Effective date: 10 September 2026
1. Application
1.1 This Privacy Notice (the "Notice") governs the processing of personal data by Bynn Intelligence Inc. ("Bynn", the "Company") in connection with the ZOREAL Mark browser extension (the "Extension") and the ZOREAL Mark record service at mark.zoreal.com and api.zoreal.com (the "Service"). It supplements the ZOREAL Privacy Notice, which is incorporated by reference and continues to apply. In the event of conflict in respect of the Extension or the Service, this Notice prevails. The Company is the controller and may be contacted at privacy@bynn.com.
2. Processing on the user's device
2.1 The Extension reads the content of web pages displayed in the user's browser for the sole purpose of locating and verifying ZOREAL Marks. Such reading takes place on the user's device. The content of pages, their addresses, the user's browsing history and the user's identity are not transmitted to the Company by the verification function.
2.2 The Extension stores on the user's device its settings, a cache of public records it has retrieved, and, for the duration of a browser session, the Marks located in each open tab. Such data is deleted upon removal of the Extension.
3. Verification
3.1 To verify a Mark, the Extension requests from the Service the public record identified by the Mark's code, without any credential, cookie or identifier of the user. The Service receives the record code requested and the network address and request headers ordinarily received by a web server, which the Company processes for the security and operation of the Service and retains in operational logs for a limited period. The Company does not maintain a record of the users who have retrieved a given record.
4. Signing
4.1 Signing requires the ZOREAL ID application and is subject to the notices applicable to it, including the Biometric Data Privacy Notice. When the user elects to sign, the Extension transmits to the Service the text to be signed, encrypted under a key generated in the browser and not disclosed to the Company, a cryptographic hash of the text, the address of the page for which the text is signed, and the site derived from it.
4.2 The resulting record is published at mark.zoreal.com, is publicly accessible, and contains the hash, the page address, the site, the time of signing, the signer's certificate for the site (a pseudonymous per-site identity or, at the signer's election, the signer's verified legal name) and the cryptographic evidence of the signing. The record does not contain the text. Published records are retained indefinitely and may be withdrawn but not deleted, their purpose being to constitute a permanent verifiable statement. Unclaimed signing requests are deleted within a limited period, and the encrypted text of a completed request is deleted upon creation of the record.
5. Sighting reports
5.1 Where the user enables sighting reports, the Extension transmits to the Service the record code and the address of the page on which a Mark verified for a different page is located, and no data concerning the user. Sighting reports are disabled by default.
6. Disclosure and use
6.1 The Company does not use analytics, advertising identifiers, tracking technologies or third-party code in the Extension, does not sell personal data processed in connection with the Extension or the Service, and does not use such data for advertising. The Company may disclose personal data to its affiliates, to processors engaged under contract, to a successor in the event of a merger, acquisition or reorganisation, and where required by law or legal process.
7. Legal bases and rights
7.1 Where the General Data Protection Regulation or an equivalent law applies, the Company processes network addresses on the basis of its legitimate interests in the security and operation of the Service (Article 6(1)(f) GDPR), the data in a signing request and a published record on the basis of the performance of the contract under which the user requests the signing (Article 6(1)(b)), and the signer's legal name in a record on the basis of the signer's election to publish it. Data subjects have the rights afforded by applicable law, including the rights of access, rectification, erasure (subject to Section 4.2), restriction, portability and objection, and the right to lodge a complaint with a supervisory authority, as further described in the ZOREAL Privacy Notice.
8. Amendments
8.1 The Company may amend this Notice. The effective date of the version in force appears above.