# Data map

v1 region: **United States**. Processor: Say Hi Apply. Controller: the client account.

| What | Where | Who | TTL |
|---|---|---|---|
| Client email, session, CSRF hash | Neon (US) | Client | While the account is open |
| Embed key hash, `allowed_origins` | Neon | Client | While the key exists |
| Intro metadata (name, coarse place, consent_version, apply email on the link door only) | Neon | Client | 30 days after record, then tombstone |
| Media (Stream uid, not a public URL) | Cloudflare Stream | Client | 30 days, then hard-delete |
| Audit (watch / download / delete / staff / webhook) | Neon | Client | ~12 months. No media. |
| Credit lots / events | Neon | Client | FIFO, 12-month lot expiry |
| Webhook signing secret | Neon (account) | Client | Until rotated |

Never stored: face embeddings, voiceprints, scores, card PAN, candidate login, a public file URL.

The person on camera has no account. Rights (delete, export) go through the client.