Customer accounts and profiles

## Profile data Customers can manage account details, profile media, locale and security preferences from their dashboard. Keep profile fields relevant to support and delivery; avoid collecting data that is not needed for your service. ## Account security Use verified email, strong password policy, session controls and TOTP where appropriate. Administrators should use the least-privilege role needed for their job, and customer support should not share credentials or change an account based on an unverified request. ## Privacy Your organisation is responsible for the privacy policy, retention period and lawful basis for customer data. Review exported data, account changes and support requests through the administration workflow and preserve only the records you need to operate the service.