Privacy Policy

Introduction

ObraVera is a registry: we collect the minimum information needed to run it and to establish who registered what and when. We do not run advertising, we do not sell or share your data with advertisers, and we do not track you across other sites. This policy explains what we collect, why, and what rights you have over it.

Who Is Responsible for Your Data

ObraVera is run by Brady Ridgway, an individual entrepreneur (entrepreneur individuel, micro-entreprise) registered in France, who is the data controller for the personal data described in this policy. For anything about your personal data, email privacy@obravera.com. Our registered details are in the legal notice.

Information We Collect

Personal Information

When you create an account on ObraVera, we collect:

• Username and email address
• Display name and optional creative discipline
• Organisation affiliation and verification details, where established by an operator or approved provider

Automatically Collected Information

• The IP address recorded against each work you register, so the record has a verifiable point of origin
• Session and CSRF cookies needed to keep you signed in and to protect forms from cross-site attacks (see Cookies, below)

We do not use third-party analytics or advertising trackers. The scripts, stylesheets and fonts our pages use are served from ObraVera's own servers, not from public content-delivery networks, so loading a page does not send a request to anyone else.

Work Content

• Your work's content. ObraVera does not retain the full text of a registered work. Registration stores only derived values — the ISCC content code and similarity fingerprints — never the source text itself.
• During registration. Your uploaded file is held only for the duration of processing. It is deleted at the end of processing on every path, including failures; it is never written to our database, and because it is never stored, it never enters our backups. What registration stores are derived values only: a cryptographic hash of the canonicalised work, the ISCC content code, and similarity fingerprints. These are one-way values used for matching; they are not the work.

How We Use Your Information

We use the information we collect to:

• Provide and operate the registry — creating registrations, generating receipts, and showing you your own records
• Verify accreditation claims — confirming organisation membership or identity-provider attestations before applying Verified status
• Communicate with you about your account by email — verification, password resets, and service notices
• Protect the security of the service and its accounts

Information Sharing

ObraVera does not currently operate a public creator directory. The lists below describe what appears where, and to whom, within the service.

Shown on your registration receipts (visible to you as the record's owner, and to ObraVera staff):

• Display name
• Discipline (if provided)
• Verification status

Never shown to any other user or made public:

• Email address
• Username
• IP addresses

Invitations

ObraVera occasionally invites specific individuals to join by way of a personal, single-use activation link. An unclaimed invitation stores only the minimum needed to address it: the invitee's name, email address, an optional personal note from the sender, and the link's validity metadata.

• No account before acceptance. Nothing is created on an invitee's behalf. An account, and any data associated with it, comes into existence only when the invitee explicitly accepts the invitation.
• Retention. Invitation links expire automatically. The personal data held in expired or revoked invitations is purged and is not retained for any other purpose.
• Sample records. Accounts created by invitation are seeded with a small number of clearly-labelled demonstration records using ObraVera-authored texts. These are excluded from all public registry counts and can be permanently deleted by the account holder at any time.

Organisation Affiliation Claims

Account holders may claim membership of a professional organisation to seek Verified accreditation. A claim — including any membership identifier or supporting evidence you supply — is personal data and is handled as follows:

• Minimum collection. We store only the organisation you selected, the membership identifier and/or evidence you chose to supply, and the claim's status and decision record.
• Never public. Membership identifiers and evidence are visible only to ObraVera staff for the purpose of confirming the claim. They are never displayed publicly or to other users. What may appear publicly on confirmation is the accreditation itself (e.g. “Verified member — [Organisation]”), never the underlying membership details.
• Confirmation contact. Confirming a claim may involve checking with the named organisation through its stated confirmation mechanism. We share no more than is needed to confirm membership.
• Deletion. You may withdraw a pending claim yourself at any time from your affiliation settings, which deletes it immediately. All claim data is deleted with your account, and you can ask us to delete decided (confirmed or rejected) claim records at any time by emailing privacy@obravera.com.

Data Security

In production, ObraVera is served over HTTPS only. Passwords are never stored in plain text: they are hashed using Django's PBKDF2 algorithm. You can add an optional second factor (TOTP authenticator app, with backup recovery codes) to your account for extra protection. Administrative access is restricted to staff accounts and is routed exclusively through the same sign-in flow as everyone else — including its multi-factor authentication — never a separate, unprotected admin login form.

Retention and Backups

Records deleted from live systems are removed at the time of deletion. Our encrypted, off-site backups rotate on a fixed schedule — the most recent 14 daily backups, plus one backup per month for 6 months — so a deleted record's derived values (never your work's text, which is never stored) age out of our backups within that window.

Our server logs record each request made to ObraVera: your IP address, the time, the page requested and your browser's identifying string. We keep them for 14 days to detect and investigate abuse and security incidents, then they are deleted automatically. Personal links, such as invitation, email-confirmation and password-reset links, are removed from these logs before they are written.

Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data (most of it directly, from your profile)
• Delete your account and the data associated with it
• Restrict how we process your data, for example while a concern you have raised is being looked into
• Object to how your data is processed
• Receive the data you gave us in a structured, machine-readable format, and have it sent to another service (data portability)
• Withdraw your consent at any time, where we rely on it; this does not affect anything done before you withdrew it

You can exercise most of these yourself: a pending organisation affiliation claim can be withdrawn (deleted) at any time from your affiliation settings, and sample records seeded on account activation can be deleted at any time from your registrations list. For anything else — including account deletion or a request about decided claim records — email privacy@obravera.com.

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a data protection supervisory authority. Ours is the CNIL (Commission nationale de l'informatique et des libertés), the French authority: www.cnil.fr. You can also complain to the authority in the EU country where you live or work. We would be glad to hear from you first, at privacy@obravera.com, and to try to put things right.

Cookies

ObraVera uses two cookies, both strictly necessary for the service to function:

• sessionid — keeps you signed in between requests
• csrftoken — protects forms against cross-site request forgery

We do not set advertising or analytics cookies.

Changes to This Policy

If we make a material change to this policy, we will update the "Last updated" date at the top of this page and announce the change here.

Contact Us

For questions about this Privacy Policy or your personal data, email privacy@obravera.com. For anything else, see our contact page.