# Privacy Policy **Last Updated:** October 10, 2026 **Effective Date:** October 10, 2026 **Version:** 2.4 ## 1. Scope This Policy explains how Encypher handles personal data when you use its websites, platform, APIs, plugins, extensions, and support channels. A separate approved agreement may add terms for an organization. Sections 2.1 to 2.9 describe, tool by tool, what our public website at encypher.com collects. ## 2. Data we collect We collect account and organization details, contact information, authentication and security events, billing records, service configuration, support requests, and technical usage records. Public issue reports may include a reply address and diagnostics supplied by the reporter. Do not submit secrets or unnecessary personal data in diagnostics. ### 2.1 Public verification tool When you check a file or a passage of text with the public verification tool, we record the check: the file name and extension, the file type you declared and the type we detected, the size, a SHA-256 fingerprint of the file or text, the result, the signer and trust status, any watermark result, and the Content Credentials metadata the file carries, whether the result is valid or not. That metadata was written by whoever signed the file and can include names, dates, locations, and other descriptive fields. We do not keep the file or the text itself, and we do not store your IP address or browser details with the record. Files that carry Content Credentials are checked on your device where your browser supports it, and only the Content Credentials and fingerprints are sent to us. Other files are uploaded so they can be checked for a watermark, then discarded. ### 2.2 AI Cost & Exposure tool When you scan a website with the AI Cost & Exposure tool, our service fetches that site's public files, such as robots.txt, its sitemap and sample pages, to build the report. You choose an audience type and can add traffic figures. When a scan succeeds, we keep one record for the site's domain, such as example.com. It holds when the domain was first and last scanned, how many times, the last audience type, scan status and exposure score, and whether traffic figures were given. It does not hold the full web address you entered, your traffic figures, your IP address, your browser details or any cookie. We use these records to find organizations that may want our help, and only Encypher administrators can see them. The public files we fetched are cached for up to 24 hours, and a report link works for up to 24 hours. You can download the report as a PDF or have it emailed to you and one colleague. We use those addresses, and any note you add, to send that email through our email provider. A colleague's address is not kept as a contact. Your own address is kept as a contact only if you tick the box that lets Encypher contact you about the report. We then store it with the domain, the time and version of your consent, and the time the report was delivered, and we may contact you about the report and AI content exposure. Every report email has an unsubscribe link. It opens a page that names the domain, and nothing changes until you press Unsubscribe there. Pressing it deletes every contact stored for that domain and marks the domain so later scans and report emails do not restart outreach. We then keep only the domain's scan record, with that mark, until you ask us to delete it. ### 2.3 EU AI Act readiness check Each answer you choose in the readiness check is kept as an anonymous usage record (section 2.6). When you finish, our service stores your assessment: the yes, no or unknown facts your answers add up to, the result, the industry you chose, which of our pages you started from, and a fingerprint of the code that lets you open the result or add it to an account. It does not store your IP address or browser details. You can open the result for 14 days after you finish. The result page gives you a link to save: the code sits in the part of the link that browsers never send to our servers or to other sites, and we do not keep the link in cookies or in your browser. Anyone with the link can open the result. Adding the result to an account within those 14 days keeps it there. Unless you add it to an account, we delete it 30 days after you finish. If you ask for the PDF report by email, we use your name, organization and email address, and up to ten colleague addresses, to build and send it. We add your own address to our newsletter list, as the form says. Colleague addresses are used only for that email. Our public readiness API, which AI assistants and other software can call, records the answers it received, the result, and the caller's browser or software name and the page it was called from. We delete the browser or software name and the page after 90 days, and the whole record after 25 months. ### 2.4 Contact forms, newsletter and downloads Contact, demo and pilot forms collect your name, email address, organization, role, message, the page you came from, and whether you agreed to be contacted. We store the request, email it to our team, and send you a confirmation. We delete every request from your address 24 months after your latest request or our latest recorded follow-up, whichever is later. Newsletter sign-ups and the download forms for our reports and research collect your email address and add it to our newsletter list. The AI Content Control Gap report form can also take your name and organization, which we use in the email that delivers the report and do not add to the list. We store your address, where you signed up, and whether you are subscribed, and we email you the welcome message or the document you asked for. We keep your address while you are subscribed. Each newsletter issue has an unsubscribe link. When you unsubscribe, we stop emailing you and send any reason you give to our team. Thirty days later we replace your address with a one-way code made from it and delete the reason. We keep that code only so our forms do not add you to the list again. If you request one of our reports with the same address within those 30 days, you rejoin the list; after that, we still send the report but do not add you. The Workflow Architect share form uses your name, organization and email address to build a workflow report and email it to you and up to ten colleagues. It adds your own address to our newsletter list, as the form says. Colleague addresses are used only for that email. ### 2.5 Chat and signing demos The chat assistant on our pages sends your message and the conversation so far to our chat service, which uses Anthropic's Claude model to answer. The chat service does not store conversations of visitors who are not signed in. Its logs record the network address each message came from, but not the message. The Provenance Chat demo sends your messages to OpenAI to write an answer. Our signing service then labels the answer under an Encypher demo account. We do not store your question. The signing demos send the text or file you choose to our signing service under an Encypher demo account. The service returns it with a label and keeps a signing record under that account. A signed image is held in our website server's memory for up to 10 minutes so you can download it. ### 2.6 Anonymous usage records We keep anonymous records of how our website and free tools are used: the pages you visit (without any query string, and with any id in the address removed), how you arrived (directly, from another of our pages, or from a named search engine, AI assistant or social site), any campaign tags in the link, whether you use a phone or a computer, and what you do in our tools. Examples are which answers you choose in the EU AI Act readiness check, whether a file or text was signed or checked and the result, which glossary terms and videos you open, and which plan you click on our pricing page. These records hold only those choices and outcomes and the hour they happened. They never include your IP address, browser details, cookies or any identifier stored on your device, your email address, the domain you scan, or anything you type, upload or ask our chat. The only link between records is a random number the readiness check creates for one run and discards when you leave the page or start over. We keep these records whether or not you accept cookies. ### 2.7 Cookies and Google Analytics The cookie banner offers three groups. Strictly necessary cookies are always on. Analytics and marketing are off until you turn them on. - encypher_cc stores your cookie choice for 12 months, across encypher.com sites. - Google Tag Manager loads on every page. Until you accept, our pages tell Google's tags not to use analytics or advertising cookies (Google Consent Mode). Some tool events, such as a finished scan or a downloaded report, are still passed to Google's tag before you choose. They carry only the event name and simple values such as categories and counts, and Google's tags then follow Consent Mode. Depending on how Google's tags are set up, Google may still receive signals without cookies that a page or event occurred. - If you accept analytics, Google Analytics sets its cookies, and Zoho PageSense loads to record how pages are used, including heatmaps. - If you accept marketing, Google's tags may use advertising cookies, and we set encypher_ad_attribution for 30 days. It holds any Google ad click id in the link, the campaign tags, the page you landed on (without its query string), the site that sent you, and when. If you then create an account, we store these details with it to see which campaigns lead to signups, and we may report the signup to Google Ads with the click id. - If you sign in through the website, it sets sign-in session cookies that are strictly necessary. You can change your choice at any time with Cookie Settings in the site footer. Turning marketing off deletes encypher_ad_attribution. Zoho PageSense stops loading from the next page you open. ### 2.8 Bot checks, abuse limits and server logs Our forms and free tools use Cloudflare Turnstile to stop automated abuse. When you submit one, we send Cloudflare your IP address with the check. To limit how often one address can use a tool, our servers count requests by IP address for up to one hour. An address that goes over a limit can be written to our server logs. Our server logs for these forms and tools do not record the email addresses, names or organizations you submit, and our email delivery logs identify a recipient only by a short one-way code. The readiness API's logs record the caller's browser or software name and the page it was called from. ### 2.9 Sign-up measurement When you create an account, we record where the sign-up came from, so we can see which pages and campaigns bring people to us. Most of our links to the sign-up page carry a short source tag, such as product-mark-hero or pricing-free. The tag names the page or campaign the link was on. It is not an identifier for you. When you click one, we put the tag in a cookie called encypher_signup_source for 10 minutes, so it survives the move from this website to the dashboard, and we store it with the account you create. If you accepted analytics cookies, our server sends Google Analytics a sign_up event when the account is created. It carries the analytics identifier your browser's Google Analytics cookie holds, the source tag and the sign-up method, such as email or Google. Without analytics consent we send nothing to Google Analytics. If you arrived from one of our Google ads and accepted marketing cookies, we also report the sign-up to Google Ads as a conversion, with the ad click id from the link you arrived on and the campaign tags held in encypher_ad_attribution (section 2.7). Without marketing consent we send nothing to Google Ads. The setup screen asks "How did you hear about us?". Answering is optional. If you answer "Referral" or "Other", it also asks "Who or where?", and that is optional too. We keep both answers with your account and use them to understand which channels work. The free-text answer is never included in reports we export. We keep the identifiers these reports need only until the report is settled: up to 48 hours for an ad click id and up to 72 hours for the analytics identifier while a report is still waiting to be sent. Once a report is sent, or the period ends without it being sent, we delete the identifier from the record and keep only the fact of the sign-up and its source tag. If you withdraw consent before a report is sent, we cancel it and delete the identifier at once. ## 3. How we use data We use data to provide and secure the Service, authenticate users, process transactions, answer support requests, prevent abuse, maintain operational records, comply with law, and improve product reliability. We do not treat customer content as ours. On our website we also use contact requests to reply to you, newsletter addresses to send the newsletter and the documents you asked for, AI Cost & Exposure domain records and the contacts who opted in for sales outreach, and anonymous usage records and analytics to measure and improve the website and tools. ## 4. Sharing We share data with service providers only as needed to operate the Service, with an organization that administers your account, when you direct us, or when law requires it. The public Subprocessors page lists only arrangements Encypher has approved for publication. It does not promise a processing location or notice period unless recorded there as confirmed. Our website tools send data to these providers to work: Cloudflare for bot checks; Google for Tag Manager, and with your consent for Google Analytics and advertising measurement; Zoho for PageSense, with your consent; Anthropic for the chat assistant; OpenAI for the Provenance Chat demo; and our email provider to deliver the emails described above. ## 5. Retention Retention depends on the record type, account state, legal duties, security needs, and an organization's approved settings. Public verification and revocation facts may outlive an account where needed to preserve trust decisions. Backup deletion and customer-controlled systems may follow separate operational obligations. We keep public verification records for 12 months to operate, secure and improve the verification service and to measure how it is used. After 12 months we delete each record and keep only a count of checks per day, per channel (such as text, image or audio) and per result. Within the 12 months you can ask us to delete a record by writing to privacy@encypher.com with the file name and the time of the check. For our website, the table below gives the period our systems enforce. | Record | How long we keep it | |---|---| | AI Cost & Exposure scan-domain records and opted-in contacts | Deleted 24 months after the last successful scan of that domain. If you unsubscribe, your contacts are deleted at once, and the domain is kept, marked to stop outreach, until you ask us to delete it | | Public files fetched for an AI Cost & Exposure scan, and report links | Up to 24 hours | | EU AI Act readiness assessments | Readable for 14 days with the link you save; deleted after 30 days unless you add it to an account | | Anonymous usage records | 25 months | | Public verification records | 12 months; after that only a count of checks per day, channel and result | | Contact, demo and pilot requests | 24 months after your latest request or our latest recorded follow-up | | Newsletter list | While you are subscribed. 30 days after you unsubscribe, your address is replaced by a one-way code kept only to stop it being added again, and your reason is deleted | | Readiness API records | 25 months; the caller's browser or software name and page are deleted after 90 days | | Signed demo images on our website server | Up to 10 minutes | | IP addresses counted to limit abuse | Up to one hour | | Server logs | The log period of our hosting provider; we set no separate limit | | Sign-up measurement identifiers | Ad click id up to 48 hours, analytics identifier up to 72 hours, both only while a report is waiting to be sent; deleted from the record once the report is sent or the period ends | | Sign-up source tag and your "How did you hear about us?" answer | Kept with your account | | Cookies | encypher_cc 12 months; encypher_ad_attribution 30 days; encypher_signup_source 10 minutes | AI Cost & Exposure outreach: to stop outreach about a domain, use the unsubscribe link in the report email or write to privacy@encypher.com. To have the domain's record deleted as well, write to privacy@encypher.com. ## 6. Security Encypher uses access controls, encryption, logging, and other safeguards appropriate to the systems it operates. No security measure eliminates all risk. ## 7. Choices and rights Depending on location, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal data. Send requests to privacy@encypher.com. Encypher may verify identity and preserve data that law or security duties require it to keep. You can change your cookie choices at any time with Cookie Settings in the site footer, and unsubscribe from the newsletter with the link in any newsletter issue. ## 8. International processing Service providers may process data in locations where they operate. Encypher does not claim EU-only or region-locked processing unless an approved written agreement and current deployment record say so. ## 9. Children The Service is not directed to children under 13, and Encypher does not knowingly collect their personal data through account registration. ## 10. Changes and contact Material changes will be posted with a new version and effective date. Contact privacy@encypher.com for privacy questions.