Legal

Privacy Policy

Effective October 30, 2026 · Previous version effective October 2, 2026 (PRIV-2026-10-02)

What we collect

We collect only what is needed to operate the accessible hosted experience, provide paid services to customers who have them, and respond to inquiries:

• Verification requests. A file selected in hosted Verify, and any proof file you add, is sent to the Service for processing. The public Create demonstration does not send its selected file to the Service.
• Bot-protection signals. To prevent automated abuse, we use a third-party bot-protection service. To perform that check, that provider processes technical signals such as your IP address and browser characteristics under its own privacy terms.
• Usage event records. We may keep a short record of each check for operational and reliability purposes: what kind of file it was (for example, JPEG or PNG) and the category of each result (for example, whether Content Credentials were present). These records contain no file content, file name, file size, file fingerprint, or IP address, and are not linked to an account. They are stored with our database provider.
• Paid C2PA validation. If you have a paid plan, the files your software sends and the account and billing records described in "Paid C2PA validation" below.
• Support communications. Messages you voluntarily send us, and the email address you send them from.
• Standard network information. Our hosting and delivery providers, and our own server logs, process standard request data (such as IP address, the page or endpoint requested, and the time) as needed to serve and protect the Service.

What we do not collect

• Create demonstration files are not uploaded. The public Create demonstration reads a selected JPG or PNG in the browser only to illustrate the flow. It creates no watermark, signature, or record.
• No account or profile for the public website tools. We do not require your name, email, or a login to use the public website tools, and we do not build advertising profiles. Paid C2PA validation does use an account, described below.
• No advertising tracking cookies or pixels.
• No sensitive or regulated data. Do not submit confidential, regulated, health, financial-account, export-controlled, classified, or children's information.

Service providers and sub-processors

We use service providers to operate the Service, including hosting, DNS, security and bot-protection, a database provider for usage event records and for the account and billing records of paid plans, Stripe, our payment provider for subscriptions and validation packs, and a randomness source that supplies random numbers for the fingerprint. None of your image content and no personal information is sent to the randomness source. We require service providers to process personal information only as needed to provide services to us, maintain security, prevent abuse, comply with law, and support business operations. For security and procurement purposes, we may provide a current list of material sub-processors to business users upon reasonable written request or under NDA.

How we use information

We use the limited information above to operate, maintain, and secure the Service; to detect, investigate, and prevent fraud, abuse, and security incidents; to respond to support requests; and to comply with legal obligations. We do not use personal information for targeted advertising, and we do not sell personal information.

Privacy rights; no sale or share

Depending on where you live, you may have rights to access, correct, or delete certain personal information, and to appeal certain privacy decisions. Because the public website tools need no account and we do not keep files you submit to hosted Verify, we typically hold little or no personal data about users of the public website tools. If you have a paid plan, we hold the account and billing records described in "Paid C2PA validation". To make a request, email tom@phase3ai.com; we will respond within 30 days and may verify your identity first. We do not sell personal information and do not share it for cross-context behavioral advertising.

Legal bases (EU/UK users)

Where the GDPR or UK GDPR applies, we rely on our legitimate interests in operating and securing the Service (including bot protection), on performance of our contract with you for paid plans and commercial engagements, and on compliance with legal obligations. You may object to processing based on legitimate interests as provided by law.

Security; breach notification; international transfers

We use reasonable administrative, technical, and organizational safeguards, including encryption in transit (TLS). No internet service can be guaranteed secure. If we determine that a security incident requires notification, we will notify affected users without undue delay and within the time required by applicable law. The Service is operated from the United States.

Paid C2PA validation

The public Verify tool, paid C2PA validation, and enterprise or technical evaluations handle data differently. This section covers paid C2PA validation. An eligible standard plan may be activated through secure Stripe Checkout after signed paid-invoice confirmation; a sales-assisted plan is activated by a person under the applicable agreement. Paid customers may validate in the browser without an API key, and developers may use the same service through the API. Enterprise and technical evaluations are handled under their own written agreement, and the information you send us for them (for example, contact details and evaluation materials) is used for that engagement.

• What is sent. The browser account or your software sends a supported JPEG, PNG, WebP, MP3, WAV, M4A or MP4 file to paid validation. Browser requests use the signed-in account session and do not send or expose an API key. API requests include the developer API key and an idempotency key you choose.
• Why. We use the file only to produce the validation report you asked for, and to bill and account for that request.
• How the file is handled. The file is handled by an isolated validation process. Submitted file bytes are not durably retained: they are not written to ChaosMark's application storage or registry. Hosting or runtime infrastructure may briefly buffer a request while it is in transit.
• Reports. A completed validation report is available for recovery for up to 24 hours, so that you can recover a lost response. After that it is no longer returned. Its text and the technical details stored with it are removed from our database later by cleanup, not necessarily at the moment the 24 hours end, and copies may persist in backup and disaster-recovery systems according to their applicable backup retention. The record of the request itself remains (see the next item). A report may include or reproduce information contained in the file's Content Credentials (its C2PA manifest), where present: for example names, identity assertions, descriptive metadata, and thumbnails or other embedded manifest material. ChaosMark reports what the manifest contains and whether it validates; it does not independently verify that those assertions are true.
• Records kept after a report expires. To bill correctly, settle disputed or undetermined charges, and prevent duplicate charges, we keep a billing record for each request: its reservation and usage identifiers, your idempotency key, the amount charged or released, its status and times, a cryptographic fingerprint (SHA-256) derived from the submitted file and its media type, a SHA-256 fingerprint of the report that was delivered, and related audit, capacity and reconciliation entries. These fingerprints let a request be matched to its charge; they are not the file or the report, but they are not anonymous either. Do not put personal information in idempotency keys: they are stored with these records and can appear in our server logs.
• Account, session, recovery and API records. A paid plan has account and tenant identifiers, your organization's name, your role in it, your plan, and its allowance and usage. Browser session tokens and customer-created recovery codes are stored only as domain-separated SHA-256 digests; sessions expire, recovery codes expire and rotate after successful use, and revoked values cannot be replayed. API keys are stored as a keyed hash (HMAC-SHA-256 with a secret held by ChaosMark); only a key identifier, the key's public prefix and its last four characters are kept in readable form, so that you can recognise a key. The full API key is never kept in readable form. A newly issued first key may be held encrypted, with a key ChaosMark keeps outside the database, so that you can view it once. Once you view it, the encrypted copy is cleared. If you do not view it within the viewing period, it can no longer be viewed, and the encrypted copy is removed later by cleanup; copies may remain in backups according to their applicable backup retention. We keep a record of acceptance of these Terms for each paid plan; where they are accepted online, that record includes SHA-256 hashes of the IP address and browser user agent used. These hashes are pseudonymous identifiers, not anonymous data.
• Payments (Stripe). When billing is enabled for a paid plan or one-time validation pack, Stripe, our payment provider, collects your payment details and billing contact details (such as email address, name, billing address and tax ID) under Stripe's own privacy terms. Stripe sends us billing event notifications that can contain those contact details; we do not keep them in our billing database. From each event we keep only a limited set of billing facts (Stripe customer, subscription, invoice, payment, refund, dispute and credit-note references; status; amounts, currency and tax totals; plan or pack and billing-period information) and a fingerprint (hash) of the event. For accounting and reconciliation, our automated operations export invoice and PaymentIntent records from Stripe; those temporary export files can include the billing contact details shown by Stripe and are removed when the reconciliation cycle ends. ChaosMark does not receive or store full payment-card numbers. Stripe does not receive the files you submit for validation.
• Stopping renewals without signing in. If you lose your account session and recovery code, contact tom@phase3ai.com from the email address on your Stripe receipt and quote its receipt number. We use the supplied email address and receipt reference to locate your ChaosMark subscription, stop future renewals and retain the request with the billing records.
• How long. These periods describe what the software does today. Browser sessions expire within 30 days. A customer-created recovery code expires 365 days after it is created and is replaced when a new one is created or used. A completed report is returned for up to 24 hours; after that its text is removed from our database by a cleanup task, and a record that the report existed, with its cryptographic fingerprint, is kept with the billing records. Database backups are kept according to the retention schedule configured with the database provider; a report may persist in a backup until that backup expires. Billing, contract, account, security, fraud-prevention, reconciliation and acceptance records may be retained as reasonably necessary for contract administration, accounting and tax obligations, security and fraud prevention, reconciliation, dispute resolution, and legal and regulatory obligations. We have not yet set fixed deletion periods for these records. We do not promise immediate or permanent deletion of these records on request where the law allows us to keep them; we will tell you what we keep and why.
• Our role. SapienCX LLC is the controller of website, account, billing, security and commercial administration data. For content a business customer submits for validation, where the customer determines the purpose of the processing, we may act as the customer's processor or service provider under the applicable agreement. We offer a data processing agreement to paid and Enterprise customers where one is required.

Data retention

Existing signed evidence records are retained according to the applicable product terms so previously issued evidence can continue to be checked. The public Create demonstration creates no new record.

The public Create demonstration uploads and retains nothing. Files submitted to hosted Verify are used to process the request and are not retained in ChaosMark's durable evidence registry or application storage after processing. Temporary request-handling storage is used while a request is processed: an upload larger than 1 MiB may be written to a temporary file on the server, which is deleted when the request ends, and hosting or runtime infrastructure may also buffer requests. The usage event records described above are kept in de-identified form, with no file content or IP address. Hosting, DNS, security, and bot-protection providers process standard request data such as IP address as needed to serve and protect the Service. To limit how often a client can send requests, the Service keeps each client's IP address in memory while the server process runs; the rate limiter does not save it, and it is cleared when the process restarts. When a request is refused for exceeding a rate limit, the IP address is written to our server logs for security purposes. Support messages are kept as needed to handle the request and for a reasonable period afterward for legal and security purposes.

For paid C2PA validation, reports are available for recovery for up to 24 hours. After that they are no longer returned; stored report details are removed later by cleanup and may remain in backups according to applicable backup retention. Submitted file bytes are not durably retained. The billing, account and acceptance records described in "Paid C2PA validation" are kept as stated there.

ChaosMark Local Agent for Windows

The Local Agent is an application that runs on your computer. It reads the files you choose to protect or verify there. It contains no code that sends those files, their evidence packages, or usage data to SapienCX, and it does not need an internet connection to protect or verify a file.

• Evidence packages. A .chaosmark package is saved where you choose. It contains a fingerprint (SHA-256) of the file, its size and type, the time it was protected, random identifiers, a signature, and the public half of the signing key. It does not contain the file itself, and the record inside it does not include your name, user name, or computer name. The package's file name normally includes the original file's name.
• Signing key. On your first Protect, the Local Agent creates a signing key for your Windows user account and stores it in your local application data folder (ChaosMark\Local Agent\device-key), protected by Windows for your account only. The private key is never placed in a package or sent anywhere.
• Removing it. Delete the Local Agent folder. To remove the signing key too, delete the ChaosMark\Local Agent\device-key folder in your local application data. If the Local Agent folder was read-only, it may also have left a small lock file in a chaosmark-verifier folder in your temporary files, which you can delete.

Children

The Service is not intended for and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child submitted personal information, contact tom@phase3ai.com and we will take appropriate steps to delete it.

Changes to this policy

We may update this policy. Material changes will be reflected by a new effective date above.

Contact

Questions about privacy: tom@phase3ai.com.