Privacy policy

Who is responsible

Erenials is operated by Cyberesia SA, Rue de la Corraterie 5, 1204 Geneva, Switzerland. Cyberesia SA is the controller of the personal data described here under the Swiss Federal Act on Data Protection (nLPD/FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

For any question about your data, write to privacy contact email, to be completed.

Pilot requests

When you send the pilot request form, we store your email address, your organization, the sector and the language you choose, your message (optional) and the time of the request in our database (Neon Postgres).

We use these details only to answer your request and to discuss a possible pilot. We send no newsletters, and we do not sell or rent these details.

Legal basis under the GDPR: steps taken at your request before a possible contract, and our legitimate interest in answering business enquiries (Art. 6(1)(b) and (f)).

Accounts and sign-in

Accounts run on Better Auth, an open-source library that we host ourselves: account data is kept in our own database (Neon Postgres), not by a third-party login service. Depending on how you sign in, we store:

• Email link: your email address and whether it has been confirmed. A sign-in link works once and expires after 15 minutes; a link that confirms a newly added email expires after one hour.
• Passkey: the passkey's public key and identifier, its name if you give one, and technical details such as its creation date. Your fingerprint, face or device PIN never leave your device; we never receive them. The passkey's public key also determines your Erenials address, a smart account address on Base Sepolia that is calculated, not published, until it is first used.
• Wallet: your wallet's public address and the network it signed in on.
• Sessions: signing in opens a session for 30 days, renewed when you use it. It is stored with the IP address and browser identification (user agent) of the sign-in request, and a session cookie is set in your browser.
• Security: to slow down abuse, the sign-in service records the IP address of each request and counts requests per sign-in action.

An account without an email address gets a technical placeholder address, which is never used to write to anyone.

Legal basis under the GDPR: providing the account you asked for (Art. 6(1)(b)) and keeping it secure (Art. 6(1)(f)).

Emails

Sign-in and confirmation emails are sent through Resend (Resend, Inc., United States), which receives your email address and the content of the email in order to deliver it. The site sends no other emails.

Certified files and certificates

When you certify a file, your browser reads it and computes its SHA-256 fingerprint on your device. The file itself never leaves your device: we receive only its fingerprint, its size and its type.

We store the certificate record in our database: the description you enter (title, issuer, type, the fields and their values, the named parties and which party may see which fields), the file's fingerprint, size and type, the validity you chose, the issue time, the network (simulation or Base Sepolia) and, for anchored certificates, the transaction reference. A random secret (salt) that protects the record's fingerprint stays on our server. If you are signed in, the certificate is linked to your account; revoking it records the time of revocation.

Anyone who has a certificate's link or identifier can open its public page, which shows the fields you assigned to the public, the file's fingerprint and the certificate's status. Fields reserved for named parties are only shown through an access pass. Do not enter other people's personal data unless you are entitled to.

A copy of the certificates you issue is also kept in your browser's local storage, so that you can find them again and import them into an account.

To prevent abuse, the certification service counts requests per IP address. The address is stored only as a hash, and the counters are deleted after about two days.

Access passes and access logs

An access pass opens one named party's view of a certificate. We store the party, a hash of the pass link (the link itself is shown to you only once), the expiry, the time of revocation and, if you enter one, the recipient's blockchain address.

Each time a pass is opened, we record the time and a coarse browser label such as "Firefox · Windows". We do not record the IP address. These access logs are shown only to the certificate's issuer, in My assets.

Legal basis under the GDPR: providing the service you use (Art. 6(1)(b)); for the people who open a pass, the issuer's and our legitimate interest in an audit trail (Art. 6(1)(f)).

Data on the blockchain

Certificates can be anchored as attestations of the Ethereum Attestation Service (EAS) on Base Sepolia, a public test network. Simulated certificates are not written anywhere.

An anchored certificate puts on the chain only the record's fingerprint (computed with the secret salt, so the content cannot be guessed from it), the file's SHA-256 fingerprint, the asset type and the issue time, signed by our issuer wallet. Titles, fields, parties and files are never written to the chain.

When a pass is addressed to a recipient and its certificate is anchored, the pass is attested too: that attestation holds a hash of the pass identifier, the time and the recipient's address.

Blockchain entries are public, copied by every node of the network, and cannot be changed or deleted, by us or by anyone else. Revoking a certificate or a pass marks its attestation as revoked; it does not erase it. Do not enter a recipient address that you do not want to appear on a public network.

To read and write these entries, our server uses a Base Sepolia node (by default the public node of the Base network). Your IP address is not sent to it.

Cookies and local storage

We use no advertising or analytics cookies and no tracking tools. The site uses only:

• a session cookie (named with the prefix "erenials"), set only when you sign in, to keep you signed in; scripts cannot read it;
• a language cookie (NEXT_LOCALE), set when you choose a language, kept for one year;
• entries in your browser's local storage for the theme, the console's demonstration state, the certificates you issued and the pass links you created. They stay in your browser unless you import your certificates into an account, and you can delete them in your browser settings.

Fonts are served from our own site: no request is made to Google or to another font service.

Hosting and service providers

The following providers process data on our behalf and on our instructions:

• Vercel Inc. (United States): hosting of the site and its server functions. Vercel processes the technical data of every request (such as IP address, browser and page requested) to deliver the site, and keeps short-lived logs.
• Neon (United States): the Postgres database that holds the data described above, hosted in the database region, to be completed region.
• Resend, Inc. (United States): sending sign-in and confirmation emails.

These providers are based in the United States or may process data there. Transfers rely on the providers' certification under the Swiss-U.S. and EU-U.S. Data Privacy Framework and/or standard contractual clauses, to be confirmed.

We do not sell personal data, and we do not pass it on to other third parties unless the law requires it.

How long we keep data

• Pilot requests: until the request has been handled and for at most 24 months afterwards, unless a business relationship follows; to be confirmed.
• Accounts, certificates, access passes and access logs: as long as the account exists. When you ask us to delete your account, we delete it with its passkeys, wallets, sessions, certificates, passes and logs within 30 days; to be confirmed, except what the law requires us to keep.
• Sessions expire after 30 days without use, sign-in links after 15 minutes. The certification service's counters are deleted after about two days.
• Data written to a blockchain cannot be deleted (see above).

Your rights

Under the nLPD/FADP, you can ask us what data we hold about you, have it corrected or deleted, object to its processing and receive it in a common electronic format. Where the GDPR applies, you also have the rights of access, rectification, erasure, restriction, portability and objection, and you can withdraw a consent at any time with effect for the future.

Write to privacy contact email, to be completed. We may ask you to prove your identity, for example by writing from your account's email address. We answer within 30 days.

You can revoke your certificates and passes yourself in My assets. Deleting an account or a passkey is currently done on request.

You can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) or, in the European Union, with the data protection authority of your country of residence.

Security

Connections are encrypted (HTTPS). Sign-in links and pass links are stored only as hashes, the session cookie is protected from scripts, and access to the database is restricted. No system is entirely secure: if a breach puts your data at high risk, we will inform you and the authorities as the law requires.

Other points

Erenials is a service for organizations; it is not intended for children. We make no automated decisions with legal effect and do no profiling.

We will update this policy when the service changes; the date at the top of the page shows the version in force.