Privacy

Last updated 7 October 2026

This notice explains what information LayerCert handles when you check an artwork, get a certificate or verify one, why we handle it, how long we keep it, and what your rights are.

In short

• We don't keep your artwork or your project file. They are deleted when the check ends.
• We don't store your name. We keep a scrambled fingerprint of it that can't be read.
• We don't ask you to create an account, and we don't use cookies or tracking.
• We keep a record of each certificate so that it can be verified and can't be issued twice.
• You can ask us to delete your certificate at any time.

Who we are

LayerCert is run by a business based in the United Kingdom. We are the controller of the personal information described in this notice, which means we decide how and why it is used. Contact us at [email protected] about anything in this notice, or to use any of your rights.

What we handle, why, and for how long

Your artwork and project file

Before anything is uploaded, your browser checks that the files are the right type and size. When you check them, they are uploaded to private storage that only our checking service can read. We read details the art app saved inside the project file (layers, recorded drawing time, brush strokes, time-lapse recording and save history), look in the finished image for marks left by AI image generators and for a Content Credential, and compare any earlier versions you add with the finished image.

Kept for: the length of the check, usually under a minute. The files are then deleted. A file left behind by an interrupted check is deleted automatically within one day.
Why we may use it: to carry out the check you asked for.

The record of a check

The names and sizes of your files, a SHA-256 fingerprint of each (which identifies a file without revealing its contents), and the result and score.

Kept for: 24 hours if you don't go on to get a certificate, so that a certificate can be issued for exactly the files that were checked.
Why we may use it: to provide the service you asked for.

Your certificate, on our register

What is printed on your certificate apart from your name: the file names and fingerprints, the image dimensions, the score, the date and our signature. With it we keep a fingerprint of how the artwork looks, and our own fuller record of how the check went.

Kept for: until you ask us to remove it. The register is what lets anyone confirm your certificate is genuine and stops the same artwork being certified to someone else, so entries are not deleted on a timer.
Why we may use it: to provide the service, and our legitimate interest in running a register that people can rely on.

A fingerprint of your name

Your name is printed on the certificate you download, but we don't store it. We keep a scrambled fingerprint of it, made with a secret key, that can't be turned back into your name. It lets us tell whether two certificates were issued to the same name, and confirm a name that someone types in when they verify your certificate.

Kept for: as long as the certificate it belongs to.
Why we may use it: to provide the service, and our legitimate interest in preventing a certificate being passed off under someone else's name.

A log of requests for a certificate

When each request was made, the file names and fingerprints, and whether a certificate was issued or refused. It holds no names.

Kept for: until you ask us to remove it.
Why we may use it: our legitimate interest in putting things right if a certificate doesn't reach you, and in detecting misuse.

Technical logs

The IP address, time and address of each request to our service, recorded automatically by our hosting providers.

Kept for: up to 30 days.
Why we may use it: our legitimate interest in keeping the service secure and working, including limiting how many checks one visitor can run in an hour.

Messages you send us

If you email us, we keep your message and email address for as long as needed to deal with it and for a reasonable period afterwards.

You don't have to give us anything

Using LayerCert is your choice. A check can't be run without the two files, and a certificate can't be issued without a name to print on it and your declaration that the work is yours.

Scoring is automatic

The check and the score are produced by software, without a person looking at your files. The result decides whether a certificate can be issued. If you think a result is wrong, email [email protected] with your certificate number or the names of your files and tell us why, and a person will look at it.

Who can see your certificate

Anyone you share your certificate with can see everything on it, including your name. Anyone with its certificate number, ID or QR code can look it up on our verification page, which shows its details without your name and without the picture of your artwork. They can type in the name printed on the certificate and we will confirm whether it matches. The picture on your certificate is added in your own browser and is never sent to or stored by us as part of the certificate.

Who handles information for us

• Google Cloud runs the checks and holds the register, the request log and the temporary file storage, in Belgium.
• Vercel hosts this website and may process technical logs on servers outside the UK, including in the United States.

They act only on our instructions, under contracts that require them to protect your information, and may not use it for their own purposes. We don't sell your information or share it with anyone else, unless the law requires us to.

Information handled outside the UK

Where your information is handled outside the UK, it is protected either because the UK government has decided that the country provides adequate protection, as it has for the European Union, or by contract terms approved for that purpose under UK data protection law.

How we protect it

• Files and records travel over encrypted connections and are encrypted where they are stored.
• Uploaded files go to private storage that the public cannot read.
• The register is backed up, and protected against accidental deletion.
• The key that signs certificates and scrambles names is held in a secrets store that no person reads.

No system is perfectly secure. If a breach of your information is likely to put you at risk, we will tell you and the Information Commissioner's Office as the law requires.

Backups

The register is backed up so that it can be restored after a fault. When we delete an entry it disappears from the live register straight away, but may remain in backups for up to 14 weeks before those are overwritten.

Cookies and tracking

LayerCert doesn't set cookies, doesn't use analytics or advertising trackers, and doesn't use your artwork to train AI models.

Your rights

Under UK data protection law you have the right to:

• be told how your information is used, which is the purpose of this notice
• ask for a copy of the information we hold about you
• ask us to correct information that is wrong
• ask us to delete your information, including removing your certificate from the register
• ask us to limit how we use your information
• object to our using your information on the basis of our legitimate interests
• ask for the information you gave us in a form you can take elsewhere

To use any of these, email [email protected]. Because we don't hold your name, tell us your certificate number or ID so we can find your record; we may ask you to confirm the name on the certificate. We will reply within one month, and there is no charge. Removing a certificate from the register means it can no longer be verified.

Complaints

If you are unhappy with how we have handled your information, please tell us first at [email protected] so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk/make-a-complaint.

Children

LayerCert is not intended for children under 13, and we do not knowingly handle their information. If you believe a child has used the service, contact us and we will delete what we hold.

Changes to this notice

If we change how we handle your information, we will update this page and the date at the top. If a change is significant, we will say so clearly on the site.