Privacy Policy

1. What We Collect

AIthentica operates two data planes with different sensitivity levels. We treat them differently by design, not by afterthought.

Account Data

• Name and work email address used to create your account.
• Organization name, team size, and role (General Counsel, Engineering, Design).
• Billing contact information processed by our payment processor — card numbers never touch our servers.

Provenance Evidence

• Cryptographic hashes of your creative artifacts (source files, design iterations, commit histories).
• Timestamped authorship attestations signed with keys you generate and control.
• Repository metadata: file paths, git history fingerprints, license headers detected by the scanner.

Operational Data

• Scan job logs: repository name, scan duration, finding counts, severity distribution.
• Product usage analytics (page views, feature adoption) collected via first-party cookies only.
• Support correspondence sent through the contact form or email.

2. What We Never Do

• We never train machine learning models on your artifacts, hashes, or scan results — not for our customers, not for ourselves.
• We never sell, rent, or share your data with third parties for marketing purposes.
• We never store the full content of your source code. The scanner operates on fingerprints and license headers; file bodies are processed in ephemeral memory and discarded at job completion.
• We never use your provenance evidence to build a resellable database of “who made what.”

3. Why We Collect It

Provenance evidence exists to be admissible. Every data category we collect maps to a specific legal or operational purpose:

• Authorship defense. Timestamped, signed attestations establish human intellectual conception under USCO guidance — the core of any copyright claim over AI-assisted work.
• License compliance. Contamination scan results let engineering teams prove their codebase is free of copyleft exposure before an IPO, M&A diligence call, or platform store submission.
• Audit readiness. Exportable evidence packets satisfy SOC 2, ISO 27001, and EU AI Act documentation obligations without rebuilding history after the fact.

4. How We Protect It

• AES-256 encryption at rest for all evidence records; TLS 1.3 in transit.
• Customer-held signing keys: attestation private keys are generated on your infrastructure. We store only public verification material.
• SOC 2 Type II audited controls and ISO 27001 certified information security management.
• Role-based access with full audit logging; evidence records are append-only and tamper-evident by construction.
• Data residency options: US (Virginia) or EU (Frankfurt) regions for enterprise contracts.

5. Data Retention

Evidence records are retained for the life of your subscription plus a 90-day grace period, after which they are cryptographically shredded (NIST SP 800-88 Purge). You may export your complete evidence portfolio at any time in open formats — COSE signatures, JWS attestations, and JSON evidence manifests. If you delete your account, retention shortens to 30 days.

6. Cookies & Tracking

We use first-party functional cookies to keep you signed in and remember workspace preferences. We do not run third-party advertising pixels, do not build cross-site profiles, and do not load external trackers beyond the web fonts served by Google Fonts (IP address transmitted, no content).

7. Your Rights

• Access. Request a full export of everything we hold about you and your organization.
• Correction. Ask us to fix inaccurate account or billing data.
• Deletion. Erase personal data on request, subject to legal hold obligations where evidence is under active litigation support.
• Portability. All evidence exports use open cryptographic formats — you are never locked into our signature scheme.

EU and UK residents have additional rights under the GDPR, including objection and restriction of processing. Contact our Data Protection Officer at privacy@aithentica.com.

8. Subprocessors

We use a minimal, disclosed subprocessor list: AWS (compute and storage), Stripe (payments), and Google Fonts (typography). Each subprocessor is bound by data processing agreements no less protective than this policy. Material changes to the list trigger a 30-day prior notice to enterprise customers.

9. Changes to This Policy

Material changes are announced in-product and by email at least 30 days before taking effect. The version history of this policy is itself part of our provenance record — every revision is signed and timestamped, so you can verify exactly which policy governed your data at any point in time.

10. Contact

Questions about this policy, a data subject request, or a security concern: email privacy@aithentica.com or use the contact form below. Security reports are triaged within 24 hours.