Privacy

Draft, not yet in effect. The bracketed details are placeholders the owner will supply, and the text is pending owner and counsel review.

Who is responsible

[legal entity name: owner to supply], [entity form and jurisdiction: owner to supply], is responsible for personal data handled through this website. Contact [contact email: owner to supply].

What we collect, and why

• Your email address, to sign you in. We send a one-time sign-in link to it. Your account is identified by a one-way hash of the address. The address itself is kept only in your signed session cookie, so we can show who is signed in; we do not keep a list of addresses.
• Purchases. Payment is handled by Stripe, which receives the details you enter at checkout. We keep the Stripe customer and subscription identifiers linked to your account, and your plan, its status and renewal date, so we can show them to you and provide what you bought. We never see or store your card number.
• Messages you send us. The Enterprise contact form and the early-access waitlist send your name, work email, company, fleet size and message to our team inbox, so we can reply. We keep them for [contact message retention: owner to supply].
• Your chain file, if you buy an evidence bundle. To make the bundle we ask you to email us your chain file. It holds your receipts, including the action details your agents recorded, and your agents’ public keys. It never holds a signing key, and we never ask for one. We use it only to timestamp the chain and build your bundle, and we keep the chain file and the bundle for [chain file and bundle retention: owner to supply], so a copy exists if you need it again.
• Abuse protection. To limit how often sign-in links and messages can be sent, we count requests per email address and per IP address. Only one-way hashes are stored, never the address itself, and the counts are deleted after 15 minutes.
• Server logs. Our own logs record request identifiers and error types, not your email or message. Our hosting provider also keeps standard request logs, such as IP address and time.

What we do not collect

No analytics or advertising cookies, and no tracking across sites. Receipts you record with Lacre Core stay on your own systems. We receive them only if you send us your chain file for an evidence bundle, as described above. The offline verifier makes no network requests.

Cookies and browser storage

One essential cookie keeps you signed in for up to seven days; it is cleared when you sign out. On the sign-up page, the address you typed is held in your browser tab for one page load, so it is not lost if sending fails.

Who processes data for us

• Vercel, which hosts the website.
• Neon, which hosts our database.
• Stripe, which takes payments.
• [sign-in email provider: owner to supply], which delivers sign-in emails.
• [mailbox provider for chain files: owner to supply], which hosts the inbox that receives chain files for evidence bundles.

Your choices and rights

You can ask what personal data we hold about you, or ask us to correct or delete it, by writing to [contact email: owner to supply]. We delete what we are not required to keep; payment records may have to be kept for tax and accounting purposes.

Changes

When this policy changes, the effective date above changes, and material changes are announced on this site before they apply. The Terms cover using the service.