Privacy
Data controller: Daniel Dan – helloihaveaquestion@laposte.net. Sceau is independent software; this page says what data this site processes, why and for how long.
Seal pages
A seal page (/V/…) shows what the person who signed with the Sceau app chose to publish: the name they declare, the mention, the type of reservation, the signing date and, where applicable, the demonstration flag. Any user of the app can publish, without an account: this site does not verify that information. It is encrypted on the server with a key specific to the seal; alongside it, the server keeps only a fingerprint of the withdrawal code (never the code itself). It is kept until the chosen expiry (1 month to 10 years), then erased automatically, or as soon as the signer withdraws the seal. Legal basis: the signer's consent, which they withdraw at any time from the app. If your name was published by someone else, use « Report this page »: the page is erased after review. The page can only be read with the access key contained in the QR code and printed on the seal: the server does not keep it: it uses it only at the moment someone opens the page with it, then forgets it. A copy of the database, even with the server's keys, therefore does not allow the pages to be read.
PDFs uploaded for checking
A PDF uploaded to « Verify a signed PDF » is processed in memory for the duration of the check, then erased: it is never stored or logged, and the result is shown only to the person who uploaded the file. The check calls no external service.
IP addresses
To limit abuse (thousands of PDF uploads or publications, identifiers tried in bulk), the server counts requests per IP address. This counter lives only in memory, for at most one hour, then disappears: it is never written to disk. There is no access log; the HTTPS front end keeps only its technical error messages, from which the IP address and the page address are removed. Legal basis: the legitimate interest of protecting the security and availability of the service.
Hosting, cookies and third parties
The site is hosted by Oracle Cloud Infrastructure, in the Frankfurt region (European Union), under Oracle's data processing agreement. Oracle is an American company: its subsidiaries may be subject to requests from US authorities; any transfer is covered by the European Commission's standard contractual clauses included in that agreement. The domain name is provided by DuckDNS, which only sees name lookups, not the pages visited. HTTPS certificates are issued by Let's Encrypt, to which no visitor data is passed. No cookies, no audience measurement, no third-party service is loaded in the pages.
Reports and messages
If you report a page or write to the contact address, your email (your name, your address, the reason and your explanation, sometimes another person's name) arrives in the publisher's mailbox. It is used only to handle your request: review, reasoned reply, possible removal of the page. Legal basis: the legitimate interest of enforcing the terms of use, and your rights if the request concerns you. It is kept for 12 months after the case is closed, then deleted. No copy is made on the site.
Your rights
You can ask for access to your data, its rectification or erasure, or object to its processing, by writing to helloihaveaquestion@laposte.net.
Complaints
You can lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be).