by cetome

Privacy Policy

Last updated:

1. Data Controller Identification

This Privacy Policy outlines how personal and technical data is processed on CRAscoping.com (the "Service", "Platform", or "Site").

The Data Controller responsible for processing operations under Regulation (EU) 2016/679 (General Data Protection Regulation - "GDPR") is cetome, a company registered in France under SIRET 84983610100014 (hereinafter referred to as "cetome", "we", "us", or "our").

For any privacy inquiries, data subject right requests, or technical compliance queries, you may contact us via our official contact form.

2. Categories of Data Collected & Purposes of Processing

We collect and process data across four main operational areas:

A. Technical Input Data & Product Specifications

  • Data Collected: Product names, technical descriptions, architectural details, connectivity specifications, hardware components, microprocessors, intended operational context, and uploaded datasheets or files submitted via the web scoper interface or API endpoints (/api/).
  • Purpose & Legal Basis: Processed strictly to translate, analyze, and compute regulatory classification reports under Regulation (EU) 2024/2847 (EU Cyber Resilience Act). Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).
  • Evaluation Records: Each evaluation (product name, description, the classification report, a pseudonymous session identifier, IP address and browser signature) is recorded in an evaluation log used for service quality, abuse prevention and, where the customer requests it, human review of the classification. Input data is never utilised to automatically train, retrain, fine-tune, or adjust weights of any artificial intelligence models.

E. Product Catalogue (Customers and Guests)

  • Data Collected: Products you choose to keep in your product catalogue: product name, manufacturer, technical description, the classification results, and any review or comment you record about a classification.
  • Customers: The catalogue is stored on our servers and linked to your account for as long as you keep it; you can edit or delete any product, or the whole catalogue, at any time from the catalogue page.
  • Guests (no account): The guest catalogue is stored in your server-side browsing session, identified by a strictly necessary session cookie (cra_session) that expires after 30 days of inactivity. It is limited in size, is not linked to any identity, and is either moved into your account when you sign in or subscribe, or deleted when the session expires. Clearing your browser cookies deletes it immediately.
  • Purpose & Legal Basis: Providing the catalogue feature you request (performance of a contract, Art. 6(1)(b) GDPR, or the pre-contractual steps you initiate as a guest).

B. Account & Billing Data

  • Data Collected: Corporate email address, contact name, billing address, tax identifier (e.g., European VIES VAT number), and subscription records. Payment card details are collected directly by our PCI-DSS certified payment processor, Stripe; cetome does not store raw credit card numbers.
  • Purpose & Legal Basis: Account management, provisioning access keys, generating tax-compliant invoices, and executing subscription billing. Legal basis: Contract performance (Art. 6(1)(b) GDPR) and legal obligations regarding accounting and VAT directives (Art. 6(1)(c) GDPR).

C. API Telemetry & Security Logs

  • Data Collected: Authenticated user identifier, API Key identifier, request timestamps, incoming IP address, user-agent string, endpoint payload dimensions, and HTTP response codes.
  • Purpose & Legal Basis: Used to enforce rate limits, prevent credential sharing, detect malicious request patterns, guarantee platform stability, and ensure system defense. Legal basis: Legitimate interest in securing digital infrastructure (Art. 6(1)(f) GDPR).

D. First-Party Web Analytics (Matomo)

  • Data Collected: Anonymized IP addresses, page views, referral URLs, outbound link clicks, browser type, screen resolution, and visit duration.
  • Purpose & Legal Basis: Operated via our self-hosted analytics infrastructure (stats.cetome.com) using Matomo Analytics (Site ID: 3) to evaluate site usage, performance, and visitor navigation without transmitting data to third-party advertising networks. Legal basis: Legitimate interest in optimizing web interface utility (Art. 6(1)(f) GDPR).

3. Analytics and Tracking (Matomo Disclosure)

We utilize an isolated instance of Matomo Analytics hosted directly on our European infrastructure (stats.cetome.com).

Unlike conventional third-party analytics platforms, our Matomo installation processes data locally under our direct control. Collected telemetry is used exclusively for site optimization and aggregated traffic analysis. We do not correlate Matomo tracking records with API credentials, billing data, or submitted product specification files.

4. Security Infrastructure and Safeguards

We implement administrative, organizational, and physical security measures designed to protect your data against unauthorized access, loss, or alteration:

  • Encryption in Transit: All web traffic, user sessions, and API communications are secured using mandatory Transport Layer Security (TLS/HTTPS) protocols.
  • Cryptographic API Authentication: API access relies on unique cryptographic API key identifiers transmitted via secure request headers (X-API-Key).
  • Infrastructure Isolation: Production services, processing workloads, and analytics platforms are hosted within secure, European-based cloud data centers operating under strict physical and logical access controls.
  • Payment Compliance: All credit card transactions are handled via Stripe’s PCI-DSS Level 1 certified payment infrastructure.

5. Third-Party Service Providers (Data Processors)

To operate the Service, we share necessary data with trusted third-party service providers acting as Data Processors bound by data processing agreements:

  • Stripe, Inc.: Payment processing, customer invoicing, and tax calculation.
  • European Hosting & Cloud Infrastructure Providers: Transient execution servers, secure data storage, and network transport infrastructure located within the EU.

We do not sell, rent, or monetize personal data or submitted product descriptions under any circumstances.

6. Data Retention Policies

  • Technical Specification Submissions: Sent to the AI provider for the transient duration of the evaluation only; the resulting evaluation record (see section 2.A) is retained for up to 12 months for service quality, abuse prevention and human review, then deleted.
  • Product Catalogue: Customer catalogues are retained until you delete the products or close your account (then removed with the account data); guest catalogues live in the browsing session and are deleted after 30 days of inactivity, or immediately when the session cookie is cleared.
  • Account & Billing Data: Retained for the duration of the active subscription plus mandatory statutory retention periods under French commercial law (up to 10 years for accounting records).
  • Security Logs: Retained for a rolling window of up to 90 days for infrastructure protection and audit defense before being purged.
  • Matomo Analytics Data: Retained in aggregated, anonymized formats for historical metric tracking.

7. Your Data Protection Rights under GDPR

Under the General Data Protection Regulation, individuals in the European Union hold specific rights regarding their personal data:

  • Right of Access: Request confirmation and copies of personal data held about you.
  • Right to Rectification: Request correction of inaccurate or incomplete personal records.
  • Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where continuous processing is no longer required by law.
  • Right to Restrict or Object: Object to or restrict processing activities based on legitimate interests.
  • Right to Data Portability: Request export of account data in a structured, machine-readable format.

To exercise any of these rights, submit a request through our contact form. If you consider that our processing violates GDPR provisions, you retain the right to lodge a complaint with the French data protection authority, the CNIL (Commission Nationale de l'Informatique et des Libertés - cnil.fr).

8. Amendments to This Policy

cetome reserves the right to update or modify this Privacy Policy to reflect technical adjustments, regulatory updates, or operational changes. Material changes will be noted by updating the "Last updated" timestamp at the top of this document. Continued use of the Service following revisions constitutes acceptance of the updated practices.