Privacy
Privacy
A product that sells data protection should be judged first on its own privacy page.
This site
This site sets no cookies and uses no advertising trackers and no third-party resources. Fonts and the audience measurement script are served from our own domain rather than an external service, and the measurement itself goes to our own server: browsing this site sends nothing to anyone but us. The only data you can send us from this site is a beta access request and the audience measurement, both described below.
Audience measurement
To know which pages are read and where our visitors come from, we count visits with GoatCounter, open-source software running on our own server in the European Union. No cookie is set and your IP address is never recorded: it is used, in memory and for a few hours at most, to work out your country and to avoid counting the same visit twice, then it is forgotten. We keep only totals: pages viewed, the domain of the site you came from, browser and operating system, country. No individual visit is recorded, no profile is built, nothing is combined with other data or shared with a third party. This measurement meets the conditions under which the CNIL exempts it from consent. You can object to it here; your choice is stored in this browser.
Beta access requests
The form collects your email address, your organisation’s name, your role, the size of your fleet and, if you wish, a free-text message; it adds the language and the page the request was sent from. This information is used only to review your request and reply to it. It is based on your consent, which you give by ticking the box on the form and can withdraw at any time. It is neither sold nor shared with third parties, and is hosted by OVHcloud in the European Union.
The monitoring service
An enrolled agent sends counters and configuration state: number of requests handled, masking counts per category, token volumes per model, version, platform, loaded locales, substitution mode, secret level and switched-off categories. It sends no prompt, no response and no detected value, not even truncated, and no file name or URL.
The personal data we receive
Two, and we would rather write them here. First the local IP addresses of the machine the agent runs on: these are the machine’s private addresses, not its public egress address; loopback and link-local are dropped, and the list is capped. Then the name the machine calls itself, as the operating system gives it, neither resolved nor hashed. Both are what tie a console row to a machine — without them, a silent agent is just an identifier. The hostname is the more direct of the two, and we will not present it as anything else: a workstation is often named after the person using it. Our backend separately records the address it observes each connection arriving from.
What never leaves the endpoint
Original values, their mapping to stand-ins, and the content of requests. The vault is encrypted, lives in memory, and is never transmitted.
Location
Monitoring data is hosted in the European Union.
Retention
Our retention periods follow the CNIL’s reference guidelines. A beta access request is kept for three years from our last exchange, then deleted. Audience measurement statistics are kept for twenty-five months, then deleted automatically. Monitoring service data — heartbeats, proof log events, account data — is kept for the duration of the contract and deleted when the account is closed, unless the law requires us to keep it.
Your rights
The data controller is neverseen-ai, a company in the process of incorporation. You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw your consent: write to privacy@neverseen.info, and we reply within the one-month period set by the GDPR. You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
Our commitments
Neverseen complies with the GDPR and with the CNIL’s recommendations. For the points this page does not yet cover — processors, security measures, record of processing activities — we apply its reference guidelines and will publish them here as they are formalised.
Contact
privacy@neverseen.info