Article 13 information at collection
Controller and operator: CommonShare for processing whose purposes and means CommonShare determines on this website. If your organization decides why and how customer-workspace data is processed, controller and processor roles may instead be governed by its agreement with CommonShare. Current operator contact routes are published on the CommonShare About page ; label privacy requests “Environmental Cost site privacy.”
Purposes and legal bases: provide the feature you request and take steps connected with your service access; preserve your selected language and device-local workflow; protect, troubleshoot and improve reliable operation. Depending on the context, the bases are performance of a contract or steps requested before a contract, and CommonShare’s legitimate interests in secure and reliable service delivery. Consent is used only where expressly requested.
Recipients and transfers: authorized CommonShare personnel, hosting and security providers, and—only when you request document extraction—the configured OpenAI API service. Providers may process data outside your country. Applicable customer terms and provider arrangements govern transfer mechanisms and safeguards; request the relevant documentation through your CommonShare contact.
Retention and rights: periods are described below. Subject to applicable law, you may request access, correction, deletion, restriction, objection and portability, and may withdraw consent where consent is the basis. You may lodge a complaint with your local supervisory authority; in France, this is the CNIL. Providing a document is optional, but extraction cannot run without it.
Automated decision-making: extraction proposes editable candidate fields. It does not make a solely automated decision with legal or similarly significant effects. A person must review the source evidence and confirm required fields before calculation.
The transparency topics in this notice follow Article 13 of the GDPR .
Data this site handles
- A language-preference cookie.
- Product inputs, evidence labels, calculations and workflow records that the current application stores in your browser’s local storage.
- Files and file contents you intentionally submit for document analysis, plus extracted candidate fields and source excerpts.
- Technical request, security and error data that hosting or service providers may process to operate and protect the service.
How data is used
Data is used to remember your language, run calculations, maintain your device-local workspace, extract candidate product fields at your request, diagnose failures and secure the service. This site does not use uploaded documents to certify products or make official declarations.
Service providers and disclosure
Document extraction uses the configured OpenAI API. The application creates a temporary API file, uses it for extraction and requests its deletion in a cleanup step. Infrastructure providers may handle network and security logs. CommonShare may disclose information when required by law or necessary to protect rights and system security.
Retention
- The language cookie is configured for one year.
- Workspace records remain in local browser storage until you clear them or site data.
- The application requests deletion of the temporary OpenAI API file after processing, including after most processing errors. Provider logs and backups may follow the provider terms and applicable customer agreement.
- Security and operational records are kept only as long as reasonably necessary for their stated purpose and applicable obligations.
Your choices and rights
You can avoid document processing by not uploading, clear local workspace data through browser controls, and change the language preference from the header. To exercise a legal data right, use CommonShare’s published corporate contact route, identify this site and describe the relevant data. CommonShare may need information to verify your identity and locate the data.
Security and data minimization
No service is risk-free. Use organization-approved files and credentials, minimize personal data, and do not treat browser-local storage as a system of record. Export needed records before clearing browser data and follow your organization’s retention and access policies.