Privacy policy

The data controller is CRAFT, reachable at contact@craftsec.eu.

To exercise your rights or ask a question relating to data, use the same address.

CRAFT collects only what is necessary for the operation of the prototype:

SBOM

The uploaded file (components, versions, PURLs). Processed in memory for the duration of the analysis, then discarded. It is not stored in a database. Details appear on the “What happens to your SBOM” page.

File name

Used to display the result. It is normalised before display.

Public PURLs

Package identifiers from public ecosystems (npm, PyPI, Maven, etc.) are sent to api.osv.dev. Internal or private PURLs are not transmitted.

IP address

Used to limit the number of analysis requests (approximately one minute, in memory). Umami may also use it to estimate a country, without advertising.

Audience

Page views and product events (visit, upload, result, contact, campaigns) via self-hosted Umami: URL, referrer, browser, system, device, language, screen, and technical properties (CTA location, SBOM format, presence of vulnerabilities). An anonymous identifier (UUID) is stored in the browser (localStorage) to recognise a return visit, without email or name. No SBOM content.

Session

A session recorder (Umami Recorder) captures the course of the visit in the interface, in order to understand friction. Recordings remain on the self-hosted instance.

Contact form

Email, company, message, and the associated consent. Processed to reply to you. No other use of the address without explicit agreement.

Diagnostic

Company name and questionnaire answers. Used for the time needed to generate the PDF, then discarded. They are not stored in a CRAFT database.

Correspondence

If you write to us, we process the information you send us in order to reply.

An SBOM may contain personal data (authors, emails, suppliers). Upload only what is necessary for the analysis.

• Perform the requested analysis: pre-contractual measures / legitimate interest in providing the service you trigger.
• Secure the service (rate limiting, origin control): legitimate interest.
• Measure the prototype’s audience (self-hosted Umami, including session recording, without advertising or resale): legitimate interest.
• Reply to your messages: legitimate interest, consent for use of the address, and where applicable pre-contractual measures.
• Produce the diagnostic report: pre-contractual measures, at your request.

CRAFT does not use your data for advertising purposes.

The data is accessible:

• to the publisher, to operate and improve the prototype;
• to Vercel Inc., host of the website, for infrastructure and technical logs;
• to the self-hosted Umami instance (metrics.dps-solution.com), for audience measurement and session recording. Statistics are not sent to a third-party commercial analytics service;
• to Google (OSV project, osv.dev), solely for public-ecosystem PURLs necessary for vulnerability correlation;
• to Resend, for sending confirmation and notification emails when you use the contact form.

The data is neither sold nor transferred to marketing partners.

Hosting of the website by Vercel Inc. (United States) may involve a transfer of technical logs outside the European Union. Vercel’s privacy policy applies to that processing.

Requests to api.osv.dev may involve processing by Google, which may take place outside the European Union. Only public package identifiers are transmitted, not the complete SBOM file.

Umami is self-hosted by CRAFT. Audience data therefore does not use a US analytics cloud.

• SBOM: duration of the request on the server. The file is not persisted.
• Analysis result: retained in your browser (session) until the tab is closed. The result URL is not indexed.
• IP address (rate limiting): approximately one minute, in memory only.
• Umami statistics and recordings: retained on the self-hosted instance for the time needed to track the prototype’s audience.
• Contact messages: the time needed to reply to you, then deletion or limited archiving if a legal obligation so requires. Sending logs are retained by Resend according to its policy.
• Diagnostic: company name and answers, duration of the request. The PDF is generated then transmitted; CRAFT does not retain it.

The website does not use advertising cookies or social-network trackers. No consent banner is displayed for these uses, because they do not exist here.

Audience measurement is performed with Umami, self-hosted on metrics.dps-solution.com: a traffic script and a session recorder. They are not intended to profile visitors for commercial purposes. Umami does not install an advertising cookie. To avoid counting the same browser as a new visitor on every visit, an anonymous technical identifier (UUID) is stored in the browser’s local storage and associated with the statistics. It contains no name, email or IP address. It disappears if you clear the site’s data, and is not set in private browsing when storage is unavailable.

The recorder may replay the path through the interface, including the results screen. Do not display secrets there. If Umami is not configured, only technical event names may be logged on the CRAFT server, without an advertising identifier.

Analysis is performed without creating an account. The file is not persisted. PURLs of internal or private hosts are not sent to OSV. Size, rate and request-origin limits reduce abuse.

No measure is infallible. Avoid uploading secrets, credentials or unnecessary personal data.

To report a vulnerability in CRAFT, see the coordinated disclosure policy.

Pursuant to the GDPR and the French Data Protection Act (loi Informatique et Libertés), you may request access, rectification, erasure, restriction or objection to processing, as well as portability of the data we hold, under the conditions provided by law.

Send your request to contact@craftsec.eu. We will reply within the statutory time limits.

You may also lodge a complaint with the CNIL (Commission nationale de l’informatique et des libertés), cnil.fr.

In practice, as the SBOM is not retained after analysis, a request to erase that file generally has no object once the request has completed.

This policy may be updated to reflect changes to the prototype or to the law. The date of last update appears at the top of the page.