Current status of this website. The public site sets no cookies and loads no analytics, advertising or session-replay script. The four free tools run in your browser and do not upload files. This domain has no account, login, contact form or payment flow. Sections that describe hosted services apply only when you use a service that references this policy; that service also has its own terms.
1. Introduction
EmbedHarbor is operated by Shanghai Weisha Technologies Co., Ltd. (上海未鲨科技有限公司), a company incorporated in the People's Republic of China.
This Privacy Policy explains how personal data is collected, used, disclosed, retained, and protected when individuals visit our website, communicate with us, use our publicly available tools, or access our hosted services.
This policy applies to https://embedharbor.com and to other EmbedHarbor services that expressly reference it.
It should be read together with any applicable Data Processing Agreement (DPA) and product-specific privacy notices.
Contact: [email protected]
Scope: this website, the free tools and hosted services
This policy covers the public website and the four free browser tools as they are implemented today. The free-tool statements describe those tools' actual data flow only. Hosted services that reference this policy must confirm each section against their real processing before relying on it, and a SaaS customer's personal data is processed under that customer's agreement and a DPA where required — a general privacy policy is not a substitute for a DPA.
2. Our roles in processing personal data
Our responsibilities depend on the circumstances in which personal data is processed.
2.1 When we act as a data controller
We generally determine the purposes and means of processing personal data relating to website visits and communications, account registration and authentication, organization administration and user invitations, customer support and security communications, product usage measurement and service improvement, marketing communications where permitted, and fraud prevention, abuse detection, and legal compliance.
For these activities, we act as a data controller to the extent provided under applicable data protection law. On this website, the processing that exists today is described in section 3.
2.2 When we act as a data processor
Where a business customer submits personal data to a hosted service and determines why and how that data is used, we may act as a data processor on that customer's behalf.
In these circumstances, the customer generally acts as the data controller and is responsible for the relevant processing instructions and legal basis. Our processing obligations are defined by the applicable agreement, including a DPA where required; such a service is not offered without that agreement.
3. Categories of personal data
Depending on which features are used, we may process the following categories.
3.1 Account and identity information
Name or account identifier, business email address, organization name, role and access permissions, and authentication information such as password verification records, session information, and security events.
This website has no accounts or login. These categories apply to hosted services that reference this policy.
3.2 Business contact information
Contact name and company affiliation, business email address, support requests and correspondence, and information provided in product inquiries or demonstrations.
On this website the only business contact data we receive is the email you choose to send to [email protected].
3.3 Technical and usage information
IP address and approximate location inferred from network information, browser type, device information and operating system, access timestamps and requested resources, authentication events, errors and security logs, and feature usage and interaction events where such collection is enabled.
This website loads no analytics or tracking script, so no usage events are collected. The hosting provider may record standard request logs (see section 3.6).
3.4 Customer-submitted technical content
Depending on the service, customers may provide SBOM files and software component metadata, software package identifiers and dependencies, product names and versions, vulnerability references and assessment records, security incident and remediation information, software supply-chain relationships, and certificate metadata.
These materials are not necessarily personal data, but they may contain names, email addresses, usernames, identifiers, or other information relating to identifiable individuals. We treat personal data within these materials in accordance with applicable law and our contractual role.
The free tools on this website do not transmit these materials to us; they are processed in your browser (section 5).
3.5 Information from third parties
We may receive limited information from organization administrators, users issuing invitations, service providers, or publicly available technical data sources. Public vulnerability intelligence or package metadata may also be obtained from third-party databases.
This website does not receive personal data from advertising, data-broker, or social-media sources.
3.6 Hosting logs
The website is served as static files by a hosting provider. Like most hosts, it may record standard request logs such as IP address, timestamp, requested path, response status and user agent for security, abuse prevention and capacity planning. We do not use these logs to build profiles or to identify individual visitors.
4. Purposes and legal bases for processing
Where the GDPR applies, we rely on an appropriate legal basis for each relevant processing activity. Some rows describe hosted services that this website does not provide today.
| Purpose | Legal basis |
|---|---|
| Providing an account or requested service to an individual contracting with us | Performance of a contract |
| Managing business-user accounts and organizational access | Legitimate interests or performance of a contract, as applicable |
| Responding to inquiries and support requests | Legitimate interests or steps requested before entering a contract |
| Protecting systems and detecting abuse | Legitimate interests and, where applicable, legal obligations |
| Maintaining required business and compliance records | Legal obligation |
| Sending optional marketing communications | Consent or another lawful basis, where permitted |
| Using non-essential tracking technologies | Consent, where required |
| Providing optional AI-assisted functions | An appropriate basis determined by the purpose and processing role |
Where we rely on legitimate interests, those interests include operating and securing our services, responding to business inquiries, preventing misuse, and improving service reliability, subject to an assessment of affected individuals' rights and interests.
Where we act as a processor, our customer determines the applicable legal basis for its processing, and we process the data under the customer's documented instructions and the applicable agreement.
We do not rely on consent for this website because no optional tracking is enabled. If that changes, this policy and the site will be updated before any tracking is introduced.
5. Free online tools and file processing
EmbedHarbor may offer free tools for SBOM validation, certificate inspection, and related technical analysis. Different tools and functions may process information differently.
The current tools run in your browser. The SBOM Validator, SBOM Diff, CRA Scope Checker and X.509 Decoder read the file or answers you provide without uploading them; there is no upload endpoint on this website. Reports you download are generated locally and saved by your device, and the input is discarded when you leave the page.
The processing behaviour of each tool is described before you provide data, including whether the input is uploaded, stored, logged, transmitted to an external service, or processed solely within the browser. A future tool that needs a server will say so on its page before it asks for input.
Sensitive information: do not submit passwords, private keys, authentication tokens, or other secret materials unless the relevant product expressly supports and securely handles such information. The X.509 Decoder rejects private keys.
6. Customer content and confidentiality
Customer-submitted content may contain commercially sensitive information, including software inventories, dependency relationships, or security findings.
We limit our use of such content to providing and maintaining the requested services, supporting authorized customer requests, protecting service security, and meeting applicable legal obligations. We will not treat customer-submitted content as publicly available merely because it is uploaded to an EmbedHarbor service.
Any disclosure to a service provider or other third party must be supported by an appropriate purpose, authorization, agreement, and legal basis. The free tools on this website do not create customer content on our systems.
7. Artificial intelligence features
Certain services may offer optional AI-assisted explanations or analysis. No AI-assisted feature is active on this website today.
Where such features become available, the applicable interface or product documentation will identify the material categories of information sent for processing, the relevant provider or provider categories, and any applicable limitations, before use.
AI-generated content may contain errors or omissions and should be reviewed by qualified personnel before reliance. We will not claim that uploaded customer data is excluded from model training unless the provider settings and the product implementation have been verified.
8. Sharing personal data
We may disclose personal data to the following categories of recipients where necessary and lawful: hosting, infrastructure and content-delivery providers; email and authentication service providers; security monitoring and operational support providers; analytics providers, where configured; AI or vulnerability-intelligence providers, where the applicable feature is enabled; and professional advisers, auditors, or public authorities where required by law.
For this website the recipients are the static hosting and content-delivery provider and the email provider. We do not grant service providers unrestricted rights to use personal data for their own purposes, and we do not sell personal data or share it for advertising.
Where service providers act as processors or sub-processors, appropriate contractual and technical safeguards must be established. A current provider and sub-processor list for a procurement review is available on request from [email protected].
9. International data transfers
EmbedHarbor is operated by a company incorporated in China, while its customers and technical service providers may be located in other jurisdictions. Personal data may be subject to cross-border processing or access depending on the deployment architecture, service providers, support arrangements, and administrative operations.
Where the GDPR applies to an international transfer, an appropriate mechanism must be established, such as an applicable adequacy decision, Standard Contractual Clauses, or another legally permitted mechanism, together with any necessary additional safeguards.
Hosting personal data in the European Economic Area does not, by itself, establish that no international transfer or third-country access occurs. For this website, personal data reaches us mainly through email correspondence and standard hosting request logs; the production hosting provider and its region are part of the deployment and are not stated here as a data-residency guarantee.
If you need the current transfer details for a procurement review, write to [email protected] and we will answer specifically.
10. Data retention
We retain personal data only for as long as reasonably necessary for the purposes for which it is processed, subject to applicable contractual, security, and legal obligations. The table states the position for this website and the rule for hosted services.
| Data category | Retention |
|---|---|
| Account and profile information | Not applicable to this website; it has no accounts |
| Customer-uploaded content | Not received by this website; the free tools process files in your browser |
| Temporary tool-processing data | Not retained; discarded when you leave the page |
| Authentication and security logs | No authentication on this website; hosting security logs follow the host's cycle |
| Operational and access logs | Hosting provider's short retention window |
| Support communications | Kept while the request and follow-up are active, then deleted or archived with the business record |
| Marketing contact data | Not collected; this website has no marketing sign-up |
| Backups and disaster recovery | Hosting backups follow the provider's cycle; no tool input is included |
Hosted services define their periods in the applicable agreement and product-specific notice before the service is offered. When retention is no longer justified, data is deleted or anonymized in accordance with the applicable policy and technical capabilities, unless continued retention is legally required. Data may remain temporarily in backups until the applicable backup lifecycle ends, subject to access restrictions and security controls.
11. Security
We seek to apply technical and organizational measures appropriate to the nature of the information processed and the associated risks, such as access controls, authentication safeguards, encryption, monitoring, and operational security procedures where relevant to the service.
No internet-based service can guarantee absolute security. This page does not claim certifications that have not been independently audited. Where required by applicable law, we will notify affected parties or competent authorities of qualifying personal data breaches.
Users are responsible for protecting their account credentials, maintaining appropriate access permissions, and notifying us of suspected account compromise. See the security and data handling page for the technical behaviour of this site.
12. Cookies and similar technologies
This website sets no cookies and stores nothing in local storage or session storage. No analytics, advertising, tag-manager, or session-replay script is loaded, and there is no fingerprinting: no canvas, font, audio or hardware probing.
Our applications and future services may use cookies, local storage, or similar technologies for authentication and session management, security and fraud prevention, preference storage, and analytics where enabled. Strictly necessary technologies may be used to provide a requested service, subject to applicable law.
Where consent is required for non-essential technologies, they will not be activated before that consent is obtained, will be listed in an inventory on this page with their purposes, providers and retention, and users will be able to manage or withdraw consent.
13. Individual rights
Where applicable data protection law provides such rights, individuals may request:
- Access to their personal data.
- Correction of inaccurate information.
- Erasure of personal data.
- Restriction of certain processing activities.
- Data portability.
- Objection to certain processing activities.
- Withdrawal of consent where processing is based on consent.
- Appropriate safeguards concerning qualifying automated decision-making.
These rights may be subject to statutory conditions and exceptions. Requests may be submitted to [email protected]. We may request reasonable information necessary to verify the identity or authority of the requester.
Where we process personal data solely on behalf of a customer, we may direct the request to the relevant customer or assist that customer as required under the applicable agreement and law. Individuals in the European Economic Area may also lodge a complaint with a competent supervisory authority.
14. Marketing communications
Where permitted by law, we may contact business users about relevant product updates, events, or services. Individuals may opt out of direct marketing communications using an unsubscribe mechanism or by contacting us.
Where consent is legally required, marketing communications will be sent only after the necessary consent has been obtained. Essential account, security, and service communications are handled separately from optional marketing communications.
This website collects no marketing contact data and has no newsletter sign-up; any future sign-up will state its purpose and require the consent that applies.
15. Children's privacy
EmbedHarbor services are designed primarily for professional and business use and are not directed to children. We do not intend to knowingly collect personal data from children through services directed at them.
If you believe a child has submitted personal data to us in circumstances requiring action, please contact us at [email protected].
16. Changes to this policy
We may update this policy to reflect changes in our services, data processing practices, or applicable law. The current version and its effective date are stated at the top of this page.
Where required, we will provide additional notice or seek renewed consent before materially changing relevant processing activities. Material changes will be reflected here with a new date.
17. Contact and data protection inquiries
For questions about this Privacy Policy, the processing of personal data, or requests to exercise applicable data protection rights, please contact:
Shanghai Weisha Technologies Co., Ltd.
上海未鲨科技有限公司
Data Protection Contact
Email: [email protected]
Registered address:
10th Floor, Building 1, No. 188 Changyi Road, Baoshan District, Shanghai, China
上海市宝山区长逸路188号1幢10层
Company registration identifier (Unified Social Credit Code): 91310113MAEGFWLF2L
Registration authority: Shanghai Baoshan District Administration for Market Regulation
上海市宝山区市场监督管理局
We will review privacy-related inquiries and respond in accordance with applicable data protection laws.
Where EmbedHarbor processes personal data solely on behalf of a business customer, requests relating to that data may need to be directed to the relevant customer acting as the data controller. We will provide assistance where required by law or an applicable data processing agreement.
Where applicable law requires us to designate a representative in the European Union, the relevant details will be published in this section in accordance with that law.