🕵🏽‍♀️ Clarify investor privacy, revocations

[JFWooten4]

Prerequisites

Structual

This relates to the pending (private/proprietary¹) NOBO v. OBO post.

Cultural

WhyDRS/DUNA-docs#32

Matter

The present privacy policy needs to explicitly clarify how and when investor information gets shared with companies, alongside when and how they can change these preferences. These features need to be implemented in the AWS PII DB accessed through the (partly) permissioned external/public interface.

I'm working through the nuances now for issuers who have sent us the original PII for an investor, so by implication they have permission to access such data.

Footnotes

1. Right now the Syndicate blog is centralized in our comprehensive Zoho system. In the future, this could move to open-source. However, I think the nuances of its centralized policies in terms of client confidentiality, MNPI, and identity verification requisite a fairly stiff line between engineering and compliance/marketing/servicing. ↩

[JFWooten4]

This also likely implicates this, which perhaps ought be moved to Projects over here (that is a new thing for me, maybe James could help).