Privacy Notice
This notice describes how VACRA.AI handles personal data in connection with the vacra.ai website and any future attestation service (none is operational today). Read it before submitting an inquiry.
1. Data controller
The data controller for personal data processed through the vacra.ai website and email correspondence is:
VACRA.AI is operated by a company incorporated in the British Virgin Islands, which is the controller. E Chan is its director. Please do not send confidential or client information in a first email. This notice will be updated if the operator's legal form changes, to reflect the registered entity name and any appointed Data Protection Officer.
2. Scope of this notice
This notice covers:
- The vacra.ai website, including the home page and the crs, research, about and privacy pages
- Inquiries submitted via the
contact@vacra.aiemail address - Not applicable today: no attestation service is operational (see Section 5)
This notice does not cover third-party websites linked from this site, including SSRN (ssrn.com) or external standards bodies. Those services operate under their own privacy terms.
3. What we collect
3a. Inquiry correspondence
All contact points on this site use mailto: links. When you click a contact
link, your own email client opens. Any email you choose to send is delivered to contact@vacra.ai through the email-forwarding service described in section 6. The personal data we receive is limited to whatever
you include in that email: typically your name, email address, organization, and the
substance of your inquiry. Apart from the server access logs described in 3b, we do not collect data from you unless you initiate contact. We use your email address only to reply to you. We keep no mailing list and send no unrequested messages.
3b. Server access logs
Our web server (Nginx on a virtual private server provided by Hetzner) automatically records a standard access log entry for each page request. Each entry contains:
- Your IP address (or the IP of your proxy/CDN exit node)
- Date and time of the request
- The page or resource requested
- HTTP status code and bytes transferred
- Referrer URL (if your browser sends one)
- Browser user-agent string
These logs are used for security monitoring, diagnosing technical errors, and understanding aggregate traffic. They are not linked to individual identities unless an IP address is investigated as part of a security incident.
3c. Fonts
The typefaces used on this website are served from this site. Your browser does not request fonts, styling or scripts from any third party.
We do not run any analytics, advertising, or behavioural tracking scripts on this site. No Google Analytics, no social media pixels, no session recording tools.
Personal data collected through this website is not currently used to train, fine-tune, or evaluate any AI or machine learning model, including our own.
4. Why we collect it and our legal basis
| Data | Purpose | Basis (GDPR Art. 6); PDPO DPP1 note |
|---|---|---|
| Inquiry emails | Responding to your inquiry | Voluntary provision (PDPO DPP1); performance of a contract or steps prior to entering into a contract at the data subject's request (GDPR Art. 6(1)(b)); or our legitimate interest in responding to business inquiries where no contract is contemplated (GDPR Art. 6(1)(f)) |
| Server access logs | Security monitoring; technical diagnosis; aggregate traffic analysis | Legitimate interests: operating and securing the service (GDPR Art. 6(1)(f)); routine operational collection (PDPO DPP1) |
Where we rely on legitimate interests, the operator has considered whether those interests are overridden by your data protection rights and concluded that they are not: the data collected is minimal, the purposes are directly connected to responding to inquiries from institutional and regulatory audiences, and no high-risk profiling or automated decision-making is involved.
5. Attestation service data (not operational)
No attestation service is operational, and this website does not collect attestation data. If a service is ever established, this notice will be updated in full before it accepts any data.
6. Data sharing
We do not sell, rent, or share personal data with third parties for marketing, advertising, or profiling purposes.
Data may be shared in the following limited circumstances:
- Infrastructure providers. Our VPS provider (Hetzner Online GmbH) hosts the server and its access logs.
- Email forwarding. Mail sent to contact@vacra.ai is received through an email-forwarding service (Cloudflare Email Routing).
- Legal obligation. We may disclose personal data where required by a valid legal process, court order, or regulatory request under applicable law with lawful authority.
- Succession. If the operator transfers VACRA.AI to another person or entity, personal data held at that point may transfer to the successor, subject to the same protections as this notice provides.
No personal data is transferred to research partners, standards bodies, or regulators in connection with our work on the CRS standard.
7. International transfers
Our server infrastructure is provided by Hetzner Online GmbH.
For users in the European Economic Area or the United Kingdom, the following applies:
- If you email us from the EEA or the UK, you send your data to the operator through the email-forwarding service described in section 6. We process it on the basis of our legitimate interests in responding to your inquiry. Email is routed through an email-forwarding service and may be processed outside your country.
For PDPO purposes (Hong Kong): personal data from Hong Kong residents is processed on our hosting provider's server. We have not assessed whether the server location is recognised as providing comparable data protection standards.
8. Retention
| Data | Retention period |
|---|---|
| Inquiry emails | Duration of any resulting engagement plus 24 months, or 24 months from last contact if no engagement results |
| Server access logs | Intended to be kept for 90 days, then deleted |
We may retain data for longer where required by applicable law or where needed to establish, exercise, or defend legal claims.
9. Your data protection rights
Hong Kong (PDPO)
Under the Personal Data (Privacy) Ordinance (Cap. 486), you have the right to:
- Request access to personal data we hold about you (Data Access Request)
- Request correction of personal data that is inaccurate (Data Correction Request)
Requests under the PDPO should be submitted in writing to contact@vacra.ai. We will respond to requests under the Ordinance within the time limit that it sets.
EU/EEA and UK (GDPR / UK GDPR)
If you are located in the EU, EEA, or the UK, you have the following rights under the General Data Protection Regulation (and the UK equivalent):
- Access. Request a copy of the personal data we hold about you.
- Rectification. Request correction of inaccurate or incomplete data.
- Erasure. Request deletion of your personal data where our basis for processing no longer applies.
- Restriction. Request that we restrict processing while a dispute is resolved.
- Data portability. Receive a copy of data you provided to us in a structured, machine-readable format, where our processing is based on consent or contract.
- Objection. Object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.
To exercise any of these rights, contact contact@vacra.ai. We will respond within one calendar month. If you are dissatisfied with our response, you have the right to lodge a complaint with your local supervisory authority: the relevant EU member state data protection authority, or the UK Information Commissioner's Office (ico.org.uk) for UK residents.
Note: most of the data we hold is server log data (no identifying information beyond IP address) or professional correspondence initiated by you. We do not maintain consumer profiles or run automated decision-making.
10. Cookies and browser storage
This website does not set any first-party cookies. We do not use session cookies, authentication cookies, analytics cookies, or advertising cookies. We do not use browser localStorage or sessionStorage for personal data.
Because we set no first-party cookies and run no tracking, we do not display a cookie consent banner. If this changes with the launch of any future service, this section will be updated before any cookies are set.
11. Children
This website is directed exclusively at institutional and professional users: AI operators, financial institutions, regulators, and standards bodies. We do not knowingly collect personal data from individuals under 18 years of age. If you believe a minor has submitted personal data to us, contact contact@vacra.ai and we will delete it promptly.
12. Changes to this notice
We will update this notice when our data practices change, if any service is introduced, or when the operator's legal form changes. The date at the top of this page reflects the most recent revision. Material changes will be shown on this page with a new date.
For regulatory bodies and standards organizations: the current version of this notice is always available at vacra.ai/privacy.
13. Contact and complaints
For any question about this notice, a data access or correction request, or to exercise any GDPR right:
We aim to resolve all privacy inquiries within the statutory deadlines noted in Section 9. If you are not satisfied with our response, the relevant supervisory authority for Hong Kong residents is the Office of the Privacy Commissioner for Personal Data (pcpd.org.hk).