Legal
Privacy Policy
Version 1 · effective date: 25 October 2026
Who we are
ClearedBadge is a service of Cubes BV, Amerikalei 209 bus GLV, 2000 Antwerpen, Belgium, enterprise number 0841.104.618 ("ClearedBadge", "we"). Cubes BV is the controller for the processing described here.
This policy is information. You do not need to accept it, and we do not ask for consent: the legal bases are listed below.
Questions and privacy requests: info@clrbadge.com.
In short
- ClearedBadge keeps a fingerprint (a SHA-256 hash) of what you register and the time. It does not store the file or the JSON event itself.
- Where the fingerprint is made depends on how you register:
- Private file registration on the website: the fingerprint is made on your device, and your file is not sent to us.
- Standard file registration, and every registration through an AI agent: your content is sent to our servers, which make the fingerprint in memory and then discard the content.
- Anyone who has a record ID can see that record's fingerprint and time. A record shows no name and no e-mail address.
- Some records made before the current pause were also published on Arweave, a public network designed for permanent storage. New records are not published there at the moment.
- The website uses no tracking, no analytics, no advertising and no cookies.
What we receive, what we store, and what may become public on Arweave
1. What we receive
| How you use ClearedBadge | What reaches our servers | What happens to it |
|---|---|---|
| Record a file — Private (website) | only the 64-character fingerprint, made by your browser. Not the file, its name or its size. | the fingerprint is stored as a record |
| Record a file — Standard (website; this is also what happens without JavaScript) | the file bytes, the file name and the file type your browser sends with the upload | the file is read once, as a stream, in memory, to compute the fingerprint. The file, its name and its type are not stored and not logged by our services. |
| Register a JSON event through an AI agent (ClearedBadge connector) | the full event: your AI client sends it to our connector, which passes it to our registry engine | the event is put in a fixed order (RFC 8785) and hashed in memory. The event is not stored and not logged by our services. There is no local-hashing option for events. |
| Verify on the website (Verify page) | only the record ID. Your file or event is compared in your browser. | nothing is stored |
Verify through an AI agent, or through our API (/verify-event, /verify-file) | the event or file you want to compare | it is compared in memory and discarded; the result is not stored |
| Signing in for the AI connector | from our login provider WorkOS: a signed token with an opaque identifier of your login. Not your e-mail address. | see "What we store" below |
If something goes wrong — invalid input, a refused or timed-out registration, or a database that cannot be reached — our services do not store the content either.
- Our error answers and our own logs are built to contain fixed codes, not your content.
- A test with a marker in the content found the marker in no answer and in no log line of our code. That test covers our own code; it cannot cover every log of every provider.
- A refused file upload is refused before the file is read.
2. What we store
| What | Fields | Linked to you? | Who can see it | Kept |
|---|---|---|---|---|
| Records (the registry) | record ID; fingerprint (SHA-256); the time our server accepted it; status; fixed labels: file or agent_commit, agent, application/json; for files, whether the fingerprint was made on our server (server_sha256) or on your device (device_sha256) | The record itself names no account and no person. For registrations through the AI connector, our registration log (below) links the record ID to your account. Website registrations are not linked to any account. | anyone with the record ID, through the Verify page and our API. In addition, our API (POST /verify-file without a record ID) lets anyone who has the same file look up whether it was recorded, with its record ID and time. The Verify page itself always needs the record ID. | see "How long" |
| Connector account | an internal account ID; the issuer and opaque identifier of your WorkOS login; when it was created; its registration quota; whether it was withdrawn | yes, through WorkOS | only us | until the account is closed |
| Registration log (connector only) | account ID; time; outcome; HTTP status; size in bytes; the resulting record ID; a fingerprint of the event (to recognise a repeat); a short fixed result text | yes | only us | for as long as the account exists: it is the account's quota and what prevents the same event being recorded twice |
| Limits | per account: a request counter per minute. For failed sign-ins and for website uploads: counters under a keyed hash of your network address (website: per UTC day; connector: a coarse number). Your IP address is not stored. | not directly | only us | connector: one counter per account or address slot, overwritten with each new minute. Website: one counter per keyed address per hour and per day, kept without any IP address; we remove old counters from time to time, by hand. |
| Anchoring bookkeeping | per anchored record: the Arweave transaction ID, our wallet address, the fee, the published payload (below), the anchoring status and the times | no | the status, transaction ID and wallet address are public through our status service | for as long as the service exists |
The core fields of a record — its record ID, its fingerprint and the time it was registered — are not changed. The anchoring status is kept separately and changes as anchoring progresses.
3. What may become public on Arweave
Arweave is a public network designed for permanent storage. We cannot change or delete what has been published there.
What was published: each of the 19 transactions that ClearedBadge's wallet published before the current pause (checked on 25 October 2026) contains this structure, and nothing else. Only the values differ:
{"anchored_at":"2026-09-25T21:41:30.038Z","badge_id":"<record ID>","created_at":"2026-09-25T21:41:29.048Z","issuer":"CLRBADGE","network":"arweave-l1","protocol":"clrbadge.anchor.v1","record_type":"agent_commit","sha256":"<the fingerprint>","type":"machine_event_anchor"}- For a file record,
record_typeisfileandtypeisfile_evidence_anchor. - Each transaction carries three public tags:
Content-Type: application/json,Protocol: clrbadge.anchor.v1andApp-Name: clrbadge. - It is signed by ClearedBadge's wallet.
What is not published: your file, your event, a file name, your account or your login.
Now: new records are not published ("not anchored — submission paused"). If we switch anchoring on again, we will update this policy first. Only records made after that moment would be published, with the same fields.
4. Logs
- Our services' own logs contain the time, method, path, status and fixed result codes. For a verification, the path contains the record ID. They do not contain your content, your e-mail address or your IP address; the only network address in them is our hosting provider's internal one.
- Our connector's logs also contain your internal account ID, a keyed reference to your login, an attempt ID and byte counts.
- Our hosting provider Vercel processes your IP address to deliver every request. The request logs it shows us contain the time, the path, the status, your country (derived from the IP address) and your browser's user-agent string. Vercel keeps these logs for a short period under its own retention; runtime logs, for example, for 1 day on our plan.
- WorkOS keeps, for each sign-in session, the IP address and the user-agent string.
- Our database provider Supabase keeps its platform logs for 7 days, and daily backups for 7 days, on our plan. Data we delete can therefore remain in those backups until they expire.
A fingerprint is not automatically anonymous
A fingerprint is designed so that the content cannot be worked out from it. But anyone who has, or can guess, the content can compute the same fingerprint and see that it matches a record.
- For a large or unpredictable file, that is practically impossible without the file itself.
- For a short or predictable event, such as
{"name":"…","result":"approved"}, someone could try candidates until one matches.
So a fingerprint of content that contains personal data can itself be personal data.
If an event contains personal data, you can make guessing much harder by adding a long random value to it: for example a field "nonce" with at least 32 characters from a secure random generator. That value must not be published or reused. This does not help against someone who obtains the full event, including the nonce: they can still compute the fingerprint and find the match.
Who processes data for us
| Provider | Role | Where | Transfer safeguard |
|---|---|---|---|
| Vercel Inc. (USA) | hosting of the website, the registry engine, the AI connector and the anchor service | functions in Washington, D.C., USA (iad1); a worldwide delivery network | Vercel states it is certified under the EU–US Data Privacy Framework; standard contractual clauses in its DPA |
| Supabase | the database | Frankfurt, Germany (AWS eu-central-1); support staff may access it from elsewhere | standard contractual clauses (2021/914) in its DPA |
| WorkOS, Inc. (USA) | sign-in for the AI connector. It holds your e-mail address, your name if you give one, and for each session the IP address and the user-agent string. | USA | standard contractual clauses (2021/914) in its DPA |
| Arweave (public network) | only the anchors described above | worldwide | none possible on a public network; that is why anchoring is paused |
| Your AI provider (e.g. Anthropic, Google) | your AI client sends your event to us and processes your conversation under its own terms | — | not our processor |
Why we may process this (legal basis)
- Performing our agreement with you (the Beta Terms): records, accounts, quota, verification.
- Our legitimate interest in a secure and reliable service: limits, logs, abuse prevention.
- The legitimate interest of the people who rely on a record in being able to verify it later.
How long
| What | How long |
|---|---|
| Records and anchoring bookkeeping | for as long as the service exists, because their purpose is later verification by you and by others. See "Your rights" for erasure requests. |
| Account, login link and registration log | until the account is closed, at your request or because we withdraw it. See "Your rights". |
| Limit counters | see "What we store": they contain no IP address |
| Your login at WorkOS | until it is deleted in WorkOS |
| Logs and backups at our providers | Vercel: runtime logs 1 day. Supabase: logs and backups 7 days. See above. |
Your rights
You can ask for access, correction, erasure, restriction, objection and portability. Write to info@clrbadge.com. We answer within one month, the period the GDPR sets; it can be extended in the cases the GDPR allows.
Closing your account. On request, we close your connector account by hand. We then delete the account, its link to your WorkOS login and its registration log, and we delete your login in WorkOS. After that, our own account data and registration log no longer link your records to you. Our database provider keeps daily backups for 7 days on our plan; deleted data can remain in those backups until they expire.
Erasing records. Records are kept so that you and others can verify content later. If you ask us to erase a record, we assess the request under the GDPR, including the exceptions it allows. Where the law requires it, we erase or restrict the record. Erasing a record makes it impossible for anyone to verify content against it.
Arweave. What was already published on Arweave cannot be deleted by us.
You can complain to the Belgian data protection authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, www.dataprotectionauthority.be).
Please do not register
- secrets: passwords, keys, tokens;
- personal data you may not share with a third-party service.
Medical, legal or other confidential documents may be registered. For those, prefer the Private method, so the file is not sent to us.
Changes
We update this page before anything described here changes, in particular before anchoring on Arweave is switched on again. The date at the top shows the current version.
← Back to CLRBADGE