Privacy

Artifact Core is a versioned deliverable registry run by mmcco (Marie-Thérèse Côté). Unlike a stateless tool, it durably stores the registry metadata you provide so it can resolve the current / latest-good version later. This policy describes that handling in the spirit of Quebec's Law 25 and of the GDPR. Updated: 13 October 2026.

1. Controller and contact

Controller: mmcco (Marie-Thérèse Côté). Questions or requests about your data: infodev@mmcco.co.

2. Data collected

The connector stores only the registry metadata you send on write calls:

• artifact identifiers, version labels, type, project_id, created_by and source_run as you provide them;
• SHA-256 hashes and content size, quality state, supersession links;
• locations (URIs/paths) you declare, and existence attestations (who verified, and when);
• free-text note fields and a self-hashed audit log of these events.

The content you may pass to compute a hash is not retained: only its SHA-256 hash and size are kept. The connector does not read the content of your remote files and makes no outbound fetch to the locations you declare.

⚠️ These are free-text technical fields: do not put personal data or secrets in identifiers, notes, created_by or locations. If you write personal data there, it becomes part of the stored record.

3. Purposes of use

The metadata is used solely to operate the registry: register immutable versions, designate the explicit CURRENT, run existence checks, resolve the current / latest-good deliverable, compare versions, and keep a tamper-evident audit. No profiling, no advertising, no model training.

4. Storage, location and retention

Records are stored in a private Vercel Blob store (not publicly listable). Entries for versions, state events and audit are write-once / append-only and immutable, so the registry keeps its history: there is no automatic expiry — metadata is retained for the life of the registry or until deletion is requested. withdraw_version marks a version withdrawn (a terminal, audited lifecycle change — there is no un-withdraw) but, by design, does not erase the immutable record or the audit trail.

5. Recipients and third parties

Your data is neither sold, exchanged, nor used to train models. Only the following are involved, on a strictly technical level:

• Vercel — infrastructure host and the private Blob store (data processor); it may keep standard HTTP technical logs (IP, timestamp), under its own policy;
• the AI host (ChatGPT or Claude) you go through, which relays the call under its own policy.

6. Your rights and controls (Law 25 / GDPR spirit)

You may withdraw a version yourself (withdraw_version). For access, rectification, erasure, portability or permanent deletion of a stored record or its audit entries — which the normal immutable lifecycle does not perform — contact infodev@mmcco.co and we will act on it.

7. Security

Traffic is over HTTPS and the store is private. The MCP endpoint (/mcp and /api/mcp) is public and unauthenticated: do not send secrets or personal data in free-text fields. The audit is tamper-evident (it detects naive editing) — not "tamper-proof" without a server-keyed HMAC.

8. Children

The service is a developer/operations tool and is not intended for anyone under 13.

9. Changes

This policy may change; the version in force is the one published here, with the update date above.

10. Complaint

If you believe your rights are not respected, you may contact the Commission d'accès à l'information du Québec (CAI).

Résumé (FR) : registre de livrables versionnés exploité par mmcco. Il conserve durablement, dans un magasin Vercel Blob privé, les métadonnées que vous fournissez (identifiants, libellés, empreintes SHA-256 et taille, provenance, emplacements déclarés, attestations, notes, journal d'audit) ; le contenu transmis pour le hachage n'est pas retenu. Entrées immuables (write-once), aucune expiration automatique. Aucun partage, aucune vente, aucun entraînement de modèle. Droits et suppression (Loi 25 / RGPD) : infodev@mmcco.co. N'inscrivez ni données personnelles ni secrets dans les champs libres.

Questions: infodev@mmcco.co