[go: up one dir, main page]
Sealed Rose
Sealed Rose
PricingResearchTrust & methodologyDocsSextortion help
Scan a video freeSign in
Last updated 30 September 2026

Privacy policy

Operated by Kinetic Helix LLC, a Florida limited liability company (doing business as “Sealed Rose,” “we,” “us,” “our,” or the “Company”). Contact: privacysealedrose.com.

1. Who we are & scope

Kinetic Helix LLC operates Sealed Rose—an autonomous artificial intelligence (AI) security, deepfake forensics, and synthetic media verification platform. Our services include our AI Video Detector, AI Image Detector, AI Voice Detector, AI Text Detector, Reverse Face Search, Likeness Protection utilities, Phone Carrier Reputation Lookup, developer APIs, and browser extensions (collectively, the “Service”).

This Privacy Policy explains what personal data and media we collect, why we process it, our strict ephemeral data retention schedules, our third-party processing partners, and your rights under United States state laws (including the California Consumer Privacy Act/CPRA, Illinois BIPA, Texas CBOI) and international data-protection frameworks (including the EU/UK General Data Protection Regulation/GDPR).

2. Information we collect

  • Account & developer data: Email address, cryptographically salted and hashed password (never stored in plaintext), display name, user role, API keys, notification preferences, and support correspondence. Sign-in session records retain the client IP address (session.ip_address) strictly for account authentication security, passkey origin validation, and multi-factor session hijacking defense.
  • Payment & billing data: We do not collect or store raw credit/debit card numbers or CVV codes. All payments for AI Verification Credit Packs and developer API access are processed securely by Stripe. We retain only merchant transaction identifiers, purchase timestamps, currency amounts, and the card's last four digits for our accounting ledger, receipt generation, refund administration (Refund & credits policy), and anti-fraud verification.
  • AI forensic verification submissions: When you submit media to our detection engines (via direct file upload, public URL, live camera capture, or clipboard paste):
    • Media bytes: Video files (MP4, MOV, WebM), image files (JPEG, PNG, WebP), audio recordings (MP3, WAV, M4A, OGG), or text snippets submitted for forensic scanning. Uploaded media is processed in memory and permanently deleted after scanning.
    • Technical forensics: Extracted video frames, perceptual hashes (pHash), audio Fourier transform spectrograms, file container metadata, and stripped EXIF data (which we discard upon ingestion).
    • Aggregate detection statistics: High-level non-personally identifiable verification metrics (such as aggregate check counts, synthetic vs. authentic ratios, and detected generative model families) are computed across checks for public transparency and threat trends (such as our Live Deepfake Detection Index at /tracker). Public aggregate statistics contain zero filenames, user identifiers, thumbnails, or personal information.
    • Phone lookup queries: Phone numbers entered to check carrier routing, virtual/VoIP risk, and scam reputation.
  • Device, network & security telemetry: IP address, approximate geographical location (city, region, country), user-agent string, operating system, browser engine, screen viewport dimensions, and WebGL hardware parameters (GPU renderer). We process this telemetry to enforce rate limits, prevent automated DDoS/scraping attacks, and diagnose client rendering issues.

3. Cookies & advertising technology policy

Sealed Rose uses first-party cookies and local storage essential for session security, quota rate limiting, and aggregate platform telemetry:

  • sr_session: Keeps authenticated accounts and developer sessions logged in securely (SameSite=Lax/Strict, HttpOnly).
  • sr_vid: An anonymous, randomly generated visitor UUID used by our first-party telemetry endpoint (/api/t) to monitor tool latency and quota usage without linking to your personal identity.
  • sr_attr: Records initial referral or search source for product analytics (30 days).
  • sr_hints: Caches client hardware viewport and GPU rendering capabilities across forensic tools to avoid redundant browser re-computation.
  • _clck, _clsk: Microsoft Clarity cookies used for anonymous, aggregate product usability analytics on public marketing pages. Clarity is strictly blocked on all forensic tool pages, verification reports, crisis and extortion assistance routes, and authenticated account pages. Where active, all on-screen text and inputs are masked.

Third-party advertising & partner cookies (Google AdSense)

We may display advertisements provided by third-party advertising networks, including Google AdSense, strictly on general informational and marketing pages. Advertising scripts are strictly blocked from loading on forensic scanner tools, verification reports, crisis or sextortion assistance resources, and account management screens. Third-party vendors, including Google, use cookies (such as the DoubleClick cookie) to serve ads based on prior visits:

  • Google's use of advertising cookies enables it and its partners to serve ads based on visits to Sealed Rose and/or other sites on the Internet.
  • Personalized advertising opt-out: Users may opt out of personalized advertising by visiting Google Ads Settings.
  • Alternatively, you can opt out of third-party vendors' use of cookies for personalized advertising by visiting www.aboutads.info or the Network Advertising Initiative opt-out page at optout.networkadvertising.org.

4. Biometric information notice (BIPA & state law)

Consistent with biometric privacy laws—including the Illinois Biometric Information Privacy Act (740 ILCS 14/), Texas Capture or Use of Biometric Identifier Act (Bus. & Com. Code §503.001), and Washington state legislation—we disclose the following regarding facial geometry and vectors:

  • Purpose: Facial embeddings and vector representations generated during Reverse Face Search or Likeness Protection scans are used solely to identify synthetic media, unauthorized deepfakes, and deepfake impersonation across indexed media. We never sell, lease, trade, or monetize biometric identifiers, nor do we use them for behavioral profiling or commercial advertising.
  • Consent: Users provide explicit, affirmative consent prior to initiating facial forensic scans or enrolling their likeness in automated deepfake monitoring.
  • Retention & destruction schedule: Ad-hoc face search embeddings are held ephemerally in volatile memory and destroyed immediately following analysis. Cropped images generated for external search pivots are stored in encrypted object storage for up to one (1) hour solely to allow third-party search engines to retrieve them, then deleted. Enrolled likeness protection vectors are maintained only for the active duration of the monitoring enrollment and are permanently purged within thirty (30) days of account deactivation or upon user deletion request.

5. How submitted verification media is handled

When you submit files to our forensic detection tools (/verify-video, /verify-image, /verify-audio, /verify-text, or developer APIs):

  • Processed in memory & immediately deleted: Media submitted for forensic verification is decoded, sampled, and analyzed in volatile memory (RAM). We do not store your uploaded media. Raw files are permanently deleted immediately upon completion of your scan. Uploaded files are never indexed in search engines, never sold, and not retained for administrative review.
  • External search engine pivots (optional): When you explicitly request an external visual search pivot or reverse face search, your cropped face or image is stored in encrypted Cloudflare R2 storage for up to one (1) hour via a time-limited presigned URL solely to allow external visual search engines (Google Lens, Microsoft Bing, Yandex, TinEye) to retrieve and process the image over HTTP. These temporary files are automatically purged after one hour. Sealed Rose does not maintain a searchable database of faces.
  • Mandatory child safety scanning: Prior to forensic scoring, every image and video frame is hashed against Microsoft PhotoDNA to detect known Child Sexual Abuse Material (CSAM). If suspected CSAM is detected, processing stops and we report it to the NCMEC CyberTipline as required by 18 U.S.C. § 2258A. The reported material is preserved in restricted, encrypted storage for the period the law requires, then deleted.
  • No AI training on your files: We do not use your submitted verification files to train proprietary foundation models, nor do our infrastructure partners have the right to use your uploads for commercial model training.

6. Service providers & third-party processing

We share information strictly with specialized providers under data processing agreements:

  • Neural Detection Partners: Evaluates sampled image and video frames for synthetic generative signatures, model family attribution (e.g., Sora, Seedance, MiniMax, Kling, Stable Diffusion, Flux), and deepfake probabilities, serving as an upstream neural classification provider alongside Sealed Rose's first-party frame sampling, sensor pattern modeling, STFT acoustic spectrogram analysis, and digital provenance verification pipelines.
  • Microsoft PhotoDNA: Mandatory pre-scan perceptual hashing against known illegal child exploitation imagery databases.
  • Stripe: Secure payment processing and invoicing for AI Verification Credit Packs and developer subscriptions.
  • Google Cloud Platform: Reverse-image search queries (only when explicitly requested by the user) and high-performance inference infrastructure.
  • External visual search engines: When you use external search pivots (such as Google Lens, Microsoft Bing, Yandex, or TinEye), your browser opens those third-party services directly with the cropped image URL you selected. Sealed Rose does not transmit your personal account credentials or private profile data to these search engines, and your interactions on those platforms are governed strictly by their respective terms of service and privacy policies.
  • Cloudflare & Railway: Content delivery, edge DDoS mitigation, and container application hosting. Cloudflare R2 encrypted object storage is utilized for static platform assets, public educational demonstration media, isolated encrypted CSAM perceptual hash evidence vaults required by law (18 U.S.C. § 2258A), and temporary 1-hour presigned files specifically requested by the user for external visual search pivots.

7. Multi-tier data retention schedule

To ensure absolute transparency across all public claims, Sealed Rose delineates retention across distinct technical layers:

  1. Temporary processing buffers: Deleted Immediately After Scan. Any temporary chunks generated during stream decoding or frame extraction are held exclusively in volatile RAM and released immediately upon scan completion. User uploads are processed in memory and permanently deleted after your scan.
  2. External search pivot image crops: Stored for up to One (1) Hour. When you explicitly initiate an external visual search pivot or reverse face search, the cropped image is held in encrypted Cloudflare R2 storage via a time-limited presigned URL expiring in one (1) hour solely to enable external engines (Google Lens, Bing, Yandex, TinEye) to fetch the file, after which it is purged.
  3. Forensic cryptographic hashes & quota logs: One-way SHA-256 media hashes, anonymized client IP hashes, and rolling timestamp counters are retained to enforce fair daily free allowances, prevent automated brute-force attacks, and validate user-requested scan reports. Cryptographic hashes cannot be reversed to reconstruct source imagery. Zero uploaded raw media is stored.
  4. Financial & Stripe billing records: Retained for seven (7) years to comply with federal and state tax laws, commercial accounting standards, and payment card network (AML) auditing rules.
  5. Safety & legal quarantine: If suspected CSAM is detected, processing stops and we report it to the NCMEC CyberTipline as required by 18 U.S.C. § 2258A. The reported material is preserved in restricted, encrypted storage for the period the law requires (at least one year under the REPORT Act, 18 U.S.C. § 2258A(h)), then deleted. Perceptual hashes of verified non-consensual imagery removed under the TAKE IT DOWN Act are preserved strictly to prevent re-upload.
  6. Account & API records: Account profile information and API key metadata are retained for the active duration of your account plus ninety (90) days following voluntary closure.

8. Global privacy rights (GDPR, CCPA/CPRA & state laws)

Whether you reside in California, another US state with comprehensive privacy legislation (Virginia, Colorado, Connecticut, Texas, Utah), the United Kingdom, or the European Economic Area (EEA), you have the right to:

  • Access & portability: Request a copy of the personal data and verification logs we hold about you.
  • Correction: Request correction of inaccurate personal data.
  • Deletion: Request erasure of your personal data, subject to legal retention exceptions (e.g., tax records, active security holds, or statutory obligations).
  • Opt-out of sale / sharing: We do not sell personal data. To the extent third-party advertising cookies or analytics partners process digital identifiers, you may exercise your opt-out rights via the mechanisms outlined in Section 3 above.
  • Non-discrimination: You will not receive discriminatory treatment or diminished service quality for exercising your privacy rights.

To exercise any of these rights, contact us at privacysealedrose.com. We verify your identity before processing sensitive requests.

9. Contact & data controller

The data controller for the Service is:
Kinetic Helix LLC (d/b/a Sealed Rose)
2261 Market St #4400, San Francisco, CA 94114
Privacy inquiries: privacysealedrose.com
Security reports: securitysealedrose.com