, market, requirements and contacts). To review your request, do the work and keep a record of it. Basis: providing the service you asked for.
• Workspace and team information (workspace names, members, roles, invitations). To let the right people in your organisation work together. Basis: providing the service, and the legitimate interest of the organisation that invited you.
• Technical and security records (event and audit history, request identifiers, and short-lived abuse-limit counters that hold a keyed hash of your network address, not the address itself). To keep the service secure, prevent abuse and show who did what. Basis: our legitimate interest in security and accountability.
• Messages you send us (support and privacy requests). To reply and keep a record. Basis: our legitimate interest in answering you, or the law where it requires a record.
• Email about your requests (your email choices with the time you made them, and a record of each message). To tell you when something needs you, only if you switch email on. Basis: your consent, which you can withdraw on the Email choices page.
• Billing records (the company name and address you ask us to invoice, invoice and credit note numbers, amounts, and the payments our team records as received, with a bank reference). To issue invoices and keep accounting records. Basis: providing the service you asked for, and our legal duty to keep accounting records. We do not collect card or bank account details through this service. Billing records are kept for as long as accounting law requires, which is longer than the request retention window below, and are not deleted on request while that duty applies.

Under Singapore’s Personal Data Protection Act we rely on your consent, including consent given by taking the step of making a request or using a feature, on what is necessary to provide the service you asked for, and on the other grounds that Act allows. Where we process information because the law requires it, we say so at the point it applies. You may withdraw consent at any time by contacting us. This may mean we can no longer provide part of the service.

We do not make decisions about people based only on automated processing and we do not build advertising profiles.

The practice payment flow on the billing page is a simulation with made-up details (madeup). It asks for no card or bank details, moves no money and does not change an invoice. It records that an attempt was made, its amount and its made-up reference.

This browser tab can keep a request draft so you can return to the form. Drafts expire in the interface after 24 hours. Passwords are kept out of that draft.

At the final step, we save a pending request while you create or activate your account. A private browser cookie carries a possession token; the database keeps its hash. Claiming the request also requires a fresh, verified account matching the contact email.

A pending handoff expires after 24 hours. Expiry stops the handoff from being used; it does not mean the stored record has been automatically deleted. If it expires, start a new request or contact us.

Your account and workspace permissions control customer access. Team members receive only the access their role and the specific sharing workflow allow. Programme participation does not grant unrestricted access to another company’s private work.

Authorized operators can access the records needed to deliver and support the work. Information shared through an explicit programme, company or delivery workflow follows that workflow’s scope.

Account verification confirms control of an account email. It does not verify a company, a commercial claim or supporting evidence.

An authorized owner or administrator records a contributor’s name, email and operating country when preparing a reviewed invitation. The invited person verifies their customer account email before setting a separate work password and enrolling an authenticator. Work password hashes, authenticator credentials, recovery codes and sessions are stored separately from customer accounts in the application database.

Eligibility records, assigned task instructions, submissions, evidence review, contribution assessments and reward decisions are private work records. Contributors receive only their assigned task disclosures, not full mission or team access. Authorized staff review submissions within their existing permissions. A recorded reward does not mean a payment has been made; automated payouts are not available.

Pending invitations expire after seven days and can be cancelled before acceptance. Expiry or cancellation does not delete invitation or work history. Accepted access can be suspended through eligibility controls. Contact us about corrections or retention; automatic deletion of these records is not operational.

How invited contributor access works

We do not sell personal information. We use these service providers to run Corridra:

• Neon: database hosting and customer account services, in Frankfurt, Germany.
• Vercel: application hosting, in the Frankfurt region.
• Resend: verification and password recovery emails, and the request emails you switch on, sent from Ireland.

They process information for us under their own terms and only for these purposes. We share information with others only when you ask us to, when a workflow you use says so (for example a programme or delivery you have joined), or when the law requires it. Corridra staff see the records they need to deliver and support the work, and no more.

Corridra does not use advertising, analytics or tracking cookies. It uses only what the service needs:

• Necessary session cookies from the account provider keep you signed in.
• A private cookie carries a possession token for a pending request while you create or activate your account. It lasts at most 24 hours.
• Your browser tab keeps form drafts and short-lived working state in session storage. It is removed when you close the tab.
• If you choose a language, your browser remembers the choice in local storage. It is not sent to us and you can clear it in your browser settings at any time.
• If you close the email prompt with Not now, your browser remembers that in local storage for 14 days. It is not sent to us.

Because these items are needed to provide what you asked for, they do not need a consent banner. You can block them in your browser, but sign-in and forms will then not work.

Application data and customer accounts are stored in Frankfurt, Germany. Corridra staff in Singapore and Bangladesh can reach that data to provide and support the service, so information may be accessed from outside the country where you live. If you are in the European Economic Area or the United Kingdom and want to know what safeguards apply to that access, contact us.

The public request form does not accept file uploads. Where an authorized workflow allows files, private access, integrity checks and evidence-review rules still apply.

Scanning and additional security integrations are deferred by the operator’s explicit decision. An unscanned file must be identified as bypassed, never as clean or independently verified. Do not assume a file is safe merely because it is available in Corridra.

The recorded mission-intake retention window is 30 days. Automatic deletion is not operational yet, so records may remain until an administrator removes them. Account records remain until an administrator removes them.

Expiry of a draft, handoff, receipt or shared view limits access through that mechanism. It does not erase the underlying record. Permissions, corrections and audit history are handled separately.

Contact us to ask about access, corrections or deletion. We review requests manually, including any records that must be kept for the history and accountability of the work. Self-service account deletion is not available.

You can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is wrong or incomplete;
• delete your information, subject to records we must keep;
• stop or limit how we use it, or object to a use based on our legitimate interest;
• give you your information in a common format so you can move it;
• withdraw a consent you gave.

Write to sadat@obsidianglobal.studiofrom the email address on your account so we can confirm it is you. We aim to respond within 30 days and will tell you if we need longer or cannot act on a request, and why. There is no charge for a reasonable request.

If you are not satisfied with our answer you can complain to the data protection authority where you live. In Singapore this is the Personal Data Protection Commission (pdpc.gov.sg). In the European Economic Area it is your national supervisory authority. We would like the chance to put things right first.

Connections use HTTPS. Passwords are handled by the account provider and stored as hashes. Private links and possession tokens are stored as hashes, not in readable form. Access follows roles and workspace permissions, enforced in the database as well as in the application. Staff use a separate identity with an authenticator. Important changes are recorded in an event history.

No system is perfectly secure. If a breach of personal information is likely to harm you, we will tell you and the authority concerned as the law requires.

Corridra is a business service. It is not intended for anyone under 18 and we do not knowingly collect information from children. If you think a child has given us information, contact us and we will delete it.

Read request updates and replies in your signed-in account. Account verification and recovery emails are separate from mission updates. Mission reply emails are not sent.

We email the verified address on your account when we receive your request. Each of these emails has a link to mute messages about that request and a link to your account. We keep the address used for sending in the Frankfurt application database for at most 24 hours, only to send the email, and we do not share it with anyone else. These emails are sent through Resend, like account verification emails. Sign-in and password emails are separate.

Email about your requests is off until you switch it on, on the Email choices page. You can switch it off there at any time, or mute one request from the link in an email. If you switch it on, we email the verified address on your account when the Corridra team sets something you need to do, or once a day if you choose. When we send, we read your name and verified address from your account and pass them to Resend, which delivers the email, with sending configured in Ireland. Resend keeps its own delivery record, including the address and the content, for a limited time under its terms. Our email records do not hold your address. Each email contains your name, a short description of what is needed as written by our team, a date if there is one, a link to the request or to Your Move, and a link to your email choices. Emails sent one at a time about a request also have a link to mute that request; the daily email has none, and you can switch it off on the Email choices page. We keep each version of your email choices with its time, as the record of your consent, and a record of each message (which request, its description, date and status, never your address) in the Frankfurt application database. These records are not deleted automatically; contact us to have them reviewed. Basis: your consent.

We update this notice when handling changes and show the date at the top. A new request records the notice version acknowledged at submission. If anything is unclear, contact us before adding sensitive information.

Understand Corridra