From d45acb3e16357d804a4dc0dfebd0eda311e1d9fd Mon Sep 17 00:00:00 2001 From: gitea-actions Date: Fri, 28 Aug 2026 11:32:31 +0000 Subject: [PATCH] docs: sync wiki from docs/users (179773f) --- Privacy-Policy.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/Privacy-Policy.md b/Privacy-Policy.md index 99225ea..b1a1257 100644 --- a/Privacy-Policy.md +++ b/Privacy-Policy.md @@ -14,6 +14,7 @@ This policy applies to the Arcs & Angles web and desktop applications and relate Depending on how you use the Service, we may process: - Content you create in the app (for example map files, labels, and exports). +- Provenance identifiers embedded in files you export under a paid license, and requests we receive when somebody scans the QR code on an exported map (see Section 6a). - Technical and usage data needed to run core features (for example IP address, device/browser information, request timestamps, and application version checks). - Local settings and recovery data stored on your device (for example preferences, recent files, and recovery drafts). - Account or backend-related data processed through our backend services when those features are enabled (for example authentication identifiers and related metadata). This authentication infrastructure is operated by IMBENJI.NET LTD, not a third party. @@ -52,6 +53,28 @@ We use information to: - Improve and develop Service features. - Improve the Service, including the AI Assistant/agent feature, using information from how the Assistant/agent is used. +## 6a. Export Provenance + +Files exported under a paid license carry provenance information identifying the seat that produced them. This section explains what that is, because it is personal data even though it contains no name. + +**What is in an exported file.** Every PDF, SVG and PNG exported under a paid license contains a signed token in its file metadata recording an opaque seat identifier, the license tier, and the date of export. On the Personal and Commercial tiers the visible mark also carries a QR code containing an opaque reference. Operational and Authority licensees may switch the metadata token off, in which case their exports carry no provenance information at all. + +**The identifier is a stable pseudonym.** It is not a name, an email address or a company name, and it cannot be resolved to a person by anyone other than us. It is nonetheless the same identifier on every file a given seat produces, so anyone holding several files can establish that one producer made all of them, and we hold the mapping from that identifier to your account. Under UK GDPR that makes it personal data in our hands, and we treat it as such. + +**When somebody scans a QR code.** The code resolves against our server, so we receive the request: the reference, an IP address, approximate location derived from it, the time, and browser information. A person scanning a code sees only the Arcs & Angles website and learns nothing about the licensee. Our staff, when signed in with an administrator account, can resolve the reference to the account that holds the seat. + +**Administrator lookups are logged.** Every occasion on which a member of our staff resolves a seat identifier to an account is recorded, including who performed the lookup, which identifier, and when. + +**Retention.** Three different things are kept for three different periods, because they serve different purposes: + +- **The mapping from seat identifier to account** is kept for as long as the license exists and for six years after it ends. Six years is the period in which a claim arising from a licensed export could still be brought, and the mapping is what makes such a question answerable at all. +- **Scan request logs** — the records created when somebody scans a QR code on an exported map — are kept for **90 days**. These are operational and analytical records rather than evidence, and they are the most sensitive thing in this section, since they can indicate where a diagram is being looked at. They are not retained beyond the period in which they are useful for running the service. +- **Administrator lookup logs** — the record of each occasion a member of our staff resolved a seat identifier to an account — are kept for six years, matching the mapping itself. This log exists to hold us to account for accessing that data, so it is retained for as long as the data it governs. + +Deleting your account removes the mapping ahead of these periods where we are not required to retain it. + +**The application does not report your exports to us.** Exporting requires no network connection and sends us nothing. We learn about an export only if somebody scans its code or sends us its file. + ## 7. International Data Transfers If personal data is transferred outside the United Kingdom, we use appropriate safeguards required by applicable law, which may include adequacy decisions or approved standard contractual clauses.