Privacy for evidence you can trust.

1. Scope and Roles

This policy applies to all users of the Services, including the public website, Chrome extension, and enterprise deployments.

Authmarks generally acts as the data controller for account management, billing, and core platform operations. In enterprise or organizational deployments, Authmarks may act as a data processor (service provider) on behalf of the customer organization, which acts as the data controller.

2. What Authmarks Does

Authmarks keeps a sealed record of how a document was written, mainly in Google Docs, and provides review before that record is sealed. It is not an AI-detection score. This policy describes what information is handled. It does not describe how the record is produced. Provisional patent protection applies.

3. Information We Collect

We only collect what is necessary and only with appropriate consent or legal basis:

• Account and Identity Data. Email, name, organization details, and authentication identifiers (via our self-hosted identity service) when you create or sign into an account.
• Extension Session Telemetry (explicit opt-in only). When you actively consent to recording for a specific document, telemetry may include typing patterns, timing, rhythm, character-level events, copy/paste/cut/deletion events, focus/idle and revision metadata, human-effort signals, structured edit logs, and revision history.
• Document-Derived Data. Hashes, cryptographic proofs, limited extracted text snapshots (only when required for verification or C2PA sealing), and provenance metadata.
• C2PA Manifests. Cryptographic signatures and manifests when you choose to seal a document.
• Google API Data (optional and scoped). Limited access to Google Docs/Drive only for features you explicitly enable and only for permitted purposes.
• Technical and Usage Data. Browser type/version, IP address (for security and geolocation-based hosting decisions), error logs, and anonymized usage analytics.
• Persistent device identifier. The extension mints a random device ID stored locally and stamped on capture events so the same browser profile can be correlated across sessions. This is not browser fingerprinting: it is an opaque ID we generate, not a profile built from hardware or tracking signals across the open web.
• Support and Communications. Messages and materials you send us.

We do not scan or store full document content unless strictly necessary for a feature you have enabled (for example C2PA sealing or verification workflows).

4. How We Use Information

We use information to:

• Provide human-effort detection, session provenance, and verification services.
• Generate and maintain C2PA cryptographic seals.
• Enable EU AI Act compliance features (review, attestation, and ownership transfer).
• Sync data across your devices and authorized reviewers.
• Operate, secure, and improve the Services.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell personal data. We do not use Chrome extension data for third-party advertising or unrelated purposes.

4A. Lawful Bases for Processing (EEA/UK)

Where GDPR or equivalent laws apply, Authmarks generally relies on the following lawful bases:

• Consent: document-level recording telemetry, optional Google-connected features, and certain analytics where required.
• Contract: providing account services, provenance, verification, and support features you request.
• Legal obligation: compliance with applicable law, lawful requests, and required records.
• Legitimate interests: service security, fraud/abuse prevention, reliability monitoring, and product integrity improvements.

5. Consent and Recording in the Chrome Extension

Recording is off by default and strictly opt-in per document. You must explicitly click "Allow recording" (or equivalent) in the extension or in-page banner before we collect typing telemetry or human-effort signals for that document.

• If you decline or choose "Not now," no session telemetry is collected.
• Pause stops capture for the current session; it does not revoke consent.
• Revoke turns consent off and purges local evidence that has not yet been sealed.
• Without active consent, no human-effort score or session-based provenance is generated for that document.
• Sealed records may remain retained where necessary to preserve forensic integrity, prevent abuse, satisfy legal obligations, or meet organizational policy (see Retention).

6. EU AI Act Compliance Features

To support EU AI Act transparency obligations — including Article 50’s human-review exception for published text in Art. 50(4) — the Services may include attestation workflows:

• Before certain outputs (especially public/shared content), users may be asked to review the work and confirm ownership via attestation controls.
• Users may request internal company review; when configured, designated reviewers can take ownership in workflow.
• This attestation is recorded as part of the provenance record.

7. C2PA Cryptographic Sealing

When you choose to cryptographically seal a document, we generate a C2PA-compliant manifest containing provenance information. The sealed manifest is stored securely and can be independently verified.

For evidentiary trust, sealed manifests and linked provenance records are designed to be tamper-evident. Where records are used in institutional or legal verification workflows, they may not be unilaterally removable by individual end users.

8. Data Hosting and Storage Locations

• Standard hosting. Data is hosted in Finland (European Union) unless otherwise agreed.
• Enterprise customers. Subject to contract and availability, data can be hosted in customer-specified regions to avoid or minimize cross-border transfer.

Data is encrypted in transit (TLS) and at rest.

9. Data Sharing and Subprocessors

We share data only with trusted subprocessors under appropriate contractual controls (for example cloud infrastructure, authentication, database, and security providers) and only for the purposes in this policy.

We may disclose data if required by law, to protect rights and safety, or in connection with a corporate transaction. We do not sell personal information.

See our Subprocessors page for the current list (last updated on that page). Enterprise customers may subscribe to advance change notice under their DPA (typically 30 days for new subprocessors that process personal data on their behalf). Contact sales@authmarks.com.

10. Data Retention

Default retention schedule for standard (non-enterprise) accounts. Enterprise customers may configure longer or shorter windows by contract:

• Account data (email, org, auth identifiers) — retained while the account is active; deleted within 30 days of account closure, subject to legal holds.
• Unsealed session telemetry (keystroke events, paste evidence, human-effort signals for drafts that were never sealed) — retained for 90 days by default, then deleted or aggregated to non-identifying metrics.
• Sealed provenance records + C2PA manifests — retained for the minimum period required to preserve independent verifiability of the seal; typically 7 years for standard accounts, and for the term of the underlying contract or investigation for enterprise/legal use.
• Support tickets and communications — retained for 24 months after resolution to support security investigations and dispute resolution.
• Security and access logs — retained for 12 months.

Erasure requests under GDPR Article 17 (right to be forgotten) and equivalent laws are reviewed under applicable law. Sealed records may be restricted from erasure where retention is required to preserve evidentiary integrity, prevent abuse, or meet legal, contractual, audit, or dispute-resolution obligations. In those cases we will explain the specific basis and offer any partial-erasure alternatives permitted by law.

10A. Institutional Controls

In academic, legal, media, and enterprise deployments, retention, reviewer access, and attestation workflow controls may be configured by the institution or organization.

Individual users may withdraw future recording consent, but institutional policies may govern preservation of already captured records used for compliance, investigations, disputes, audit, or evidentiary review.

11. Security

We implement administrative, technical, and organizational safeguards appropriate to data sensitivity, including encryption, access controls, monitoring, and regular security assessment practices.

12. Your Rights and Choices

Under GDPR and equivalent laws, you may have rights to:

• Access (GDPR Article 15) — request a copy of the personal data we hold about you.
• Rectification (Article 16) — correct inaccurate or incomplete data.
• Erasure (Article 17) — request deletion, subject to the evidentiary-integrity limits described in Section 10.
• Data portability (Article 20) — receive your provenance records in a structured, machine-readable format (JSON export from the dashboard).
• Withdraw consent at any time (Article 7) — recording stops immediately and no further telemetry is collected.
• Object or restrict (Articles 18 and 21) — where processing relies on legitimate interests.

Most controls are available in the extension and dashboard. For anything not self-serve, contact sales@authmarks.com; we respond within 30 days (extendable to 90 days for complex requests, as permitted by GDPR Article 12).

Residents of the EEA, UK, and other jurisdictions with data-protection rights may also lodge complaints with their supervisory authority.

13. International Data Transfers

Because standard hosting is in Finland (EU) and enterprise hosting can be regionalized, cross-border transfers are minimized where possible. Where transfer outside the EU/EEA occurs, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent legal mechanisms.

14. Cookies and Similar Technologies

We use necessary cookies and local storage for authentication, session management, and functionality. Analytics cookies are used with appropriate legal basis and in anonymized form where possible. You can manage preferences through browser settings.

15. Children's Privacy

The Services are not directed at children under 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal data from children.

16. Changes to This Policy

We may update this Privacy Policy. Updated versions are posted on this page with a new effective date. Material changes are notified in-product or by email where required.

17. Contact

Privacy questions, data-subject requests, DPA / SCC requests, or legal notices: sales@authmarks.com.

Chrome Web Store and Google-Specific Disclosure

Our Chrome extension collects and processes data only with your explicit consent and solely to provide user-facing features described in the Chrome Web Store listing. We comply with the Chrome Web Store User Data Policy, including the Limited Use requirements for Google user data.

We access Google APIs only for authorized purposes you enable, use the data only to provide the user-facing features described here, do not transfer that data to third parties except as needed to provide the service or as required by law, and do not use it for advertising or human review other than for security or to comply with applicable law.

Additional product information is available at authmarks.com.