Privacy
Last updated: August 2026
1. Who we are
This Privacy notice describes how the operators of Hardlock5 (“Hardlock5,” “we,” “us”) process personal data in connection with hardlock5.com, the Hardlock5 application, and related services (the “Service”). For questions or to exercise your rights, email privacy@hardlock5.com. Where Brazilian LGPD applies, we act as controller for personal data we determine the purposes and means of processing, except where we process data solely on documented instructions of an enterprise customer under a separate agreement (in which case roles will be defined in that agreement).
2. Scope and honesty about maturity
We process personal data to provide certification, verification, accounts, security, billing, and product improvement. We do not sell personal data for advertising. Formal compliance certifications (for example completed SOC 2, designated DPO filings, or comprehensive GDPR Article 27 representation) may still be maturing; this notice describes current practice and is not a certification. Mandatory legal rights continue to apply where the law grants them.
3. Categories of data
Depending on your use of the Service, we may process: (a) identity and contact data (name, email, organization, role); (b) authentication and security data (IdP identifiers, session metadata, MFA status); (c) media files and associated metadata you upload for certification or verification; (d) certificate, job, audit, and verification outcome records; (e) billing, credits, and payment references from payment providers (we typically do not store full card numbers); (f) support communications; (g) device/technical logs (IP address or derived signals, user agent, timestamps, error logs); and (h) analytics events as described below.
4. Purposes and legal bases
We process personal data to: provide and operate the Service; create and manage accounts; perform certification and verification; secure the Service and prevent fraud/abuse; process payments and credits; provide support; improve reliability and features; and comply with law. Where LGPD/GDPR-style bases apply, we rely as appropriate on: performance of a contract; legitimate interests (security, product improvement, aggregate analytics) balanced against your rights; legal obligation; and consent where required (for example certain optional cookies or marketing, if introduced). You may withdraw consent where processing is consent-based, without affecting prior lawful processing.
5. Public verification uploads
If you verify a file without an account, we process the file and related technical data to extract watermarks, query on-chain certificates, compare fingerprints, return a verdict, and protect the Service (rate limiting, abuse detection, security logging). Do not upload files you are not permitted to process. Verification is not used to build advertising profiles.
6. Issuer media and certificates
Issuers upload source media and metadata to issue certificates. We process that data to embed watermarks, store objects, run pipelines, maintain certificate and audit history, and provide dashboards. You must ensure you have lawful grounds to process any personal data appearing in media (for example identifiable people) before upload.
7. Verification analytics
We store verification event records for product analytics (for example outcome counts, coarse geography, time series). In the analytics dataset, IP addresses are hashed at ingest with a server-side secret and the raw address is discarded before any record is written; those analytics records are deleted after 12 months. Separately, our internal verification and audit records do retain the raw IP address and user agent of requests, including anonymous verification requests, for security, forensics, and tamper-evidence; we have not yet defined an automatic deletion period for those records. Aggregated statistics contain no personal data and are kept indefinitely. UI disclosures list the analytics fields in more detail.
8. Payments
If you purchase credits or plans, payment processors process payment data under their own privacy policies. We receive limited billing metadata (status, amounts, references) needed for accounting, fraud prevention, and access control.
9. Retention
We retain personal data as long as needed for the purposes above. Two categories are deleted automatically today: uploaded source media, after 90 days; and verification analytics records, after 12 months. Other categories are currently retained without a fixed end date, including account and profile records (which may include identity document details you provide), identity-verification documents you upload, certificate records, audit records, and billing records. We are actively working to define and automate retention periods for those categories, and this notice will be updated as each one lands. Records anchored to a public blockchain cannot be deleted at all; see the blockchain section. Aggregated, non-identifying statistics are kept indefinitely.
10. Sharing
We share personal data with: infrastructure and service providers (hosting, storage, email, identity, monitoring, payments) under contractual restrictions; professional advisors under confidentiality; authorities when required by law or to protect rights, safety, and security; and successors in a merger, acquisition, or asset transfer. We do not sell personal data. Public verification results and on-chain certificate fields may be visible to anyone who has the relevant identifiers or media.
11. International transfers
We and our providers may process data in countries other than yours. Where required, we use appropriate safeguards (for example contractual clauses or other lawful transfer mechanisms). Blockchain networks are globally distributed by nature.
12. Public blockchain limitation
Data anchored on Klever Blockchain is public and durable. Certificate identifiers, hashes, and related on-chain fields may be permanently visible and copyable by third parties. Off-chain deletion or account erasure cannot fully remove public chain history. Do not place secrets or unnecessary personal data into fields that will be anchored on-chain.
13. Security
We implement technical and organizational measures appropriate to risk (access controls, encryption in transit where configured, segregation of duties, logging, and key-handling practices for signing materials). No method of transmission or storage is 100% secure. You are responsible for safeguarding your passwords, MFA devices, API keys, and issuer signing keys.
14. Cookies and similar technologies
We use essential cookies or local storage for authentication sessions, security, locale, and core product function. We do not use third-party advertising cookies on the marketing site for cross-site behavioral advertising. If we introduce non-essential cookies that require consent in your region, we will request consent where required.
15. Children
The Service is not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child provided personal data, contact us and we will take appropriate steps to delete it where required.
16. Your rights
Subject to applicable law (including LGPD where applicable), you may have rights to confirm processing, access, correct, anonymize, block, or delete personal data; portability; information about sharing; withdrawal of consent; and review of automated decisions if legally applicable. We may need to verify your identity and may refuse or limit requests as permitted by law (for example fraud prevention, legal claims, or technical impossibility regarding public blockchain data). To exercise rights, email privacy@hardlock5.com. We aim to respond within 15 days, and will tell you if we need the one extension the law allows. You may also contact a competent data protection authority.
17. Automated processing
Verification produces automated technical verdicts from watermark extraction, chain lookups, and fingerprint comparison. These outputs are origin-attestation signals for the media sample submitted, not decisions about legal rights or creditworthiness. Some verdicts are negative and publicly visible, including a verdict indicating that content appears to have been modified after certification. To be clear about current capability: there is no self-service mechanism in the product today to contest or request human review of a verdict. If you believe a verdict about your media is wrong, contact us using the details in the Contact section and we will review it manually. We are building a proper review workflow.
18. Changes to this notice
We may update this Privacy notice. We will revise the “Last updated” date and, where required, provide additional notice. Continued use after changes become effective means you acknowledge the updated notice, except where mandatory law requires express consent for a specific processing change.
19. Contact
Privacy questions, complaints, or rights requests: email privacy@hardlock5.com. We aim to respond within 15 days. We will handle requests in line with applicable law and our technical capabilities, and will tell you plainly where a request cannot be fully satisfied (for example data anchored to a public blockchain, which cannot be deleted).