Privacy Policy
This policy explains which personal data ProvSeal processes, why, on what legal basis, for how long, and how to exercise your rights. It covers the provseal.fr website and the ProvSeal products.
- Your files, certificates and private keys are processed in your environment and are never sent to ProvSeal.
- Audience measurement runs only if you accept it, and you can withdraw your consent at any time.
- No data is sold, and no advertising cookies are used.
1. Data controller
- Controller
- JLWK, individual entrepreneur, publisher of ProvSeal
- Contact
- contact@provseal.fr
- Legal notice
- Publisher and hosting details
ProvSeal has not appointed a data protection officer. Any question about your data can be sent to the address above.
2. Files processed by ProvSeal products
ProvSeal processes supported media files directly in the local extension environment. Verification and signing workflows are designed to run locally, without uploading your files to a ProvSeal backend.
- No upload: selected media is not sent to a ProvSeal server for verification or signing.
- Explicit actions only: files and page media are read only when you choose to verify, inspect, sign or scan.
- No secondary use: ProvSeal does not use your files for advertising, profiling, training, or unrelated analytics.
Extension permissions
The extension requests only the permissions needed for file verification, local signing, page media scan and the context menu. Permissions are not used for advertising, tracking, profiling, or unrelated browsing history collection.
Limited Use disclosure
The use of information received from extension permissions adheres to applicable store User Data Policy requirements, including Limited Use.
User data is used only to provide and improve the extension’s single purpose: local C2PA Content Credentials signing, verification and page media analysis.
Certificates and private keys
Certificates and private keys that you import or generate stay on their own medium. ProvSeal never receives them. Never import a production signing key into an environment you do not control.
3. Data processed on the website
The table below lists each processing operation carried out on provseal.fr.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Delivering the site and keeping it secure | IP address, browser type, requested page, date and time | Legitimate interest | As long as the host keeps its technical logs |
| Audience measurement (Google Analytics) | Pseudonymous identifier, pages viewed, language, referring site, campaign parameters, approximate location | Consent | Cookies: 13 months at most. Data: 25 months at most |
| Product statistics (Mixpanel) | Pseudonymous identifier, page, language, clicks on install, demo, documentation and contact links, approximate location (country, region, city) | Consent | 25 months at most |
| Replying to your e-mails and pilot requests | Name, e-mail address, organization, content of your message | Legitimate interest, or steps prior to a contract | 3 years after our last exchange |
Files, file names, certificates, private keys and e-mail addresses are never included in measurement data.
4. Cookies and browser storage
When you first visit, a banner asks for your choice. Refusing is as easy as accepting, and nothing is measured until you accept. You can change your choice at any time with Cookie settings, at the bottom of every page.
| Name | Purpose | Type | Duration |
|---|---|---|---|
| c2pa-analytics-consent-v1 | Remembers your measurement choice | Strictly necessary | Until you change it |
| c2pa-language | Remembers the language you chose | Strictly necessary | Until you clear it |
| c2pa-utm | Keeps the campaign that brought you here during your visit | Measurement, after consent | End of the browsing session |
| c2pa-analytics-id | Pseudonymous identifier for product statistics | Measurement, after consent | Until you clear it or withdraw consent |
| _ga, _ga_* | Google Analytics cookies | Measurement, after consent | 13 months |
5. Recipients and transfers
Your data is accessible only to the ProvSeal team and to the following service providers, strictly for the services they provide:
- Vercel hosts the website.
- Google provides Google Analytics and the fonts loaded by the site (Google Fonts). Loading fonts sends your IP address to Google.
- Mixpanel stores product statistics on its European servers.
- YouTube plays the demo video in privacy-enhanced mode, only on the demo video page.
Vercel and Google are based in the United States. Transfers to these providers are covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.
ProvSeal does not sell your data, does not use it for advertising, and does not make any automated decision about you.
6. Your rights
Under the GDPR and the French Data Protection Act, you have the right to:
- access your data and obtain a copy;
- have it corrected or erased;
- restrict or object to its processing;
- receive it in a portable format;
- withdraw your consent at any time, without affecting earlier processing;
- set instructions for what happens to your data after your death.
To exercise these rights, write to contact@provseal.fr. We reply within one month. If you believe your rights are not respected, you can lodge a complaint with the CNIL.
7. Security
The site is served over HTTPS with a strict content security policy. How ProvSeal protects your files and keys is described on the Security page. To report a vulnerability, write to security@provseal.fr.
8. Changes to this policy
We may update this policy when our services change. The date at the top of the page shows the latest version. Significant changes will be announced on this page.