Loading report

CertScore.ai report

Loading report

The report is ready; we’re loading its retained findings and evidence.

huggingface.co tracking, cookie, consent, and accessibility scan | CertScore.ai

Scanned from EU-IR

Oct 12, 2026, 7:36:48 PM UTC(13 sec scan)

Coverage

CMS / generator: Not identified
Declared version: Not available

Coverage

Scan scope: Single page
Pages scanned: 1
Scan region: EU-IR

Timing

Observation window: 13 sec

Started: Oct 12, 2026, 7:36:48 PM UTC
Completed: Oct 12, 2026, 7:37:02 PM UTC

huggingface.co

https://huggingface.co/

Executive overview

92/ 100

Page score

1 priority issue

1 page scanned

Assessment highlights

The assessment calls for focused review of cookies and storage before consent. “Pre-consent storage classification review”: Cookies or browser storage were retained before consent. First retained item: aws-waf-token (huggingface.co): unknown, present in periodic pre-consent snapshot. Essentiality was not confirmed for every item. Review the supporting evidence and recommended fixes in Detailed evidence.

Pre-consent resource counts & classifications

Each resource is counted once. Services group requests, cookies/storage and frames.

Requests62

Non-essential: 0
Classification review: 0
Unknown purpose: 28
Contextual: 32
Essential: 2

Cookies & storage3

Non-essential: 0
Classification review: 1
Unknown purpose: 0
Contextual: 2
Essential: 0

Embedded frames0

Non-essential: 0
Classification review: 0
Unknown purpose: 0
Contextual: 0
Essential: 0

Services1

Stripe.js

Forms1

generic form
1 field · unknown

View forms ↗

Hidden links0

Requests620 non-essential0 review

Cookies & storage30 non-essential1 review

Embedded frames00 non-essential0 review

Regulatory Risk Review

Top issues on this page

1 issue

01Pre-consent storage classification reviewStarting pageCookies or browser storage were retained before consent. First retained item: aws-waf-token (huggingface.co): unknown, present in periodic pre-consent snapshot. Essentiality was not confirmed for every item.Partial concernPartial concern

Affected pages

https://huggingface.co/ · Starting page

GDPR / ePrivacy: Pre-consent storage classification review
Cookies or browser storage were observed before consent, but the scan could not determine whether every item was essential or non-essential.

Recommended fixes

View supporting evidence ↓

Inspect the listed cookie and storage identities, their purposes, and the retained timing evidence. Distinguish a directly observed write from snapshot presence. For items confirmed to require consent, gate their creation and use on the relevant affirmative choice; check the responsible tag or integration. Retest the same page and location in a fresh session. Verify those items are absent before consent and after Reject, and appear only after the applicable Accept choice.

JSON evidence

{
  "assessmentStatus": "review_signal",
  "checklistItemId": "pre_consent_cookies_storage",
  "coverageArea": "Pre-consent storage classification review",
  "evidenceState": "observed",
  "explanation": "Pre-consent storage was retained. 1 record remains unclassified. Review the retained storage inventory before drawing a conclusion.",
  "note": "Pre-consent storage was retained. 1 record remains unclassified. Review the retained storage inventory before drawing a conclusion.",
  "status": "Review signal",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.pre_consent_cookies_storage.review_signal",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.pre_consent_cookies_storage"
  },
  "statusBasis": "Pre-consent storage was retained. 1 record remains unclassified. Review the retained storage inventory before drawing a conclusion.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Inspect the listed cookie and storage identities, their purposes, and the retained timing evidence. Distinguish a directly observed write from snapshot presence.",
        "For items confirmed to require consent, gate their creation and use on the relevant affirmative choice; check the responsible tag or integration.",
        "Retest the same page and location in a fresh session. Verify those items are absent before consent and after Reject, and appear only after the applicable Accept choice."
      ]
    },
    "evidenceRefs": [
      "aws-waf-token (huggingface.co): unknown, present in periodic pre-consent snapshot",
      "Aggregate pre-consent storage count: 1",
      "Assessment reconciliation: reconciled"
    ],
    "cookiesSeenCount": 1,
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected retained concrete cookie/storage evidence for storage timing; request-only tracking evidence is not used as storage proof.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "limited",
    "cookiesBeforeConsentCount": 0,
    "selectedEvidenceArtifactId": "preConsentCookieOrStorageEvidence.missing",
    "preConsentStorageAssessment": {
      "status": "partially_classified",
      "evidenceRows": [
        {
          "name": "aws-waf-token",
          "party": "first_party",
          "domain": "huggingface.co",
          "category": "unknown",
          "storageType": "cookie",
          "essentiality": "unknown",
          "timingEvidence": "periodic_preconsent_snapshot",
          "exclusionReason": null,
          "firstObservedMs": 3413,
          "initiatorDomain": null,
          "initiatorVendor": null,
          "essentialitySource": "unknown",
          "exactStorageIdentity": "[\"aws-waf-token\",\".huggingface.co\",\"/\",null]"
        }
      ],
      "provenWriteCount": 0,
      "assessmentVersion": "pre-consent-storage-assessment-v1",
      "unclassifiedCount": 1,
      "reconciliationStatus": "reconciled",
      "snapshotPresenceCount": 1,
      "aggregateObservedCount": 1,
      "classifiedEssentialCount": 0,
      "classifiedNonEssentialCount": 0,
      "attributedPreConsentRecordCount": 1,
      "excludedFunctionalOrConsentCount": 0
    },
    "preConsentStorageAssessmentStatus": "partially_classified",
    "rowLevelEssentialityEvidenceRetained": true,
    "firstPreconsentCookieOrStorageObservedMs": 3413,
    "preConsentStorageClassificationLimitation": true,
    "preconsentCookieOrStorageExactTimingRetained": false,
    "eligibleNonEssentialCookieStorageFindingProjected": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": [],
  "groupedEvidence": [],
  "evidenceDetails": {
    "policyEvidenceDetails": {
      "assessmentStatus": "review_signal",
      "evidenceRefs": [
        "aws-waf-token (huggingface.co): unknown, present in periodic pre-consent snapshot",
        "Aggregate pre-consent storage count: 1",
        "Assessment reconciliation: reconciled"
      ],
      "explanation": "Pre-consent storage was retained. 1 record remains unclassified. Review the retained storage inventory before drawing a conclusion.",
      "regulatoryAreaId": "gdpr_eprivacy",
      "regulatoryAreaTitle": "GDPR / ePrivacy",
      "regulatoryMapping": [],
      "missingOrIncompleteSourceSignals": [],
      "pipeline": {
        "projectionStage": "coverage_policy",
        "concernPolicyKey": "gdpr_eprivacy_coverage.pre_consent_cookies_storage.review_signal",
        "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
        "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.pre_consent_cookies_storage"
      },
      "projectedFindings": [],
      "retainedEvidence": {
        "remediation": {
          "kind": "steps",
          "steps": [
            "Inspect the listed cookie and storage identities, their purposes, and the retained timing evidence. Distinguish a directly observed write from snapshot presence.",
            "For items confirmed to require consent, gate their creation and use on the relevant affirmative choice; check the responsible tag or integration.",
            "Retest the same page and location in a fresh session. Verify those items are absent before consent and after Reject, and appear only after the applicable Accept choice."
          ]
        },
        "evidenceRefs": [
          "aws-waf-token (huggingface.co): unknown, present in periodic pre-consent snapshot",
          "Aggregate pre-consent storage count: 1",
          "Assessment reconciliation: reconciled"
        ],
        "cookiesSeenCount": 1,
        "missingEvidenceNeeded": [],
        "selectedEvidenceReason": "Selected retained concrete cookie/storage evidence for storage timing; request-only tracking evidence is not used as storage proof.",
        "weakerArtifactsIgnored": [],
        "selectedEvidenceStrength": "limited",
        "cookiesBeforeConsentCount": 0,
        "selectedEvidenceArtifactId": "preConsentCookieOrStorageEvidence.missing",
        "preConsentStorageAssessment": {
          "status": "partially_classified",
          "evidenceRows": [
            {
              "name": "aws-waf-token",
              "party": "first_party",
              "domain": "huggingface.co",
              "category": "unknown",
              "storageType": "cookie",
              "essentiality": "unknown",
              "timingEvidence": "periodic_preconsent_snapshot",
              "exclusionReason": null,
              "firstObservedMs": 3413,
              "initiatorDomain": null,
              "initiatorVendor": null,
              "essentialitySource": "unknown",
              "exactStorageIdentity": "[\"aws-waf-token\",\".huggingface.co\",\"/\",null]"
            }
          ],
          "provenWriteCount": 0,
          "assessmentVersion": "pre-consent-storage-assessment-v1",
          "unclassifiedCount": 1,
          "reconciliationStatus": "reconciled",
          "snapshotPresenceCount": 1,
          "aggregateObservedCount": 1,
          "classifiedEssentialCount": 0,
          "classifiedNonEssentialCount": 0,
          "attributedPreConsentRecordCount": 1,
          "excludedFunctionalOrConsentCount": 0
        },
        "preConsentStorageAssessmentStatus": "partially_classified",
        "rowLevelEssentialityEvidenceRetained": true,
        "firstPreconsentCookieOrStorageObservedMs": 3413,
        "preConsentStorageClassificationLimitation": true,
        "preconsentCookieOrStorageExactTimingRetained": false,
        "eligibleNonEssentialCookieStorageFindingProjected": false
      },
      "rowId": "pre_consent_cookies_storage",
      "rowLabel": "Pre-consent storage classification review",
      "rowNote": "Cookies or browser storage were observed before consent, but the scan could not determine whether every item was essential or non-essential.",
      "statusBasis": "Cookies or browser storage were observed before consent, but the scan could not determine whether every item was essential or non-essential.",
      "regulatoryConcernKind": "partial_rating",
      "status": "Review signal"
    }
  },
  "evidenceRefs": [
    "aws-waf-token (huggingface.co): unknown, present in periodic pre-consent snapshot",
    "Aggregate pre-consent storage count: 1",
    "Assessment reconciliation: reconciled"
  ],
  "findingId": "regulatory_gap__gdpr_eprivacy__pre_consent_cookies_storage"
}

Pre-consent page event timeline

Scan start

Public page observation began

1.01s

3P request

3P request first observed

3.41s

Cookie observed

aws-waf-token · snapshot observation

3.41s

Pre-consent storage review

Classification review · first retained observation

12.97s

Observation end

Retained scan window closed

Pre-consent supporting evidence

Services & Resources

Resource breakdowns

65 distinct resources = 62 requests + 3 cookies & storage. Services group these resources.

Type mix

Requests62
Cookies & storage3

Evidence mix

Classification review1
Unknown purpose28
Contextual34
Essential2

Purpose mix

Unknown purpose63
Security2

Site relationship

First party59
Third party6

Services and their member resources
	Type		Priority legend Inventory classifications are separate from priority findings. Unknown purpose means the retained evidence does not establish a purpose. Contextual records an observation; it does not establish necessity or consent exemption.Non-essentialClassification reviewUnknown purposeContextualEssential Shows the highest priority among the service’s resources. Expand the service to inspect individual resources.					Domain	Site relationship		JSON evidence
2		Stripe.js		Payment processors	Policy disclosure · Mentioned Stripe.js Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. \| Forum \| United States AWS SES \| Emails \| United States Amazon Web Services, Inc. \| Hosting/Infrastructure \| United States Metronome \| Billing \| United States Stripe \| Payment \| United States MongoDB Atlas \| Hosting/Infrastructure \| United States Google Cloud Platform \| Hosting/Infrastructure \| United States/EMEA GitHub \| Hosting code \| United States OVHCloud \| Hosting/Infrastructure \| France Slack Tec Matched at vendor level. https://huggingface.co/privacy Reviewed 2026-10-12T19:37:02.160Z · Complete retained text Evidence SHA-256: a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18	Location details Stripe.js Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. Ireland 54.230.114.76 · Amazon.com, Inc. · AS16509 Approximate server country · Source: proxy connect iplocate Country database: 2026-10-07 Network database: 2026-10-07 Ireland 54.230.114.76 · Amazon.com, Inc. · AS16509 Approximate server country · Source: proxy connect iplocate Country database: 2026-10-07 Network database: 2026-10-07 2 of 2 request events assessed; 0 without a retained server IP. Provider headquarters: Unknown Transfer mechanism: Mechanism not assessed Corporate headquarters Stripe, Inc. No verified headquarters reference available. Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	1.8s	js.stripe.com	Third party	Captured on 1 page https://huggingface.co/

Unattributed resources (63)

1 distinct service, including child services and unattributed resources

Forms & fields

1 form

Form 1Page observation

Not classified

Not captured

huggingface.co/

Not captured

Form 1

UNKNOWN · Checkboxes / toggles: —

Privacy disclosure Not captured

No disclosure text captured.

Fields in Form 1
Field	Input type	Data type	Required	Selection	State
Search models, datasets, users...	text	Not classified	No		Enabled

Technical evidence

{
  "observationRef": "collection_form_0",
  "formRef": "collection_form_0",
  "method": "unknown",
  "confidence": 0.78,
  "directVsInferred": "direct",
  "evidenceRefs": [
    {
      "refId": "ref_collection_surface_form_0",
      "eventType": "main_document_dom_form",
      "artifactId": "collection_surface_inventory_pre_consent"
    }
  ],
  "fields": [
    {
      "label": "Search models, datasets, users...",
      "review": {
        "version": "collection-field-review.v1",
        "category": "unknown",
        "preselectedMarketing": false
      },
      "disabled": false,
      "fieldRef": "collection_form_0_field_0",
      "readOnly": false,
      "required": false,
      "inputType": "text",
      "confidence": 0.68,
      "elementType": "input",
      "controlIndex": 0,
      "evidenceRefs": [
        {
          "refId": "ref_collection_surface_0_0",
          "eventType": "main_document_dom_control",
          "artifactId": "collection_surface_inventory_pre_consent"
        }
      ],
      "directVsInferred": "direct",
      "semanticCategory": "unknown",
      "autocompleteToken": "off"
    }
  ]
}

Detailed evidence

Privacy & security ratingsStarting page

29 rows

1Needs review12positive16contextual

CertScore.ai can make mistakes. Verify all findings.

CMP details

13 checks · 10 limited

Limited

Consent platform not i...

Consent management audit · 13 criteria

Cookie bannerSufficient verified evidence for this criterion was not retained in this scan.Not observed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "cfe74173-c90a-48a7-859d-740b6c823180",
  "assessmentSourceHash": "fnv1a-a8663998",
  "criterion": {
    "id": "banner",
    "label": "Cookie banner available",
    "status": "Not observed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": [
      "consentControlAssessment.surface"
    ]
  }
}

Correction steps

01Check the evidence for this item before making changes.

Reject optionReject or an equivalent refusal option was available on the banner.Not observed

View consent choices ↓

JSON evidence

{
  "scope": "starting_page",
  "scanId": "cfe74173-c90a-48a7-859d-740b6c823180",
  "assessmentSourceHash": "fnv1a-a8663998",
  "criterion": {
    "id": "reject",
    "label": "Option to reject cookies available",
    "status": "Not observed",
    "detail": "First-layer Reject or equivalent refusal control.",
    "sourceIds": [
      "consentControlAssessment.controls.reject"
    ]
  }
}

Correction steps

01Check the evidence for this item before making changes.

Accept / Reject prominenceNot enough verified evidence was captured.Not assessed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "cfe74173-c90a-48a7-859d-740b6c823180",
  "assessmentSourceHash": "fnv1a-a8663998",
  "criterion": {
    "id": "prominence",
    "label": "Accept / Reject prominence comparison",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

Category choicesNot enough verified evidence was captured.Not assessed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "cfe74173-c90a-48a7-859d-740b6c823180",
  "assessmentSourceHash": "fnv1a-a8663998",
  "criterion": {
    "id": "categories",
    "label": "Selection by categories available",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

CMP service listNot enough verified evidence was captured.Not assessed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "cfe74173-c90a-48a7-859d-740b6c823180",
  "assessmentSourceHash": "fnv1a-a8663998",
  "criterion": {
    "id": "services",
    "label": "Individual services identified in the CMP",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

Privacy-policy linkA privacy-policy link or page was found.Observed

View privacy-policy discovery evidence ↓

Privacy link before consentNot enough verified evidence was captured.Not assessed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "cfe74173-c90a-48a7-859d-740b6c823180",
  "assessmentSourceHash": "fnv1a-a8663998",
  "criterion": {
    "id": "privacy_access",
    "label": "Privacy-policy link reachable before consent interaction",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

Browser consent recordNot enough verified evidence was captured.Not assessed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "cfe74173-c90a-48a7-859d-740b6c823180",
  "assessmentSourceHash": "fnv1a-a8663998",
  "criterion": {
    "id": "consent_record",
    "label": "Client-side consent decision recorded",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

Tracking after consent choicesAction evidence was insufficient to assess implementation.Not assessed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "cfe74173-c90a-48a7-859d-740b6c823180",
  "assessmentSourceHash": "fnv1a-a8663998",
  "criterion": {
    "id": "implementation",
    "label": "Tracking activity after consent choices",
    "status": "Not assessed",
    "detail": "The retained action evidence does not establish whether settings are implemented correctly. No implementation pass is inferred from an absence of findings.",
    "sourceIds": []
  }
}

Consent-cookie expiryNot enough verified evidence was captured.Not assessed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "cfe74173-c90a-48a7-859d-740b6c823180",
  "assessmentSourceHash": "fnv1a-a8663998",
  "criterion": {
    "id": "duration",
    "label": "Consent-cookie expiry observed",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

Pre-consent cookie comparisonNot enough verified evidence was captured.Not assessed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "cfe74173-c90a-48a7-859d-740b6c823180",
  "assessmentSourceHash": "fnv1a-a8663998",
  "criterion": {
    "id": "declared_not_found",
    "label": "CMP cookie declarations compared with pre-consent capture",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

Unmatched cookie namesNot enough verified evidence was captured.Not assessed

JSON evidence

{
  "scope": "starting_page",
  "scanId": "cfe74173-c90a-48a7-859d-740b6c823180",
  "assessmentSourceHash": "fnv1a-a8663998",
  "criterion": {
    "id": "found_not_declared",
    "label": "Observed cookie names missing from CMP declarations",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

Cookie detailsNot enough verified evidence was captured.Not assessed

View cookie-disclosure availability ↓

JSON evidence

{
  "scope": "starting_page",
  "scanId": "cfe74173-c90a-48a7-859d-740b6c823180",
  "assessmentSourceHash": "fnv1a-a8663998",
  "criterion": {
    "id": "cookie_information",
    "label": "Information about cookies available (e.g., storage duration)",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

Tracking & embeds

4 checks · No review flags

Pre-consent non-essential trackingNo non-essential tracking requests were detected before a consent choice.Not observed

JSON evidence

runtime capture completed

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "pre_consent_third_party_tracking",
  "coverageArea": "Pre-consent non-essential tracking",
  "evidenceState": "not_observed",
  "explanation": "Whether classified non-essential analytics, advertising, measurement, replay, or similar requests were observed before recorded consent. Site relationship and entity ownership are reported separately.",
  "note": "Whether classified non-essential analytics, advertising, measurement, replay, or similar requests were observed before recorded consent. Site relationship and entity ownership are reported separately.",
  "status": "Not observed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.pre_consent_third_party_tracking.not_observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.pre_consent_third_party_tracking"
  },
  "statusBasis": "Runtime tracking checks completed for the tested context, and no eligible pre-consent non-essential tracking finding was projected.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: runtime capture completed"
    ],
    "trackerVendorCount": 0,
    "missingEvidenceNeeded": [],
    "trackingRequestTiming": {
      "version": "classified-request-timing.v1",
      "requests": []
    },
    "selectedEvidenceReason": "Selected retained pre-consent request/vendor timing evidence; storage evidence is evaluated separately.",
    "weakerArtifactsIgnored": [],
    "runtimeCaptureCompleted": true,
    "preconsentTimingEvidence": {
      "cookieOrStorage": {
        "preconsentCookieOrStorageExactTimingRetained": false,
        "firstPreconsentCookieOrStorageObservationBasis": "initial_preconsent_cookie_inventory",
        "preconsentCookieOrStorageTimedObservationCount": 0,
        "preconsentCookieOrStorageUntimedObservationCount": 0,
        "preconsentCookieOrStorageInitialInventoryObserved": true
      },
      "thirdPartyTracking": {
        "trackingRequestTiming": {
          "version": "classified-request-timing.v1",
          "requests": []
        },
        "preconsentThirdPartyTrackingTimedObservationCount": 0
      }
    },
    "selectedEvidenceStrength": "moderate",
    "preconsentTrackingDetected": false,
    "selectedEvidenceArtifactId": "preConsentTrackingRequestEvidence.missing",
    "preconsentCookieOrStorageExactTimingRetained": false,
    "firstPreconsentCookieOrStorageObservationBasis": "initial_preconsent_cookie_inventory",
    "preconsentCookieOrStorageTimedObservationCount": 0,
    "preconsentCookieOrStorageUntimedObservationCount": 0,
    "preconsentCookieOrStorageInitialInventoryObserved": true,
    "preconsentThirdPartyTrackingTimedObservationCount": 0
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Third-party iframes before consentNo third-party iframes were detected before a consent choice.Not observed

JSON evidence

retained pre-consent iframe inventory

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "third_party_iframe_pre_consent",
  "coverageArea": "3rd party iframes before consent",
  "evidenceState": "not_observed",
  "explanation": "Whether retained scanner evidence showed known 3rd party iframe embeds before a recorded consent action.",
  "note": "Whether retained scanner evidence showed known 3rd party iframe embeds before a recorded consent action.",
  "status": "Not observed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.third_party_iframe_pre_consent.not_observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.third_party_iframe_pre_consent"
  },
  "statusBasis": "Retained iframe inventory did not show known 3rd party iframe embeds before a recorded consent action.",
  "retainedEvidence": {
    "evidenceRefs": [
      "Evidence: retained pre-consent iframe inventory"
    ],
    "missingEvidenceNeeded": [],
    "preConsentIframeCount": 0,
    "iframeObservationCount": 0,
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "runtimeCaptureCompleted": true,
    "selectedEvidenceStrength": "missing",
    "selectedEvidenceArtifactId": "coverage_policy"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Social/media services before consentNo social or media services loaded before a consent choice.Not observed

JSON evidence

retained pre-consent embedded-content inventory

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "social_media_embed_pre_consent",
  "coverageArea": "Social/media embeds or plugins loaded before consent",
  "evidenceState": "not_observed",
  "explanation": "Whether retained network/runtime evidence showed a social, video, media embed, social pixel, or plugin provider loading before a recorded consent action.",
  "note": "Whether retained network/runtime evidence showed a social, video, media embed, social pixel, or plugin provider loading before a recorded consent action.",
  "status": "Not observed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.social_media_embed_pre_consent.not_observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.social_media_embed_pre_consent"
  },
  "statusBasis": "Retained embedded-content checks did not show a social/media embed, plugin, widget, or pixel provider request before consent. Plain outbound links are not treated as evidence for this row.",
  "retainedEvidence": {
    "evidenceRefs": [
      "Evidence: retained pre-consent embedded-content inventory"
    ],
    "placeholderDetected": false,
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "runtimeCaptureCompleted": true,
    "selectedEvidenceStrength": "missing",
    "selectedEvidenceArtifactId": "coverage_policy",
    "socialMediaEmbedObservationCount": 0
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Third-party embeds before consentNo third-party embeds were detected before a consent choice.Not observed

JSON evidence

EmbeddedContentObservationCount: 0

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "embedded_content_pre_consent",
  "coverageArea": "Embedded third-party services before consent",
  "evidenceState": "not_observed",
  "explanation": "Whether retained scanner evidence showed iframe, embed, widget, or visibly integrated third-party services before a recorded consent action. This row does not represent all background analytics or network requests.",
  "note": "Whether retained scanner evidence showed iframe, embed, widget, or visibly integrated third-party services before a recorded consent action. This row does not represent all background analytics or network requests.",
  "status": "Not observed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.embedded_content_pre_consent.not_observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.embedded_content_pre_consent"
  },
  "statusBasis": "Iframe/runtime checks completed for the tested context and did not retain a concrete 3rd party embedded-content iframe before consent.",
  "retainedEvidence": {
    "evidenceRefs": [
      "Evidence: retained pre-consent embedded-content inventory"
    ],
    "missingEvidenceNeeded": [],
    "preConsentIframeCount": 0,
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "runtimeCaptureCompleted": true,
    "selectedEvidenceStrength": "missing",
    "selectedEvidenceArtifactId": "coverage_policy",
    "embeddedContentObservationCount": 0
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Policies & disclosures

12 checks · 5 limited

Limited

JSON evidence

Policy source

Captured page title: Privacy Policy – Hugging Face — https://huggingface.co/privacy

Document heading: Hugging Face Privacy Policy

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:36:58.534Z.

Section: Not retained; effective date: March 28, 2023; update text: Effective Date: March 28, 2023.

Open policy source

Policy URL: https://huggingface.co/privacy

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "privacy_notice_availability",
  "coverageArea": "Privacy notice link/surface discovered",
  "evidenceState": "observed",
  "explanation": "Whether a reachable privacy notice or privacy policy link/surface was retained. This row does not by itself confirm that substantive notice content was available.",
  "note": "Whether a reachable privacy notice or privacy policy link/surface was retained. This row does not by itself confirm that substantive notice content was available.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.privacy_notice_availability.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.privacy_notice_availability"
  },
  "statusBasis": "Privacy notice evidence was retained in public policy-surface evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: privacy policy surface retained",
      "Policy URL: https://huggingface.co/privacy"
    ],
    "signalObserved": true,
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://huggingface.co/privacy",
      "policyTitle": "Privacy Policy – Hugging Face",
      "artifactRefs": [
        "policy_excerpt_6ae2f3f0_b2dce9c4",
        "policy_surface_text_6ae2f3f0_a5512975"
      ],
      "effectiveDate": "March 28, 2023",
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "Hugging Face Privacy Policy",
      "lastUpdatedText": "Effective Date: March 28, 2023",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:36:58.534Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "Hugging Face",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "policySurfaceSummary": {
      "scanStartedAt": "2026-10-12T19:36:49.191Z",
      "observedTopics": [
        "cookies",
        "advertising",
        "sale_or_share",
        "third_party_disclosures",
        "vendor_list",
        "consent_withdrawal",
        "data_retention",
        "controller_contact",
        "processing_purposes",
        "legal_basis",
        "recipients_or_vendor_categories",
        "data_subject_rights",
        "international_transfers",
        "contact_privacy"
      ],
      "cookiePolicyUrls": [],
      "cookieDisclosures": [],
      "mentionedControls": [
        "consent_withdrawal"
      ],
      "privacyPolicySize": {
        "url": "https://huggingface.co/privacy",
        "completeness": "complete",
        "documentFormat": "text",
        "compressedBytes": 108890,
        "measurementScope": "selected_usable_privacy_policy",
        "decompressedBytes": 108890
      },
      "privacyPolicyUrls": [
        "https://huggingface.co/privacy"
      ],
      "cookie_disclosures": [],
      "policySectionCount": 18,
      "policySurfaceCount": 2,
      "cookiePolicyPresent": false,
      "scannedPageLanguage": "en",
      "privacyPolicyPresent": true,
      "policyPrimaryLanguage": "en",
      "policyLastUpdatedTexts": [
        "Effective Date: March 28, 2023",
        "Effective Date: September 15, 2022"
      ],
      "policyTextCoverageMode": "section_targeted",
      "retainedPolicySections": [
        {
          "charEnd": 31140,
          "heading": "Hugging Face Privacy Policy",
          "quality": "strong",
          "charStart": 3728,
          "sourceUrl": "https://huggingface.co/privacy",
          "textExcerpt": "🗓 Effective Date: March 28, 2023 We have implemented this Privacy Policy because your privacy is important to us. This Privacy Policy (the “Policy”) describes the type of information that Hugging Face, Inc. (the “Company”) gathers from users of the Hugging Face services (the “Services”), and how the Company uses that information. The Policy is part of the Company Terms of Use. The Policy applies to all users of the Services (“Users”). The Company occasionally collects Personal Information from Users. “Personal Information” means any information that can, alone or associated with other information, be used to identify an individual, for instance by reference of a name, a username, an email address, an IP address, a photograph or others. By using the Services, you consent to the terms of the Policy and to our processing of Personal Information in the manner and for the purposes set forth herein. If you do not agree with the Policy, please do not use the Services. The Company reserves the right, at its sole discretion, to change the Policy at any time, which change will be effective 10 days following posting the revision to the Policy on the Hugging Face website (the “Website”)."
        },
        {
          "charEnd": 11511,
          "heading": "E. “Do Not Track”",
          "quality": "strong",
          "charStart": 9886,
          "sourceUrl": "https://huggingface.co/privacy",
          "textExcerpt": "On September 27, 2013, California enacted A.B. 370, amending the California Online Privacy Protection Act to require website operators to disclose how they respond to \"Do Not Track Signals\"; and whether third parties collect personally identifiable information about users when they use online services. The Company honors \"do not track\" signals and does not track, use cookies, or use advertising when a “do not track” mechanism is in place. The Company does not authorize the collection of personally identifiable information from our users for third party use through advertising technologies without separate member consent. California Civil Code Section 1798.83 also permits customers who are California residents to request certain information regarding Our disclosure of Personal Information to third parties for direct marketing purposes. To make such a request, please send an email to [email protected] . Please note that the Company is only required to respond to one request per customer each year."
        },
        {
          "charEnd": 13850,
          "heading": "Purposes of the use of Information",
          "quality": "strong",
          "charStart": 11837,
          "sourceUrl": "https://huggingface.co/privacy",
          "textExcerpt": "The Company may use information from Users for the following purposes: to deliver the Services, which may include the creation of Your account, the display of Your profile or Your content, or if applicable the upgrading of Your account to a paid account, to operate and improve the Services by providing you with more effective customer service, making the Services easier to use by eliminating the need for you to enter the same information repeatedly; performing research and analysis aimed at improving the Services, or other products and technologies of the Company; automatically updating the Services; diagnosing or fixing problems with the Services, to conduct analysis or research on the Services or any topics related to it, for business operations or scientific purposes, to communicate with you, especially through the sending of welcome emails, information on technical service issues, security announcements, information of new services available, legal notices, response to your requests, or any other information that we think might interest or be relevant to you, to ensure and maintain security on our Services or Website, which may include detecting, preventing, investigating or"
        },
        {
          "charEnd": 15487,
          "heading": "B. Grounds for the use of Information",
          "quality": "strong",
          "charStart": 13850,
          "sourceUrl": "https://huggingface.co/privacy",
          "textExcerpt": "Pursuant to applicable data protection laws, and especially the European Union’s General Data Protection Regulation (EU) 2016/679 (the “GDPR”), Hugging Face remains under an obligation to notify the Users about the legal basis on which their Personal Information is processed. Consent By creating an account on the Website and by using the Services, you consent to disclose information, some of which might be personal, and to our processing of such Personal Information in the manner and for the purposes set forth in this Policy. Agreement If you or your organization enter into an agreement with Hugging Face, either by simply using the Services and abiding by the terms and conditions available on the Website, or by executing another separate agreement, you also consent to our processing of your Personal Information as pursuant the obligations of such an agreement. Legitimate Interests Apart from the above cases, Hugging Face will use the information collected from you to pursue legitimate interests such as legal or regulatory compliance, security control, business operations, scientific research, or any other interest reasonably held as legitimate."
        },
        {
          "charEnd": 20318,
          "heading": "3. SHARING OF INFORMATION",
          "quality": "strong",
          "charStart": 15487,
          "sourceUrl": "https://huggingface.co/privacy",
          "textExcerpt": "The Company will not sell, rent or lease your Personal Information except as provided for by this Policy. The Company may also share other information as provided by this Policy. A. Affiliates The Company may share User Information and Personal information collected by the Services with businesses that are legally part of the same group as the Company, or that become part of that group in the event of a change of control, merger, acquisition or sale (“Affiliates”). B. Third Party Service Providers The Company may occasionally hire other companies to provide limited services on its behalf, such as providing customer support, hosting websites, processing transactions, or performing statistical analysis of its Services. Those companies will be permitted to obtain only the Personal Information they need to deliver the relevant service. They will be required to maintain the confidentiality of the information and are prohibited from using it for any other purpose. Please refer to the list of Third Party Service Providers below. C. With your consent At any time during your use of the Services, or upon explicit request from us, you may consent to the disclosure of your information. D."
        },
        {
          "charEnd": 16597,
          "heading": "A. Affiliates",
          "quality": "strong",
          "charStart": 16011,
          "sourceUrl": "https://huggingface.co/privacy",
          "textExcerpt": "The Company may share User Information and Personal information collected by the Services with businesses that are legally part of the same group as the Company, or that become part of that group in the event of a change of control, merger, acquisition or sale (“Affiliates”)."
        },
        {
          "charEnd": 17498,
          "heading": "B. Third Party Service Providers",
          "quality": "strong",
          "charStart": 16597,
          "sourceUrl": "https://huggingface.co/privacy",
          "textExcerpt": "The Company may occasionally hire other companies to provide limited services on its behalf, such as providing customer support, hosting websites, processing transactions, or performing statistical analysis of its Services. Those companies will be permitted to obtain only the Personal Information they need to deliver the relevant service. They will be required to maintain the confidentiality of the information and are prohibited from using it for any other purpose. Please refer to the list of Third Party Service Providers below."
        },
        {
          "charEnd": 20318,
          "heading": "G. Anonymous Information",
          "quality": "strong",
          "charStart": 19407,
          "sourceUrl": "https://huggingface.co/privacy",
          "textExcerpt": "The Company may use Anonymous Information (as defined below) or disclose it to third party service providers, to provide and improve the Services and other products or technologies of the Company. The Company may disclose Anonymous Information (with or without compensation) to third parties, including advertisers and partners, for purposes including, but not limited to, targeting advertisements. \"Anonymous Information\" means information which does not enable identification of an individual User, such as aggregated information about use of the Services."
        },
        {
          "charEnd": 22839,
          "heading": "4. YOUR RIGHTS",
          "quality": "strong",
          "charStart": 20318,
          "sourceUrl": "https://huggingface.co/privacy",
          "textExcerpt": "A. Access your Information You may be entitled under data protection laws to access and review Personal Information the Company holds related to you. You may access, modify or delete the Information we collected by editing your profile or controlling the content that you share at any time. If you have any other request, all such communications regarding access to Personal Information should be addressed to: [email protected] . Such inquiries should be clearly marked as data protection queries and you should indicate if the request is time sensitive. B. Data retention We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests. You may decide to cancel your account and your content at any time by editing your profile. If you wish to request the erasure of all of your Personal Information that we process, you may do so by sending a written request to [email protected] ."
        },
        {
          "charEnd": 21778,
          "heading": "A. Access your Information",
          "quality": "strong",
          "charStart": 20623,
          "sourceUrl": "https://huggingface.co/privacy",
          "textExcerpt": "You may be entitled under data protection laws to access and review Personal Information the Company holds related to you. You may access, modify or delete the Information we collected by editing your profile or controlling the content that you share at any time. If you have any other request, all such communications regarding access to Personal Information should be addressed to: [email protected] . Such inquiries should be clearly marked as data protection queries and you should indicate if the request is time sensitive."
        },
        {
          "charEnd": 22839,
          "heading": "B. Data retention",
          "quality": "strong",
          "charStart": 21778,
          "sourceUrl": "https://huggingface.co/privacy",
          "textExcerpt": "We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests. You may decide to cancel your account and your content at any time by editing your profile. If you wish to request the erasure of all of your Personal Information that we process, you may do so by sending a written request to [email protected] ."
        },
        {
          "charEnd": 26440,
          "heading": "6. LOCATION OF PROCESSING AND DATA TRANSFERS",
          "quality": "strong",
          "charStart": 24682,
          "sourceUrl": "https://huggingface.co/privacy",
          "textExcerpt": "The Company and its servers are located in the United States. Personal Information collected by the Services may be stored and processed in the United States or any other country in which the Company or its affiliates, subsidiaries or agents maintain facilities. By using the Services, you consent to any such transfer of information outside of your country. The Company may transfer your Personal Information to affiliated companies for the purpose of storing or processing such information on its behalf. Such information may be transferred to other countries around the world. The Company requires that these parties agree to process such information in compliance with the Policy. In particular, if you provide Personal Information, it may be transferred to and processed on computers in the U.S. and other countries. We strive to take appropriate safeguards to ensure that your Personal Information will remain protected in a manner consistent with standard applicable data protection laws. If you have any other question, please contact the Company at: [email protected] ."
        },
        {
          "charEnd": 27640,
          "heading": "7. CHILDREN’S PRIVACY",
          "quality": "strong",
          "charStart": 26440,
          "sourceUrl": "https://huggingface.co/privacy",
          "textExcerpt": "The Services are neither directed to nor structured to attract children under the age of 13 years. Accordingly, the Company does not intend to collect Personal Information from anyone it knows to be under 13 years of age. The Company will direct potential users under 13 years of age not to use the Services. If the Company learns that Personal Information of persons less than 13 years of age has been collected without verifiable parental consent, the Company will take the appropriate steps to delete this information. To make such a request, please contact the Company at: [email protected] ."
        },
        {
          "charEnd": 29714,
          "heading": "9. CONTACT US",
          "quality": "strong",
          "charStart": 28528,
          "sourceUrl": "https://huggingface.co/privacy",
          "textExcerpt": "If you have questions about this Policy, please contact [email protected] . The main establishment in the European Union is Hugging Face, SAS, a French société par actions simplifiée à associé unique registered in the Paris Trade and Companies Register under the number 822 168 043, and whose headquarters are located on 9 rue des Colonnes, 75002 Paris, France. The designation of this main establishment in the European Union gives full authority to the French Data Protection Agency, la Commission Nationale de l'Informatique et des Libertés (CNIL) per the General Data Protection Regulation (GDPR)."
        },
        {
          "charEnd": 31140,
          "heading": "10. LIST OF THIRD-PARTY SERVICE PROVIDERS",
          "quality": "strong",
          "charStart": 29714,
          "sourceUrl": "https://huggingface.co/privacy",
          "textExcerpt": "We may share your information with Third-Party Service Providers, and when we do, we ensure that they access your information in compliance with applicable data protection laws. The following list respects the format Subprocessor | Description of Subprocessing | Location of Subprocessing . Discourse | Forum | United States AWS SES | Emails | United States Amazon Web Services, Inc. | Hosting/Infrastructure | United States Metronome | Billing | United States Stripe | Payment | United States MongoDB Atlas | Hosting/Infrastructure | United States Google Cloud Platform | Hosting/Infrastructure | United States/EMEA GitHub | Hosting code | United States OVHCloud | Hosting/Infrastructure | France Slack Technologies | Communication | United States Hugging Face SAS | All of the above | France"
        },
        {
          "charEnd": 13458,
          "heading": "Policy section",
          "quality": "strong",
          "charStart": 12592,
          "sourceUrl": "https://huggingface.co/privacy",
          "textExcerpt": "6. LOCATION OF PROCESSING AND DATA TRANSFERS The Company and its servers are located in the United States. Personal Information collected by the Services may be stored and processed in the United States or any other country in which the Company or its affiliates, subsidiaries or agents maintain facilities. By using the Services, you consent to any such transfer of information outside of your country. The Company may transfer your Personal Information to affiliated companies for the purpose of storing or processing such information on its behalf. Such information may be transferred to other countries around the world. The Company requires that these parties agree to process such information in compliance with the Policy. In particular, if you provide Personal Information, it may be transferred to and processed on computers in the U.S. and other countries."
        },
        {
          "charEnd": 11675,
          "heading": "Policy section",
          "quality": "strong",
          "charStart": 10825,
          "sourceUrl": "https://huggingface.co/privacy",
          "textExcerpt": "B. Data retention We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests. You may decide to cancel your account and your content at any time by editing your profile. If you wish to request the erasure of all of your Personal Information that we process, you may do so by sending a written request to [email protected] . 5. DATA SECURITY The security of your Personal Information is important to us. The Company follows generally accepted industry standards, including the use of appropriate administrative, physical and technical safeguards, to protect Personal Information. However, no method of transmission over the Internet, or method of electronic storage, is fully secure."
        },
        {
          "charEnd": 11395,
          "heading": "Policy section",
          "quality": "strong",
          "charStart": 10555,
          "sourceUrl": "https://huggingface.co/privacy",
          "textExcerpt": "If you have any other request, all such communications regarding access to Personal Information should be addressed to: [email protected] . Such inquiries should be clearly marked as data protection queries and you should indicate if the request is time sensitive. B. Data retention We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests. You may decide to cancel your account and your content at any time by editing your profile. If you wish to request the erasure of all of your Personal Information that we process, you may do so by sending a written request to [email protected] . 5. DATA SECURITY The security of your Personal Information is important to us."
        }
      ],
      "cookieDisclosurePresent": true,
      "policyCookieDisclosures": [],
      "privacyPolicyDiscovered": true,
      "processingErrorObserved": false,
      "observedPolicyTopicHints": [
        "cookies",
        "advertising",
        "sale_or_share",
        "third_party_disclosures",
        "vendor_list",
        "consent_withdrawal",
        "data_retention",
        "controller_contact",
        "processing_purposes",
        "legal_basis",
        "recipients_or_vendor_categories",
        "data_subject_rights",
        "international_transfers",
        "contact_privacy"
      ],
      "policyDocumentProvenance": [
        {
          "sourceUrl": "https://huggingface.co/privacy",
          "policyTitle": "Privacy Policy – Hugging Face",
          "artifactRefs": [
            "policy_excerpt_6ae2f3f0_b2dce9c4",
            "policy_surface_text_6ae2f3f0_a5512975"
          ],
          "effectiveDate": "March 28, 2023",
          "observationId": "policy_surface_6ae2f3f0",
          "discoveryMethod": "footer_link",
          "documentHeading": "Hugging Face Privacy Policy",
          "lastUpdatedText": "Effective Date: March 28, 2023",
          "detectedLanguage": "en",
          "retrievalTimestamp": "2026-10-12T19:36:58.534Z",
          "targetRelationship": "target_controller",
          "translationApplied": false,
          "documentOwnerEntity": "Hugging Face",
          "ownershipConfidence": 0.98,
          "translationTargetLanguage": null,
          "directlyLinkedFromScannedPage": true
        }
      ],
      "policy_cookie_disclosures": [],
      "article13DisclosureSignals": [
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.9,
          "surfaceUrl": "https://huggingface.co/privacy",
          "evidenceText": "to keep your information private and control the access to it, you understand that only the users that you authorize will view this information. The Company also reserves the right to access this information with your consent, or without your consent only for the purposes of pursuing legitimate interests such as",
          "disclosureType": "data_subject_rights",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://huggingface.co/privacy",
          "supportingContactContext": null,
          "selectedPolicySectionExcerpt": "... Your continued use of the Services 10 days following such posting means you accept those changes. 1. INFORMATION WE COLLECT The Company collects the following information, some of which might be Personal Information. A. Information you provide directly The Company collects information directly provided by Users as part of using the Services, such as: information provided as part of setting up an account on the Website: email address, password, username, full name, and other optional information such as an avatar, your interests, or usernames to your third-party social networks, payment information provided, if you decide to upgrade your user or organization account: credit card information, other information and materials that you decide to post on the Website (e.g., the discussion forum, or other), communications between you and the Company, as part of using the Services. At any time during your use of the Services, you may decide to share some information or content publicly or privately. If you decide to share your information or content publicly, and if you decide to include Personal Information, you understand that anyone may view this information. If you decide to keep your information private and control the access to it, you understand that only the users that you authorize will view this information. The Company also reserves the right to access this information with your consent, or without your consent only for the purposes of pursuing legitimate interests such as maintaining security on its Services or complying with any legal or regulatory obligations. B. Information we collect from third parties We may collect Information from third parties that help us deliver the Services or process information. C. Information we automatically collect from your use of the Services The Company automatically records information from your use of the Services such as: information about your Use of the Services, your session (date, location), your IP address, information from cookies, especially your login information, your preferences, information about your device: type, model, version, operating system, browser D. ...",
          "selectedPolicySectionHeading": "Policy text context"
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.86,
          "surfaceUrl": "https://huggingface.co/privacy",
          "matchedTerm": "personal-data retention period or criterion",
          "evidenceText": "We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests.",
          "matchStrength": "equivalent",
          "matchedLocale": "en",
          "disclosureType": "data_retention",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_data_retention",
            "match_strength_equivalent",
            "variant_semantic_clause"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://huggingface.co/privacy",
          "selectedPolicySectionExcerpt": "We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests.",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.86,
          "surfaceUrl": "https://huggingface.co/privacy",
          "matchedTerm": "international or cross-border transfer disclosure",
          "evidenceText": "Such information may be transferred to other countries around the world.",
          "matchStrength": "equivalent",
          "matchedLocale": "en",
          "disclosureType": "international_transfers",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_international_transfers",
            "match_strength_equivalent",
            "variant_semantic_clause"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://huggingface.co/privacy",
          "selectedPolicySectionExcerpt": "Such information may be transferred to other countries around the world.",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.9,
          "surfaceUrl": "https://huggingface.co/privacy",
          "evidenceText": "9. CONTACT US If you have questions about this Policy, please contact [email protected] . The main establishment in the European Union is Hugging Face, SAS, a French société par actions simplifiée à associé unique registered in the Paris Trade and Companies Register under the number 822 168 043, and whose headquarters are located on 9 rue des Colonnes, 75002 Paris, France. The designation of this main establishment in the European Union gives full authority to the French Data Protection Agency, la Commission Nationale de l'Informatique et des Libertés (CNIL) per the General Data Protection Regulation (GDPR).",
          "disclosureType": "controller_contact",
          "evidenceSource": "deterministic",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://huggingface.co/privacy",
          "supportingContactContext": null,
          "selectedPolicySectionExcerpt": "9. CONTACT US If you have questions about this Policy, please contact [email protected] . The main establishment in the European Union is Hugging Face, SAS, a French société par actions simplifiée à associé unique registered in the Paris Trade and Companies Register under the number 822 168 043, and whose headquarters are located on 9 rue des Colonnes, 75002 Paris, France. The designation of this main establishment in the European Union gives full authority to the French Data Protection Agency, la Commission Nationale de l'Informatique et des Libertés (CNIL) per the General Data Protection Regulation (GDPR).",
          "selectedPolicySectionHeading": "9. CONTACT US"
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.88,
          "surfaceUrl": "https://huggingface.co/privacy",
          "evidenceText": "The Company may use information from Users for the following purposes: to deliver the Services, which may include the creation of Your account, the display of Your profile or Your content, or if applicable the upgrading of Your account to a paid account, to operate and improve the Services by providing you with more effective customer service, making the Services easier to use by eliminating the need for you to enter the same information repeatedly; performing research and analysis aimed at improving the Services, or other products and technologies of the Company; automatically updating the Services; diagnosing or fixing problems",
          "disclosureType": "processing_purposes",
          "evidenceSource": "deterministic",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://huggingface.co/privacy",
          "supportingContactContext": null,
          "selectedPolicySectionExcerpt": "The Company may use information from Users for the following purposes: to deliver the Services, which may include the creation of Your account, the display of Your profile or Your content, or if applicable the upgrading of Your account to a paid account, to operate and improve the Services by providing you with more effective customer service, making the Services easier to use by eliminating the need for you to enter the same information repeatedly; performing research and analysis aimed at improving the Services, or other products and technologies of the Company; automatically updating the Services; diagnosing or fixing problems with the Services, to conduct analysis or research on the Services or any topics related to it, for business operations or scientific purposes, to communicate with you, especially through the sending of welcome emails, information on technical service issues, security announcements, information of new services available, legal notices, response to your requests, or any other information that we think might interest or be relevant to you, to ensure and maintain security on our Services or Website, which may include detecting, preventing, investigating or",
          "selectedPolicySectionHeading": "Purposes of the use of Information"
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.86,
          "surfaceUrl": "https://huggingface.co/privacy",
          "matchedTerm": "processing legal-basis clause",
          "evidenceText": "Pursuant to applicable data protection laws, and especially the European Union’s General Data Protection Regulation (EU) 2016/679 (the “GDPR”), Hugging Face remains under an obligation to notify the Users about the legal basis on which their Personal Information is processed.",
          "matchStrength": "equivalent",
          "matchedLocale": "en",
          "disclosureType": "legal_basis",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_legal_basis",
            "match_strength_equivalent",
            "variant_semantic_clause"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://huggingface.co/privacy",
          "selectedPolicySectionExcerpt": "Pursuant to applicable data protection laws, and especially the European Union’s General Data Protection Regulation (EU) 2016/679 (the “GDPR”), Hugging Face remains under an obligation to notify the Users about the legal basis on which their Personal Information is processed.",
          "selectedPolicySectionHeading": "B. Grounds for the use of Information",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.86,
          "surfaceUrl": "https://huggingface.co/privacy",
          "matchedTerm": "named recipient or meaningful recipient category",
          "evidenceText": "Affiliates The Company may share User Information and Personal information collected by the Services with businesses that are legally part of the same group as the Company, or that become part of that group in the event of a change of control, merger, acquisition or sale (“Affiliates”).",
          "matchStrength": "equivalent",
          "matchedLocale": "en",
          "disclosureType": "recipients_or_vendor_categories",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_recipients_or_vendor_categories",
            "match_strength_equivalent",
            "variant_semantic_clause"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://huggingface.co/privacy",
          "selectedPolicySectionExcerpt": "Affiliates The Company may share User Information and Personal information collected by the Services with businesses that are legally part of the same group as the Company, or that become part of that group in the event of a change of control, merger, acquisition or sale (“Affiliates”).",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.86,
          "surfaceUrl": "https://huggingface.co/privacy",
          "matchedTerm": "enumerated data-subject rights disclosure",
          "evidenceText": "If you have any other request, all such communications regarding access to Personal Information should be addressed to: [email protected] . Such inquiries should be clearly marked as data protection queries and you should indicate if the request is time sensitive. B.",
          "matchStrength": "equivalent",
          "matchedLocale": "en",
          "disclosureType": "data_subject_rights",
          "evidenceSource": "gdpr_transparency_topic_candidate",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_data_subject_rights",
            "match_strength_equivalent",
            "variant_semantic_clause"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://huggingface.co/privacy",
          "selectedPolicySectionExcerpt": "If you have any other request, all such communications regarding access to Personal Information should be addressed to: [email protected] . Such inquiries should be clearly marked as data protection queries and you should indicate if the request is time sensitive. B.",
          "selectedPolicySectionHeading": "4. YOUR RIGHTS",
          "sourceCandidateProductionCredit": false
        }
      ],
      "policyTextExtractionHealth": {
        "policyUrls": [
          "https://huggingface.co/privacy"
        ],
        "nanoInvoked": false,
        "contractVersion": "certscore.policy-text-extraction-health.v2",
        "policyTextQuality": {
          "usable": true,
          "codeSignalCount": 0,
          "codeSymbolRatio": 0.0002447231569287244,
          "policyTermCount": 14,
          "alphabeticWordRatio": 0.7939897192566232,
          "accessChallengeSignalCount": 0,
          "naturalLanguageSentenceCount": 91
        },
        "policyUrlRetained": true,
        "extractedTextLength": 16345,
        "policySurfaceObserved": true,
        "detectedPolicyLanguage": "en",
        "minimumTextLengthRequired": 500,
        "policyTextExtractionStatus": "ok",
        "verifiedPolicyDocumentCount": 1,
        "detectedPolicyLanguageSource": "policy_surface",
        "supportedGdprTransparencyLocales": [
          "en",
          "de",
          "fr",
          "es",
          "it",
          "nl",
          "pl",
          "pt",
          "ru",
          "ja",
          "zh",
          "ar",
          "sv",
          "ro",
          "cs",
          "el",
          "hu",
          "da",
          "fi",
          "sk",
          "bg",
          "hr",
          "nb",
          "sl",
          "lt",
          "lv",
          "et",
          "uk",
          "tr",
          "fa",
          "vi",
          "id",
          "ko",
          "th",
          "he",
          "sr",
          "ca",
          "hi",
          "az",
          "gl"
        ],
        "gdprTransparencyLanguageSupported": true,
        "policyTextEvidenceProjectionStatus": "verified_complete",
        "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
      },
      "privacyPolicyEvidencePaths": [],
      "discoveredPrivacyPolicyUrls": [
        "https://huggingface.co/privacy"
      ],
      "article13CoverageAssessments": [
        {
          "topic": "automated_decision_making_or_profiling",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "controller_contact",
          "status": "observed",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "data_retention",
          "status": "observed",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "data_subject_rights",
          "status": "observed",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "dpo_contact",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "international_transfers",
          "status": "observed",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "legal_basis",
          "status": "observed",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "processing_purposes",
          "status": "observed",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "recipients_or_vendor_categories",
          "status": "observed",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "supervisory_authority",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        }
      ],
      "dedicatedCookiePolicyPresent": false,
      "policyTextEvidenceProjection": {
        "scanId": "cfe74173-c90a-48a7-859d-740b6c823180",
        "documents": [
          {
            "finalUrl": "https://huggingface.co/privacy",
            "artifactId": "policy_surface_text_6ae2f3f0_a5512975",
            "artifactUri": "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/cfe74173-c90a-48a7-859d-740b6c823180/auxiliary/policy_surface_text_6ae2f3f0_a5512975.txt",
            "contentType": "text/html; charset=utf-8",
            "documentRole": "policy_document",
            "requestedUrl": "/privacy",
            "observationId": "policy_surface_6ae2f3f0",
            "redirectChain": [
              "https://huggingface.co/privacy"
            ],
            "artifactSha256": "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18",
            "documentFormat": "text",
            "limitationKeys": [
              "policy_section_inventory_bounded",
              "policy_section_text_bounded"
            ],
            "contentCoverage": {
              "status": "truncated",
              "limitationKeys": [
                "policy_section_inventory_bounded",
                "policy_section_text_bounded"
              ],
              "sourceTextChars": 16345,
              "retainedSectionCount": 18,
              "extractedSectionCount": 31,
              "retainedTableRowCount": 0
            },
            "artifactFileName": "policy_surface_text_6ae2f3f0_a5512975.txt",
            "extractionStatus": "complete",
            "artifactSizeBytes": 16397,
            "retainedTextChars": 16345,
            "documentFetchState": "fetched",
            "retainedTextSha256": "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18",
            "targetRelationship": "target_controller",
            "documentOwnerEntity": "Hugging Face",
            "ownershipConfidence": 0.98,
            "documentTextCoverage": {
              "status": "complete",
              "limitationKeys": [],
              "sourceTextChars": 16345,
              "retainedTextChars": 16345
            },
            "documentEvaluationState": "usable",
            "documentRoleReasonCodes": [
              "multiple_substantive_disclosure_signals_retained"
            ],
            "governingPolicySelection": {
              "rank": 1,
              "score": 85,
              "state": "primary",
              "reasonCodes": [
                "highest_ranked_eligible_governing_policy",
                "target_controller_document",
                "policy_content_coverage_truncated",
                "complete_policy_text_retention",
                "multiple_substantive_disclosure_signals_retained"
              ],
              "contractVersion": "governing_policy_selection.v1"
            },
            "artifactVerificationStatus": "verified",
            "gdprTransparencyTopicCoverageDiagnostics": [
              {
                "topic": "controller_contact",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "bd416db7f137a6e2da1f1e964d86fc330cc40a857345b8773e9c905ec609c5e8",
                "evidenceSectionSha256": "2eee5588c6715ebcb1ac034d436c729c59a9d1c37a25f6a42f281fe7a4a16d18",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "processing_purposes",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "bd416db7f137a6e2da1f1e964d86fc330cc40a857345b8773e9c905ec609c5e8",
                "evidenceSectionSha256": "64f8fce64d3fe1d99f70613a81034c2126ce280df31ed5f89e77ece707a981ea",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "legal_basis",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "bd416db7f137a6e2da1f1e964d86fc330cc40a857345b8773e9c905ec609c5e8",
                "evidenceSectionSha256": "5370944a335c232630743963a3b3f90a175e47002aa22b5e45473cc3f448f6e4",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "recipients_or_vendor_categories",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "bd416db7f137a6e2da1f1e964d86fc330cc40a857345b8773e9c905ec609c5e8",
                "evidenceSectionSha256": "70158e2145a258474c41290841f419d4707e8e28b173c8ae120dfe0bb345bb96",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "data_retention",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "bd416db7f137a6e2da1f1e964d86fc330cc40a857345b8773e9c905ec609c5e8",
                "evidenceSectionSha256": "9cf57134f312b87376085169985ab400570e417f9896093923d1a0c158d5ae30",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "data_subject_rights",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "international_transfers",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "bd416db7f137a6e2da1f1e964d86fc330cc40a857345b8773e9c905ec609c5e8",
                "evidenceSectionSha256": "4fb3f767844f3eab16466dd04dfed6511bc8af6ddeeb8e019421856a9e865742",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "dpo_contact",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "supervisory_authority",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "automated_decision_making_or_profiling",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              }
            ]
          }
        ],
        "generatedAt": "2026-10-12T19:37:02.160Z",
        "sourceBundle": {
          "uri": "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/cfe74173-c90a-48a7-859d-740b6c823180/CanonicalEvidenceBundle.json",
          "sha256": "875403917c8e47e410cdeec75bb9e069d95bc52d09ef04bfd813aa5da018a500",
          "sizeBytes": 658321,
          "schemaVersion": "certscore.v2.alpha.1",
          "verificationStatus": "verified"
        },
        "limitationKeys": [
          "policy_section_inventory_bounded",
          "policy_section_text_bounded"
        ],
        "contractVersion": "certscore.policy-text-evidence-projection.v1",
        "projectionStatus": "verified_complete"
      },
      "privacyPolicyEvaluationState": "fetched_usable",
      "legalFrameworkValidityMatches": [],
      "missingExpectedPolicySections": [
        "Your privacy controls",
        "Exporting and deleting your information",
        "Retaining your information",
        "Compliance and cooperation with regulators",
        "European requirements"
      ],
      "policy_text_extraction_health": {
        "policyUrls": [
          "https://huggingface.co/privacy"
        ],
        "nanoInvoked": false,
        "contractVersion": "certscore.policy-text-extraction-health.v2",
        "policyTextQuality": {
          "usable": true,
          "codeSignalCount": 0,
          "codeSymbolRatio": 0.0002447231569287244,
          "policyTermCount": 14,
          "alphabeticWordRatio": 0.7939897192566232,
          "accessChallengeSignalCount": 0,
          "naturalLanguageSentenceCount": 91
        },
        "policyUrlRetained": true,
        "extractedTextLength": 16345,
        "policySurfaceObserved": true,
        "detectedPolicyLanguage": "en",
        "minimumTextLengthRequired": 500,
        "policyTextExtractionStatus": "ok",
        "verifiedPolicyDocumentCount": 1,
        "detectedPolicyLanguageSource": "policy_surface",
        "supportedGdprTransparencyLocales": [
          "en",
          "de",
          "fr",
          "es",
          "it",
          "nl",
          "pl",
          "pt",
          "ru",
          "ja",
          "zh",
          "ar",
          "sv",
          "ro",
          "cs",
          "el",
          "hu",
          "da",
          "fi",
          "sk",
          "bg",
          "hr",
          "nb",
          "sl",
          "lt",
          "lv",
          "et",
          "uk",
          "tr",
          "fa",
          "vi",
          "id",
          "ko",
          "th",
          "he",
          "sr",
          "ca",
          "hi",
          "az",
          "gl"
        ],
        "gdprTransparencyLanguageSupported": true,
        "policyTextEvidenceProjectionStatus": "verified_complete",
        "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
      },
      "retainedPolicySectionHeadings": [
        "Hugging Face Privacy Policy",
        "E. “Do Not Track”",
        "Purposes of the use of Information",
        "B. Grounds for the use of Information",
        "3. SHARING OF INFORMATION",
        "A. Affiliates",
        "B. Third Party Service Providers",
        "G. Anonymous Information",
        "4. YOUR RIGHTS",
        "A. Access your Information",
        "B. Data retention",
        "6. LOCATION OF PROCESSING AND DATA TRANSFERS",
        "7. CHILDREN’S PRIVACY",
        "9. CONTACT US",
        "10. LIST OF THIRD-PARTY SERVICE PROVIDERS",
        "Policy section"
      ],
      "selectedPrivacyPolicyDocument": {
        "documentUrl": "https://huggingface.co/privacy",
        "observationId": "policy_surface_6ae2f3f0",
        "traversalDepth": 0,
        "parentSurfaceUrl": null,
        "parentObservationId": null,
        "selectionReasonCodes": []
      },
      "article13_coverage_assessments": [
        {
          "topic": "automated_decision_making_or_profiling",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "controller_contact",
          "status": "observed",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "data_retention",
          "status": "observed",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "data_subject_rights",
          "status": "observed",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "dpo_contact",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "international_transfers",
          "status": "observed",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "legal_basis",
          "status": "observed",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "processing_purposes",
          "status": "observed",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "recipients_or_vendor_categories",
          "status": "observed",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "supervisory_authority",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://huggingface.co/privacy"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_6ae2f3f0"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        }
      ],
      "discoveredPrivacyPolicyDetails": [
        {
          "url": "https://huggingface.co/privacy",
          "status": "fetched",
          "documentFetchState": "fetched",
          "fetchFailureReason": null,
          "linkObservationState": "observed",
          "documentEvaluationState": "usable"
        }
      ],
      "article13DisclosureTypesPartial": [],
      "discoveredPrivacyPolicyStatuses": [
        "fetched"
      ],
      "gdprTransparencyEvidenceProfile": "gdpr_transparency_multilingual_article13_v1",
      "policy_text_evidence_projection": {
        "scanId": "cfe74173-c90a-48a7-859d-740b6c823180",
        "documents": [
          {
            "finalUrl": "https://huggingface.co/privacy",
            "artifactId": "policy_surface_text_6ae2f3f0_a5512975",
            "artifactUri": "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/cfe74173-c90a-48a7-859d-740b6c823180/auxiliary/policy_surface_text_6ae2f3f0_a5512975.txt",
            "contentType": "text/html; charset=utf-8",
            "documentRole": "policy_document",
            "requestedUrl": "/privacy",
            "observationId": "policy_surface_6ae2f3f0",
            "redirectChain": [
              "https://huggingface.co/privacy"
            ],
            "artifactSha256": "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18",
            "documentFormat": "text",
            "limitationKeys": [
              "policy_section_inventory_bounded",
              "policy_section_text_bounded"
            ],
            "contentCoverage": {
              "status": "truncated",
              "limitationKeys": [
                "policy_section_inventory_bounded",
                "policy_section_text_bounded"
              ],
              "sourceTextChars": 16345,
              "retainedSectionCount": 18,
              "extractedSectionCount": 31,
              "retainedTableRowCount": 0
            },
            "artifactFileName": "policy_surface_text_6ae2f3f0_a5512975.txt",
            "extractionStatus": "complete",
            "artifactSizeBytes": 16397,
            "retainedTextChars": 16345,
            "documentFetchState": "fetched",
            "retainedTextSha256": "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18",
            "targetRelationship": "target_controller",
            "documentOwnerEntity": "Hugging Face",
            "ownershipConfidence": 0.98,
            "documentTextCoverage": {
              "status": "complete",
              "limitationKeys": [],
              "sourceTextChars": 16345,
              "retainedTextChars": 16345
            },
            "documentEvaluationState": "usable",
            "documentRoleReasonCodes": [
              "multiple_substantive_disclosure_signals_retained"
            ],
            "governingPolicySelection": {
              "rank": 1,
              "score": 85,
              "state": "primary",
              "reasonCodes": [
                "highest_ranked_eligible_governing_policy",
                "target_controller_document",
                "policy_content_coverage_truncated",
                "complete_policy_text_retention",
                "multiple_substantive_disclosure_signals_retained"
              ],
              "contractVersion": "governing_policy_selection.v1"
            },
            "artifactVerificationStatus": "verified",
            "gdprTransparencyTopicCoverageDiagnostics": [
              {
                "topic": "controller_contact",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "bd416db7f137a6e2da1f1e964d86fc330cc40a857345b8773e9c905ec609c5e8",
                "evidenceSectionSha256": "2eee5588c6715ebcb1ac034d436c729c59a9d1c37a25f6a42f281fe7a4a16d18",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "processing_purposes",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "bd416db7f137a6e2da1f1e964d86fc330cc40a857345b8773e9c905ec609c5e8",
                "evidenceSectionSha256": "64f8fce64d3fe1d99f70613a81034c2126ce280df31ed5f89e77ece707a981ea",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "legal_basis",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "bd416db7f137a6e2da1f1e964d86fc330cc40a857345b8773e9c905ec609c5e8",
                "evidenceSectionSha256": "5370944a335c232630743963a3b3f90a175e47002aa22b5e45473cc3f448f6e4",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "recipients_or_vendor_categories",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "bd416db7f137a6e2da1f1e964d86fc330cc40a857345b8773e9c905ec609c5e8",
                "evidenceSectionSha256": "70158e2145a258474c41290841f419d4707e8e28b173c8ae120dfe0bb345bb96",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "data_retention",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "bd416db7f137a6e2da1f1e964d86fc330cc40a857345b8773e9c905ec609c5e8",
                "evidenceSectionSha256": "9cf57134f312b87376085169985ab400570e417f9896093923d1a0c158d5ae30",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "data_subject_rights",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "international_transfers",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "bd416db7f137a6e2da1f1e964d86fc330cc40a857345b8773e9c905ec609c5e8",
                "evidenceSectionSha256": "4fb3f767844f3eab16466dd04dfed6511bc8af6ddeeb8e019421856a9e865742",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "dpo_contact",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "supervisory_authority",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "automated_decision_making_or_profiling",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              }
            ]
          }
        ],
        "generatedAt": "2026-10-12T19:37:02.160Z",
        "sourceBundle": {
          "uri": "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/cfe74173-c90a-48a7-859d-740b6c823180/CanonicalEvidenceBundle.json",
          "sha256": "875403917c8e47e410cdeec75bb9e069d95bc52d09ef04bfd813aa5da018a500",
          "sizeBytes": 658321,
          "schemaVersion": "certscore.v2.alpha.1",
          "verificationStatus": "verified"
        },
        "limitationKeys": [
          "policy_section_inventory_bounded",
          "policy_section_text_bounded"
        ],
        "contractVersion": "certscore.policy-text-evidence-projection.v1",
        "projectionStatus": "verified_complete"
      },
      "privacyPolicyTextCharacterCount": 16345,
      "retainedCookiePolicyTextExcerpt": "",
      "validatedDisclosureTypesPartial": [],
      "article13DisclosureTypesObserved": [
        "data_subject_rights",
        "data_retention",
        "international_transfers",
        "controller_contact",
        "processing_purposes",
        "legal_basis",
        "recipients_or_vendor_categories"
      ],
      "retainedArticle13SectionEvidence": [
        {
          "surfaceUrl": "https://huggingface.co/privacy",
          "coverageArea": "data_retention",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://huggingface.co/privacy",
          "selectedPolicySectionExcerpt": "We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests.",
          "selectedPolicySectionHeading": "B. Data retention"
        },
        {
          "surfaceUrl": "https://huggingface.co/privacy",
          "coverageArea": "data_subject_rights",
          "evidenceSource": "deterministic",
          "signalObserved": "partial",
          "selectedEvidenceStrength": "partial",
          "selectedPolicySectionUrl": "https://huggingface.co/privacy",
          "selectedPolicySectionExcerpt": "If you have any other request, all such communications regarding access to Personal Information should be addressed to: [email protected] . Such inquiries should be clearly marked as data protection queries and you should indicate if the request is time sensitive. B.",
          "selectedPolicySectionHeading": "4. YOUR RIGHTS"
        },
        {
          "surfaceUrl": "https://huggingface.co/privacy",
          "coverageArea": "international_transfers",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://huggingface.co/privacy",
          "selectedPolicySectionExcerpt": "Such information may be transferred to other countries around the world.",
          "selectedPolicySectionHeading": "6. LOCATION OF PROCESSING AND DATA TRANSFERS"
        },
        {
          "surfaceUrl": "https://huggingface.co/privacy",
          "coverageArea": "dpo_contact",
          "evidenceSource": "deterministic",
          "signalObserved": "not_confirmed",
          "extractionLimitation": "section_retained_without_row_specific_disclosure",
          "selectedEvidenceStrength": "limited",
          "selectedPolicySectionUrl": "https://huggingface.co/privacy",
          "selectedPolicySectionExcerpt": "If you have questions about this Policy, please contact [email protected] . The main establishment in the European Union is Hugging Face, SAS, a French société par actions simplifiée à associé unique registered in the Paris Trade and Companies Register under the number 822 168 043, and whose headquarters are located on 9 rue des Colonnes, 75002 Paris, France. The designation of this main establishment in the European Union gives full authority to the French Data Protection Agency, la Commission Nationale de l'Informatique et des Libertés (CNIL) per the General Data Protection Regulation (GDPR).",
          "selectedPolicySectionHeading": "9. CONTACT US"
        },
        {
          "surfaceUrl": "https://huggingface.co/privacy",
          "coverageArea": "controller_contact",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://huggingface.co/privacy",
          "selectedPolicySectionExcerpt": "9. CONTACT US If you have questions about this Policy, please contact [email protected] . The main establishment in the European Union is Hugging Face, SAS, a French société par actions simplifiée à associé unique registered in the Paris Trade and Companies Register under the number 822 168 043, and whose headquarters are located on 9 rue des Colonnes, 75002 Paris, France. The designation of this main establishment in the European Union gives full authority to the French Data Protection Agency, la Commission Nationale de l'Informatique et des Libertés (CNIL) per the General Data Protection Regulation (GDPR).",
          "selectedPolicySectionHeading": "9. CONTACT US"
        },
        {
          "surfaceUrl": "https://huggingface.co/privacy",
          "coverageArea": "processing_purposes",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "extractionLimitation": "selected_policy_section_truncated_by_retention_limit",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://huggingface.co/privacy",
          "selectedPolicySectionExcerpt": "The Company may use information from Users for the following purposes: to deliver the Services, which may include the creation of Your account, the display of Your profile or Your content, or if applicable the upgrading of Your account to a paid account, to operate and improve the Services by providing you with more effective customer service, making the Services easier to use by eliminating the need for you to enter the same information repeatedly; performing research and analysis aimed at improving the Services, or other products and technologies of the Company; automatically updating the Services; diagnosing or fixing problems with the Services, to conduct analysis or research on the Services or any topics related to it, for business operations or scientific purposes, to communicate with you, especially through the sending of welcome emails, information on technical service issues, security announcements, information of new services available, legal notices, response to your requests, or any other information that we think might interest or be relevant to you, to ensure and maintain security on our Services or Website, which may include detecting, preventing, investigating or",
          "selectedPolicySectionHeading": "Purposes of the use of Information"
        },
        {
          "surfaceUrl": "https://huggingface.co/privacy",
          "coverageArea": "legal_basis",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://huggingface.co/privacy",
          "selectedPolicySectionExcerpt": "Pursuant to applicable data protection laws, and especially the European Union’s General Data Protection Regulation (EU) 2016/679 (the “GDPR”), Hugging Face remains under an obligation to notify the Users about the legal basis on which their Personal Information is processed.",
          "selectedPolicySectionHeading": "B. Grounds for the use of Information"
        },
        {
          "surfaceUrl": "https://huggingface.co/privacy",
          "coverageArea": "recipients_or_vendor_categories",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "extractionLimitation": "selected_policy_section_truncated_by_retention_limit",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://huggingface.co/privacy",
          "selectedPolicySectionExcerpt": "Affiliates The Company may share User Information and Personal information collected by the Services with businesses that are legally part of the same group as the Company, or that become part of that group in the event of a change of control, merger, acquisition or sale (“Affiliates”).",
          "selectedPolicySectionHeading": "3. SHARING OF INFORMATION"
        }
      ],
      "retainedPrivacyPolicyTextExcerpt": "Terms of Service Privacy Policy Content Policy Code of Conduct Hugging Face Privacy Policy 🗓 Effective Date: March 28, 2023 We have implemented this Privacy Policy because your privacy is important to us. This Privacy Policy (the “Policy”) describes the type of information that Hugging Face, Inc. (the “Company”) gathers from users of the Hugging Face services (the “Services”), and how the Company uses that information. The Policy is part of the Company Terms of Use. The Policy applies to all users of the Services (“Users”). The Company occasionally collects Personal Information from Users. “Personal Information” means any information that can, alone or associated with other information, be used to identify an individual, for instance by reference of a name, a username, an email address, an IP address, a photograph or others. By using the Services, you consent to the terms of the Policy and to our processing of Personal Information in the manner and for the purposes set forth herein. If you do not agree with the Policy, please do not use the Services. The Company reserves the right, at its sole discretion, to change the Policy at any time, which change will be effective 10 days following posting the revision to the Policy on the Hugging Face website (the “Website”). Your continued use of the Services 10 days following such posting means you accept those changes. 1. INFORMATION WE COLLECT The Company collects the following information, some of which might be Personal Information. A. Information you provide directly The Company collects information directly provided by Users as part of using the Services, such as: information provided as part of setting up an account on the Website: email address, password, username, full name, and other optional information such as an avatar, your interests, or usernames to your third-party social networks, payment information provided, if you decide to upgrade your user or organization account: credit card information, other information and materials that you decide to post on the Website (e.g., the discussion forum, or other), communications between you and the Company, as part of using the Services. At any time during your use of the Services, you may decide to share some information or content publicly or privately. If you decide to share your information or content publicly, and if you decide to include Personal Information, you understand that anyone may view this information. If you decide to keep your information private and control the access to it, you understand that only the users that you authorize will view this information. The Company also reserves the right to access this information with your consent, or without your consent only for the purposes of pursuing legitimate interests such as maintaining security on its Services or complying with any legal or regulatory obligations. B. Information we collect from third parties We may collect Information from third parties that help us deliver the Services or process information. C. Information we automatically collect from your use of the Services The Company automatically records information from your use of the Services such as: information about your Use of the Services, your session (date, location), your IP address, information from cookies, especially your login information, your preferences, information about your device: type, model, version, operating system, browser D. Cookies We use cookies only for the purposes of delivering, updating, monitoring, improving the Services, and maintaining security on our Services by detecting, preventing and responding to any type of threats or incidents. We may collect Information through those cookies. If you do not wish to accept these cookies and you decide to disable them, you will not be able to access and use the Services. E. “Do Not Track” On September 27, 2013, California enacted A.B. 370, amending the California Online Privacy Protection Act to require website operators to disclose how they respond to \"Do Not Track Signals\"; and whether third parties collect personally identifiable information about users when they use online services. The Company honors \"do not track\" signals and does not track, use cookies, or use advertising when a “do not track” mechanism is in place. The Company does not authorize the collection of personally identifiable information from our users for third party use through advertising technologies without separate member consent. California Civil Code Section 1798.83 also permits customers who are California residents to request certain information regarding Our disclosure of Personal Information to third parties for direct marketing purposes. To make such a request, please send an email to [email protected] . Please note that the Company is only required to respond to one request per customer each year. 2. USE OF INFORMATION Purposes of the use of Information The Company may use information from Users for the following purposes: to deliver the Services, which may include the creation of Your account, the display of Your profile or Your content, or if applicable the upgrading of Your account to a paid account, to operate and improve the Services by providing you with more effective customer service, making the Services easier to use by eliminating the need for you to enter the same information repeatedly; performing research and analysis aimed at improving the Services, or other products and technologies of the Company; automatically updating the Services; diagnosing or fixing problems with the Services, to conduct analysis or research on the Services or any topics related to it, for business operations or scientific purposes, to communicate with you, especially through the sending of welcome emails, information on technical service issues, security announcements, information of new services available, legal notices, response to your requests, or any other information that we think might interest or be relevant to you, to ensure and maintain security on our Services or Website, which may include detecting, preventing, investigating or otherwise addressing fraud or security issues, to protect against harm to the rights, property or safety of the Company, our Users, yourself or the public, to enforce any applicable terms of service or agreement, including investigations of potential violations thereof, to comply with any applicable law, regulation, legal process or governmental requests. B. Grounds for the use of Information Pursuant to applicable data protection laws, and especially the European Union’s General Data Protection Regulation (EU) 2016/679 (the “GDPR”), Hugging Face remains under an obligation to notify the Users about the legal basis on which their Personal Information is processed. Consent By creating an account on the Website and by using the Services, you consent to disclose information, some of which might be personal, and to our processing of such Personal Information in the manner and for the purposes set forth in this Policy. Agreement If you or your organization enter into an agreement with Hugging Face, either by simply using the Services and abiding by the terms and conditions available on the Website, or by executing another separate agreement, you also consent to our processing of your Personal Information as pursuant the obligations of such an agreement. Legitimate Interests Apart from the above cases, Hugging Face will use the information collected from you to pursue legitimate interests such as legal or regulatory compliance, security control, business operations, scientific research, or any other interest reasonably held as legitimate. 3. SHARING OF INFORMATION The Company will not sell, rent or lease your Personal Information except as provided for by this Policy. The Company may also share other information as provided by this Policy. A. Affiliates The Company may share User Information and Personal information collected by the Services with businesses that are legally part of the same group as the Company, or that become part of that group in the event of a change of control, merger, acquisition or sale (“Affiliates”). B. Third Party Service Providers The Company may occasionally hire other companies to provide limited services on its behalf, such as providing customer support, hosting websites, processing transactions, or performing statistical analysis of its Services. Those companies will be permitted to obtain only the Personal Information they need to deliver the relevant service. They will be required to maintain the confidentiality of the information and are prohibited from using it for any other purpose. Please refer to the list of Third Party Service Providers below. C. With your consent At any time during your use of the Services, or upon explicit request from us, you may consent to the disclosure of your information. D. For security and safety purposes In the event of any fraud, security threats or incidents, we reserve the right to disclose your information without your consent for the purposes of ensuring and maintaining security on our Website and for all of our Users, and detecting, preventing, investigating or otherwise addressing fraud or security issues. Similarly, we reserve the right to disclose your information without your consent for the purpose of protecting against harm to the rights, property or safety of the Company, our Users, yourself or the public. E. For legal or regulatory purposes We also reserve the right to disclose your information without your consent to comply with any applicable law, regulation, legal process or governmental requests. G. Anonymous Information The Company may use Anonymous Information (as defined below) or disclose it to third party service providers, to provide and improve the Services and other products or technologies of the Company. The Company may disclose Anonymous Information (with or without compensation) to third parties, including advertisers and partners, for purposes including, but not limited to, targeting advertisements. \"Anonymous Information\" means information which does not enable identification of an individual User, such as aggregated information about use of the Services. 4. YOUR RIGHTS A. Access your Information You may be entitled under data protection laws to access and review Personal Information the Company holds related to you. You may access, modify or delete the Information we collected by editing your profile or controlling the content that you share at any time. If you have any other request, all such communications regarding access to Personal Information should be addressed to: [email protected] . Such inquiries should be clearly marked as data protection queries and you should indicate if the request is time sensitive. B. Data retention We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests. You may decide to cancel your account and your content at any time by editing your profile. If you wish to request the erasure of all of your Personal Information that we process, you may do so by sending a written request to [email protected] . 5. DATA SECURITY The security of your Personal Information is important to us. The Company follows generally accepted industry standards, including the use of appropriate administrative, physical and technical safeguards, to protect Personal Information. However, no method of transmission over the Internet, or method of electronic storage, is fully secure. Therefore, while the Company strives to use commercially acceptable means to protect Personal Information, the Company cannot guarantee its absolute security or confidentiality. If you have any questions about security, you can contact the Company at [email protected] . In the event of an incident affecting your Personal Information, we will act promptly acceptable means to identify and address the incident, and to notify you. Please be aware that certain Personal Information and other information provided by you in connection with your use of the Services may be stored on your device (even if that Information is not collected by the Company). You are solely responsible for maintaining the security of your device from unauthorized access. Similarly, you also remain responsible for maintaining the confidentiality of your password or any other information that should reasonably be held confidential. 6. LOCATION OF PROCESSING AND DATA TRANSFERS The Company and its servers are located in the United States. Personal Information collected by the Services may be stored and processed in the United States or any other country in which the Company or its affiliates, subsidiaries or agents maintain facilities. By using the Services, you consent to any such transfer of information outside of your country. The Company may transfer your Personal Information to affiliated companies for the purpose of storing or processing such information on its behalf. Such information may be transferred to other countries around the world. The Company requires that these parties agree to process such information in compliance with the Policy. In particular, if you provide Personal Information, it may be transferred to and processed on computers in the U.S. and other countries. We strive to take appropriate safeguards to ensure that your Personal Information will remain protected in a manner consistent with standard applicable data protection laws. If you have any other question, please contact the Company at: [email protected] . 7. CHILDREN’S PRIVACY The Services are neither directed to nor structured to attract children under the age of 13 years. Accordingly, the Company does not intend to collect Personal Information from anyone it knows to be under 13 years of age. The Company will direct potential users under 13 years of age not to use the Services. If the Company learns that Personal Information of persons less than 13 years of age has been collected without verifiable parental consent, the Company will take the appropriate steps to delete this information. To make such a request, please contact the Company at: [email protected] . 8. COMMUNICATIONS AND CAN-SPAM ACT The Company may collect your email address in order to send information and respond to inquiries and/or other requests or questions. The Company does not use false or misleading subjects or email addresses. The Company reasonably identifies advertisements and includes in its communications the physical address of its business location. The Company honors opt-out/unsubscribe requests. Users may follow the instructions at the bottom of an email from the Company in order to unsubscribe from correspondence. 9. CONTACT US If you have questions about this Policy, please contact [email protected] . The main establishment in the European Union is Hugging Face, SAS, a French société par actions simplifiée à associé unique registered in the Paris Trade and Companies Register under the number 822 168 043, and whose headquarters are located on 9 rue des Colonnes, 75002 Paris, France. The designation of this main establishment in the European Union gives full authority to the French Data Protection Agency, la Commission Nationale de l'Informatique et des Libertés (CNIL) per the General Data Protection Regulation (GDPR). 10. LIST OF THIRD-PARTY SERVICE PROVIDERS We may share your information with Third-Party Service Providers, and when we do, we ensure that they access your information in compliance with applicable data protection laws. The following list respects the format Subprocessor | Description of Subprocessing | Location of Subprocessing . Discourse | Forum | United States AWS SES | Emails | United States Amazon Web Services, Inc. | Hosting/Infrastructure | United States Metronome | Billing | United States Stripe | Payment | United States MongoDB Atlas | Hosting/Infrastructure | United States Google Cloud Platform | Hosting/Infrastructure | United States/EMEA GitHub | Hosting code | United States OVHCloud | Hosting/Infrastructure | France Slack Technologies | Communication | United States Hugging Face SAS | All of the above | France",
      "validatedDisclosureTypesObserved": [
        "data_subject_rights",
        "data_retention",
        "international_transfers",
        "controller_contact",
        "processing_purposes",
        "legal_basis",
        "recipients_or_vendor_categories"
      ],
      "privacyNoticeAvailabilityObserved": true,
      "evaluatedPrivacyPolicySurfaceCount": 1,
      "discardedArticle13DisclosureSignals": [
        {
          "source": "deterministic",
          "confidence": 0.88,
          "surfaceUrl": "https://huggingface.co/privacy",
          "evidenceText": "the users that you authorize will view this information. The Company also reserves the right to access this information with your consent, or without your consent only for the purposes of pursuing legitimate interests such as maintaining security on its Services or complying with any legal or regulatory obligations. B.",
          "rejectReason": "insufficient_row_specific_terms",
          "disclosureType": "processing_purposes"
        },
        {
          "source": "deterministic",
          "confidence": 0.76,
          "surfaceUrl": "https://huggingface.co/privacy",
          "evidenceText": "legally part of the same group as the Company, or that become part of that group in the event of a change of control, merger, acquisition or sale (“Affiliates”). B.",
          "rejectReason": "insufficient_row_specific_terms",
          "disclosureType": "recipients_or_vendor_categories"
        },
        {
          "source": "deterministic",
          "confidence": 0.66,
          "surfaceUrl": "https://huggingface.co/privacy",
          "evidenceText": "or security issues, to protect against harm to the rights, property or safety of the Company, our Users, yourself or the public, to enforce any applicable terms of service or agreement, including investigations of potential violations thereof, to comply with any applicable law, regulation, legal process or governmental requests. B.",
          "rejectReason": "insufficient_row_specific_terms",
          "disclosureType": "international_transfers"
        },
        {
          "source": "deterministic",
          "confidence": 0.9,
          "surfaceUrl": "https://huggingface.co/privacy",
          "evidenceText": "designation of this main establishment in the European Union gives full authority to the French Data Protection Agency, la Commission Nationale de l'Informatique et des Libertés (CNIL) per the General Data Protection Regulation (GDPR). 10.",
          "rejectReason": "insufficient_row_specific_terms",
          "disclosureType": "supervisory_authority"
        }
      ],
      "staleLegalFrameworkReferenceObserved": false,
      "policyEvidenceProvenanceContractVersion": "certscore.policy-evidence-provenance.v1",
      "gdprTransparencyProductionEvidenceEnabled": true,
      "gdprTransparencyProductionEvidenceDiagnostics": {
        "sourceCandidateCount": 6,
        "candidateDispositions": [
          {
            "topic": "international_transfers",
            "confidence": 0.86,
            "disposition": "accepted",
            "matchStrength": "equivalent",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_6ae2f3f0"
          },
          {
            "topic": "legal_basis",
            "confidence": 0.86,
            "disposition": "accepted",
            "matchStrength": "equivalent",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_6ae2f3f0"
          },
          {
            "topic": "data_retention",
            "confidence": 0.86,
            "disposition": "accepted",
            "matchStrength": "equivalent",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_6ae2f3f0"
          },
          {
            "topic": "recipients_or_vendor_categories",
            "confidence": 0.86,
            "disposition": "accepted",
            "matchStrength": "equivalent",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_6ae2f3f0"
          },
          {
            "topic": "data_subject_rights",
            "confidence": 0.86,
            "disposition": "accepted",
            "matchStrength": "equivalent",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_6ae2f3f0"
          },
          {
            "topic": "processing_purposes",
            "confidence": 0.88,
            "disposition": "diagnostic_only",
            "matchStrength": "equivalent",
            "matchedLocale": "en",
            "rejectionReason": "candidate_topic_invariants_failed",
            "sourceObservationId": "policy_surface_6ae2f3f0"
          }
        ],
        "acceptedCandidateCount": 5,
        "rejectedCandidateCount": 1,
        "discardedCandidateCount": 0,
        "diagnosticCandidateCount": 1,
        "productionCreditSignalCount": 5
      }
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Legal basisIncludes legal grounds for using personal data.Observed

JSON evidence

Policy source

Captured page title: Privacy Policy – Hugging Face — https://huggingface.co/privacy

Document heading: Hugging Face Privacy Policy

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:36:58.534Z.

Section: B. Grounds for the use of Information; effective date: March 28, 2023; update text: Effective Date: March 28, 2023.

Open policy source

Pursuant to applicable data protection laws, and especially the European Union’s General Data Protection Regulation (EU) 2016/679 (the “GDPR”), Hugging Face remains under an obligation to notify the Users about the legal basis on which their Personal Information is processed.

Matched disclosure snippet: Pursuant to applicable data protection laws, and especially the European Union’s General Data Protection Regulation (EU)…

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "legal_basis_disclosure_observed",
  "coverageArea": "Legal basis disclosure",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence included a canonical legal-basis disclosure signal.",
  "note": "Whether retained privacy-policy evidence included a canonical legal-basis disclosure signal.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.legal_basis_disclosure_observed.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.legal_basis_disclosure_observed"
  },
  "statusBasis": "Legal basis disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: Legal basis disclosure",
      "Excerpt: Pursuant to applicable data protection laws, and especially the European Union’s General Data Protection Regulation (EU) 2016/679 (the “GDPR”), Hugging Face remains under an obligation to notify the Users about the legal basis on which their Personal Information is processed.",
      "Locale: en",
      "Policy URL: https://huggingface.co/privacy"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.86,
      "surfaceUrl": "https://huggingface.co/privacy",
      "evidenceText": "Pursuant to applicable data protection laws, and especially the European Union’s General Data Protection Regulation (EU) 2016/679 (the “GDPR”), Hugging Face remains under an obligation to notify the Users about the legal basis on which their Personal Information is processed.",
      "matchStrength": "equivalent",
      "matchedLocale": "en",
      "disclosureType": "legal_basis",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
      "classifierReasonCodes": [
        "matched_legal_basis",
        "match_strength_equivalent",
        "variant_semantic_clause"
      ],
      "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://huggingface.co/privacy",
      "selectedPolicySectionHeading": "B. Grounds for the use of Information"
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://huggingface.co/privacy",
      "policyTitle": "Privacy Policy – Hugging Face",
      "artifactRefs": [
        "policy_excerpt_6ae2f3f0_b2dce9c4",
        "policy_surface_text_6ae2f3f0_a5512975"
      ],
      "effectiveDate": "March 28, 2023",
      "bannerLanguage": "en",
      "sectionHeading": "B. Grounds for the use of Information",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "Hugging Face Privacy Policy",
      "lastUpdatedText": "Effective Date: March 28, 2023",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:36:58.534Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "Hugging Face",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "legal_basis",
      "originKey": "gdpr_transparency.article13.legal_basis",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.legal_basis",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Data retentionDescribes when personal data is kept or deleted.Observed

JSON evidence

Policy source

Captured page title: Privacy Policy – Hugging Face — https://huggingface.co/privacy

Document heading: Hugging Face Privacy Policy

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:36:58.534Z.

Section: Not retained; effective date: March 28, 2023; update text: Effective Date: March 28, 2023.

Open policy source

We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests.

Matched disclosure snippet: We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirem…

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "retention_disclosure_observed",
  "coverageArea": "Retention disclosure",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence included a data-retention disclosure signal.",
  "note": "Whether retained privacy-policy evidence included a data-retention disclosure signal.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.retention_disclosure_observed.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.retention_disclosure_observed"
  },
  "statusBasis": "Retention disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: Retention disclosure",
      "Excerpt: We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests.",
      "Locale: en",
      "Policy URL: https://huggingface.co/privacy"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.86,
      "surfaceUrl": "https://huggingface.co/privacy",
      "evidenceText": "We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests.",
      "matchStrength": "equivalent",
      "matchedLocale": "en",
      "disclosureType": "data_retention",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
      "classifierReasonCodes": [
        "matched_data_retention",
        "match_strength_equivalent",
        "variant_semantic_clause"
      ],
      "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://huggingface.co/privacy",
      "selectedPolicySectionHeading": null
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://huggingface.co/privacy",
      "policyTitle": "Privacy Policy – Hugging Face",
      "artifactRefs": [
        "policy_excerpt_6ae2f3f0_b2dce9c4",
        "policy_surface_text_6ae2f3f0_a5512975"
      ],
      "effectiveDate": "March 28, 2023",
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "Hugging Face Privacy Policy",
      "lastUpdatedText": "Effective Date: March 28, 2023",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:36:58.534Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "Hugging Face",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "data_retention",
      "originKey": "gdpr_transparency.article13.data_retention",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.data_retention",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Controller and contact detailsThis disclosure could not be confirmed from the saved policy evidence.Not confirmed

JSON evidence

Policy source

Captured page title: Privacy Policy – Hugging Face — https://huggingface.co/privacy

Document heading: Hugging Face Privacy Policy

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:36:58.534Z.

Section: Not retained; effective date: March 28, 2023; update text: Effective Date: March 28, 2023.

Open policy source

unprojected controller/contact disclosure candidate

Excerpt: 9. CONTACT US If you have questions about this Policy, please contact [email protected] . The main establishment in the European Union is Hugging Face, SAS, a French société par actions simplifiée à associé unique registered in the Paris Trade and Companies Register under the number 822 168 043, and whose headquarters are located on 9 rue des Colonnes, 75002 Paris, France. The designation of this main establishment in the European Union gives full authority to the French Data Protection Agency, la Commission Nationale de l'Informatique et des Libertés (CNIL) per the General Data Protection Regulation (GDPR).

Policy URL: https://huggingface.co/privacy

Full evidence JSON

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "controller_contact_disclosure",
  "coverageArea": "Controller/contact disclosure",
  "evidenceState": "not_testable",
  "explanation": "Whether retained privacy-policy evidence included a controller, privacy contact, or equivalent contact point.",
  "note": "Whether retained privacy-policy evidence included a controller, privacy contact, or equivalent contact point.",
  "status": "Not confirmed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.controller_contact_disclosure.not_confirmed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.controller_contact_disclosure"
  },
  "statusBasis": "No production-approved topic match was established. A retained candidate was rejected by the canonical projection and remains available for audit; this result does not establish that the disclosure is absent.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Review the governing policy section for the controller identity and contact details; retain the exact excerpt and source URL.",
        "If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.",
        "Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording."
      ]
    },
    "evidenceRefs": [
      "Evidence: unprojected controller/contact disclosure candidate",
      "Excerpt: 9. CONTACT US If you have questions about this Policy, please contact [email protected] . The main establishment in the European Union is Hugging Face, SAS, a French société par actions simplifiée à associé unique registered in the Paris Trade and Companies Register under the number 822 168 043, and whose headquarters are located on 9 rue des Colonnes, 75002 Paris, France. The designation of this main establishment in the European Union gives full authority to the French Data Protection Agency, la Commission Nationale de l'Informatique et des Libertés (CNIL) per the General Data Protection Regulation (GDPR).",
      "Policy URL: https://huggingface.co/privacy"
    ],
    "signalObserved": "not_confirmed_canonical_projection_unavailable",
    "retainedCandidate": {
      "source": "deterministic",
      "status": "observed",
      "confidence": 0.9,
      "surfaceUrl": "https://huggingface.co/privacy",
      "evidenceText": "9. CONTACT US If you have questions about this Policy, please contact [email protected]. The main establishment in the European Union is Hugging Face, SAS, a French société par actions simplifiée à associé unique registered in the Paris Trade and Companies Register under the number 822 168 043, and whose headquarters are located on 9 rue des Colonnes, 75002 Paris, France. The designation of this main establishment in the European Union gives full authority to the French Data Protection Agency, la Commission Nationale de l'Informatique et des Libertés (CNIL) per the General Data Protection Regulation (GDPR).",
      "disclosureType": "controller_contact",
      "evidenceSource": "deterministic",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://huggingface.co/privacy",
      "supportingContactContext": null,
      "selectedPolicySectionExcerpt": "9. CONTACT US If you have questions about this Policy, please contact [email protected] . The main establishment in the European Union is Hugging Face, SAS, a French société par actions simplifiée à associé unique registered in the Paris Trade and Companies Register under the number 822 168 043, and whose headquarters are located on 9 rue des Colonnes, 75002 Paris, France. The designation of this main establishment in the European Union gives full authority to the French Data Protection Agency, la Commission Nationale de l'Informatique et des Libertés (CNIL) per the General Data Protection Regulation (GDPR).",
      "selectedPolicySectionHeading": "9. CONTACT US"
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "canonicalProjectionState": "retained_candidate_not_production_projectable",
    "policyEvidenceAssessment": {
      "result": "extraction_incomplete",
      "scoreEffect": "none",
      "topicRelevance": "unknown",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://huggingface.co/privacy",
      "policyTitle": "Privacy Policy – Hugging Face",
      "artifactRefs": [
        "policy_excerpt_6ae2f3f0_b2dce9c4",
        "policy_surface_text_6ae2f3f0_a5512975"
      ],
      "effectiveDate": "March 28, 2023",
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "Hugging Face Privacy Policy",
      "lastUpdatedText": "Effective Date: March 28, 2023",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:36:58.534Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "Hugging Face",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "missing",
    "policyTextExtractionHealth": {
      "policyUrls": [
        "https://huggingface.co/privacy"
      ],
      "nanoInvoked": false,
      "contractVersion": "certscore.policy-text-extraction-health.v2",
      "policyTextQuality": {
        "usable": true,
        "codeSignalCount": 0,
        "codeSymbolRatio": 0.0002447231569287244,
        "policyTermCount": 14,
        "alphabeticWordRatio": 0.7939897192566232,
        "accessChallengeSignalCount": 0,
        "naturalLanguageSentenceCount": 91
      },
      "policyUrlRetained": true,
      "extractedTextLength": 16345,
      "policySurfaceObserved": true,
      "detectedPolicyLanguage": "en",
      "minimumTextLengthRequired": 500,
      "policyTextExtractionStatus": "ok",
      "verifiedPolicyDocumentCount": 1,
      "detectedPolicyLanguageSource": "policy_surface",
      "supportedGdprTransparencyLocales": [
        "en",
        "de",
        "fr",
        "es",
        "it",
        "nl",
        "pl",
        "pt",
        "ru",
        "ja",
        "zh",
        "ar",
        "sv",
        "ro",
        "cs",
        "el",
        "hu",
        "da",
        "fi",
        "sk",
        "bg",
        "hr",
        "nb",
        "sl",
        "lt",
        "lv",
        "et",
        "uk",
        "tr",
        "fa",
        "vi",
        "id",
        "ko",
        "th",
        "he",
        "sr",
        "ca",
        "hi",
        "az",
        "gl"
      ],
      "gdprTransparencyLanguageSupported": true,
      "policyTextEvidenceProjectionStatus": "verified_complete",
      "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
    },
    "selectedEvidenceArtifactId": "coverage_policy",
    "article13CoverageAssessment": {
      "topic": "controller_contact",
      "status": "observed",
      "sourceUrls": [
        "https://huggingface.co/privacy"
      ],
      "reasonCodes": [
        "row_specific_disclosure_observed"
      ],
      "coverageStatus": "insufficient",
      "policyDocumentIds": [
        "policy_surface_6ae2f3f0"
      ],
      "policyDocumentRoles": [
        "policy_document"
      ],
      "policyDocumentSha256": [
        "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
      ],
      "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
      "unresolvedMaterialPolicyChildUrls": []
    },
    "gdprTransparencyReportStatusContract": "observed_not_confirmed_no_match_found.v1"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the governing policy section for the controller identity and contact details; retain the exact excerpt and source URL.
2If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.
3Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording.

Data use purposesThis disclosure could not be confirmed from the saved policy evidence.Not confirmed

JSON evidence

Policy source

Captured page title: Privacy Policy – Hugging Face — https://huggingface.co/privacy

Document heading: Hugging Face Privacy Policy

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:36:58.534Z.

Section: Not retained; effective date: March 28, 2023; update text: Effective Date: March 28, 2023.

Open policy source

unprojected processing purposes disclosure candidate

Excerpt: The Company may use information from Users for the following purposes: to deliver the Services, which may include the creation of Your account, the display of Your profile or Your content, or if applicable the upgrading of Your account to a paid account, to operate and improve the Services by providing you with more effective customer service, making the Services easier to use by eliminating the need for you to enter the same information repeatedly; performing research and analysis aimed at improving the Services, or other products and technologies of the Company; automatically updating the Services; diagnosing or fixing problems with the Services, to conduct analysis or research on the Services or any topics related to it, for business operations or scientific purposes, to communicate with you, especially through the sending of welcome emails, information on technical service issues, security announcements, information of new services available, legal notices, response to your requests, or any other information that we think might interest or be relevant to you, to ensure and maintain security on our Services or Website, which may include detecting, preventing, investigating or

Policy URL: https://huggingface.co/privacy

Full evidence JSON

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "processing_purposes_disclosure",
  "coverageArea": "Processing purposes disclosure",
  "evidenceState": "not_testable",
  "explanation": "Whether retained privacy-policy evidence described the purposes for processing personal data.",
  "note": "Whether retained privacy-policy evidence described the purposes for processing personal data.",
  "status": "Not confirmed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.processing_purposes_disclosure.not_confirmed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.processing_purposes_disclosure"
  },
  "statusBasis": "No production-approved topic match was established. A retained candidate was rejected by the canonical projection and remains available for audit; this result does not establish that the disclosure is absent.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Review the governing policy section for the purposes for each described processing activity; retain the exact excerpt and source URL.",
        "If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.",
        "Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording."
      ]
    },
    "evidenceRefs": [
      "Evidence: unprojected processing purposes disclosure candidate",
      "Excerpt: The Company may use information from Users for the following purposes: to deliver the Services, which may include the creation of Your account, the display of Your profile or Your content, or if applicable the upgrading of Your account to a paid account, to operate and improve the Services by providing you with more effective customer service, making the Services easier to use by eliminating the need for you to enter the same information repeatedly; performing research and analysis aimed at improving the Services, or other products and technologies of the Company; automatically updating the Services; diagnosing or fixing problems with the Services, to conduct analysis or research on the Services or any topics related to it, for business operations or scientific purposes, to communicate with you, especially through the sending of welcome emails, information on technical service issues, security announcements, information of new services available, legal notices, response to your requests, or any other information that we think might interest or be relevant to you, to ensure and maintain security on our Services or Website, which may include detecting, preventing, investigating or",
      "Policy URL: https://huggingface.co/privacy"
    ],
    "signalObserved": "not_confirmed_canonical_projection_unavailable",
    "retainedCandidate": {
      "source": "deterministic",
      "status": "observed",
      "confidence": 0.88,
      "surfaceUrl": "https://huggingface.co/privacy",
      "evidenceText": "The Company may use information from Users for the following purposes: to deliver the Services, which may include the creation of Your account, the display of Your profile or Your content, or if applicable the upgrading of Your account to a paid account, to operate and improve the Services by providing you with more effective customer service, making the Services easier to use by eliminating the need for you to enter the same information repeatedly; performing research and analysis aimed at improving the Services, or other products and technologies of the Company; automatically updating the Services; diagnosing or fixing problems",
      "disclosureType": "processing_purposes",
      "evidenceSource": "deterministic",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://huggingface.co/privacy",
      "supportingContactContext": null,
      "selectedPolicySectionExcerpt": "The Company may use information from Users for the following purposes: to deliver the Services, which may include the creation of Your account, the display of Your profile or Your content, or if applicable the upgrading of Your account to a paid account, to operate and improve the Services by providing you with more effective customer service, making the Services easier to use by eliminating the need for you to enter the same information repeatedly; performing research and analysis aimed at improving the Services, or other products and technologies of the Company; automatically updating the Services; diagnosing or fixing problems with the Services, to conduct analysis or research on the Services or any topics related to it, for business operations or scientific purposes, to communicate with you, especially through the sending of welcome emails, information on technical service issues, security announcements, information of new services available, legal notices, response to your requests, or any other information that we think might interest or be relevant to you, to ensure and maintain security on our Services or Website, which may include detecting, preventing, investigating or",
      "selectedPolicySectionHeading": "Purposes of the use of Information"
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "canonicalProjectionState": "retained_candidate_not_production_projectable",
    "policyEvidenceAssessment": {
      "result": "extraction_incomplete",
      "scoreEffect": "none",
      "topicRelevance": "unknown",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://huggingface.co/privacy",
      "policyTitle": "Privacy Policy – Hugging Face",
      "artifactRefs": [
        "policy_excerpt_6ae2f3f0_b2dce9c4",
        "policy_surface_text_6ae2f3f0_a5512975"
      ],
      "effectiveDate": "March 28, 2023",
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "Hugging Face Privacy Policy",
      "lastUpdatedText": "Effective Date: March 28, 2023",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:36:58.534Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "Hugging Face",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "missing",
    "policyTextExtractionHealth": {
      "policyUrls": [
        "https://huggingface.co/privacy"
      ],
      "nanoInvoked": false,
      "contractVersion": "certscore.policy-text-extraction-health.v2",
      "policyTextQuality": {
        "usable": true,
        "codeSignalCount": 0,
        "codeSymbolRatio": 0.0002447231569287244,
        "policyTermCount": 14,
        "alphabeticWordRatio": 0.7939897192566232,
        "accessChallengeSignalCount": 0,
        "naturalLanguageSentenceCount": 91
      },
      "policyUrlRetained": true,
      "extractedTextLength": 16345,
      "policySurfaceObserved": true,
      "detectedPolicyLanguage": "en",
      "minimumTextLengthRequired": 500,
      "policyTextExtractionStatus": "ok",
      "verifiedPolicyDocumentCount": 1,
      "detectedPolicyLanguageSource": "policy_surface",
      "supportedGdprTransparencyLocales": [
        "en",
        "de",
        "fr",
        "es",
        "it",
        "nl",
        "pl",
        "pt",
        "ru",
        "ja",
        "zh",
        "ar",
        "sv",
        "ro",
        "cs",
        "el",
        "hu",
        "da",
        "fi",
        "sk",
        "bg",
        "hr",
        "nb",
        "sl",
        "lt",
        "lv",
        "et",
        "uk",
        "tr",
        "fa",
        "vi",
        "id",
        "ko",
        "th",
        "he",
        "sr",
        "ca",
        "hi",
        "az",
        "gl"
      ],
      "gdprTransparencyLanguageSupported": true,
      "policyTextEvidenceProjectionStatus": "verified_complete",
      "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
    },
    "selectedEvidenceArtifactId": "coverage_policy",
    "article13CoverageAssessment": {
      "topic": "processing_purposes",
      "status": "observed",
      "sourceUrls": [
        "https://huggingface.co/privacy"
      ],
      "reasonCodes": [
        "row_specific_disclosure_observed"
      ],
      "coverageStatus": "insufficient",
      "policyDocumentIds": [
        "policy_surface_6ae2f3f0"
      ],
      "policyDocumentRoles": [
        "policy_document"
      ],
      "policyDocumentSha256": [
        "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
      ],
      "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
      "unresolvedMaterialPolicyChildUrls": []
    },
    "gdprTransparencyReportStatusContract": "observed_not_confirmed_no_match_found.v1"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the governing policy section for the purposes for each described processing activity; retain the exact excerpt and source URL.
2If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.
3Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording.

Recipients and vendor categoriesIdentifies recipients or types of organizations that may receive personal data.Observed

JSON evidence

Policy source

Captured page title: Privacy Policy – Hugging Face — https://huggingface.co/privacy

Document heading: Hugging Face Privacy Policy

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:36:58.534Z.

Section: Not retained; effective date: March 28, 2023; update text: Effective Date: March 28, 2023.

Open policy source

Affiliates The Company may share User Information and Personal information collected by the Services with businesses that are legally part of the same group as the Company, or that become part of that group in the event of a change of control, merger, acquisition or sale (“Affiliates”).

Matched disclosure snippet: Affiliates The Company may share User Information and Personal information collected by the Services with businesses that…

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "recipients_vendor_categories_disclosure",
  "coverageArea": "Recipients/vendor categories disclosed",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence described recipient, vendor, or 3rd party categories.",
  "note": "Whether retained privacy-policy evidence described recipient, vendor, or 3rd party categories.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.recipients_vendor_categories_disclosure.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.recipients_vendor_categories_disclosure"
  },
  "statusBasis": "Recipients/vendor categories disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: Recipients/vendor categories disclosure",
      "Excerpt: Affiliates The Company may share User Information and Personal information collected by the Services with businesses that are legally part of the same group as the Company, or that become part of that group in the event of a change of control, merger, acquisition or sale (“Affiliates”).",
      "Locale: en",
      "Policy URL: https://huggingface.co/privacy"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.86,
      "surfaceUrl": "https://huggingface.co/privacy",
      "evidenceText": "Affiliates The Company may share User Information and Personal information collected by the Services with businesses that are legally part of the same group as the Company, or that become part of that group in the event of a change of control, merger, acquisition or sale (“Affiliates”).",
      "matchStrength": "equivalent",
      "matchedLocale": "en",
      "disclosureType": "recipients_or_vendor_categories",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
      "classifierReasonCodes": [
        "matched_recipients_or_vendor_categories",
        "match_strength_equivalent",
        "variant_semantic_clause"
      ],
      "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://huggingface.co/privacy",
      "selectedPolicySectionHeading": null
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://huggingface.co/privacy",
      "policyTitle": "Privacy Policy – Hugging Face",
      "artifactRefs": [
        "policy_excerpt_6ae2f3f0_b2dce9c4",
        "policy_surface_text_6ae2f3f0_a5512975"
      ],
      "effectiveDate": "March 28, 2023",
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "Hugging Face Privacy Policy",
      "lastUpdatedText": "Effective Date: March 28, 2023",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:36:58.534Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "Hugging Face",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "recipients_or_vendor_categories",
      "originKey": "gdpr_transparency.article13.recipients_or_vendor_categories",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.recipients_or_vendor_categories",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Privacy rightsDescribes rights people have over their personal data.Observed

JSON evidence

Policy source

Captured page title: Privacy Policy – Hugging Face — https://huggingface.co/privacy

Document heading: Hugging Face Privacy Policy

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:36:58.534Z.

Section: 4. YOUR RIGHTS; effective date: March 28, 2023; update text: Effective Date: March 28, 2023.

Open policy source

If you have any other request, all such communications regarding access to Personal Information should be addressed to: [email protected] . Such inquiries should be clearly marked as data protection queries and you should indicate if the request is time sensitive. B.

Matched disclosure snippet: If you have any other request, all such communications regarding access to Personal Information should be addressed to: p…

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "data_subject_rights_disclosure",
  "coverageArea": "Data subject rights disclosure",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence described data subject rights or a rights request path.",
  "note": "Whether retained privacy-policy evidence described data subject rights or a rights request path.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.data_subject_rights_disclosure.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.data_subject_rights_disclosure"
  },
  "statusBasis": "Data subject rights disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: Data subject rights disclosure",
      "Excerpt: If you have any other request, all such communications regarding access to Personal Information should be addressed to: [email protected] . Such inquiries should be clearly marked as data protection queries and you should indicate if the request is time sensitive. B.",
      "Locale: en",
      "Policy URL: https://huggingface.co/privacy"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.86,
      "surfaceUrl": "https://huggingface.co/privacy",
      "evidenceText": "If you have any other request, all such communications regarding access to Personal Information should be addressed to: [email protected] . Such inquiries should be clearly marked as data protection queries and you should indicate if the request is time sensitive. B.",
      "matchStrength": "equivalent",
      "matchedLocale": "en",
      "disclosureType": "data_subject_rights",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
      "classifierReasonCodes": [
        "matched_data_subject_rights",
        "match_strength_equivalent",
        "variant_semantic_clause"
      ],
      "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://huggingface.co/privacy",
      "selectedPolicySectionHeading": "4. YOUR RIGHTS"
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://huggingface.co/privacy",
      "policyTitle": "Privacy Policy – Hugging Face",
      "artifactRefs": [
        "policy_excerpt_6ae2f3f0_b2dce9c4",
        "policy_surface_text_6ae2f3f0_a5512975"
      ],
      "effectiveDate": "March 28, 2023",
      "bannerLanguage": "en",
      "sectionHeading": "4. YOUR RIGHTS",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "Hugging Face Privacy Policy",
      "lastUpdatedText": "Effective Date: March 28, 2023",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:36:58.534Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "Hugging Face",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "data_subject_rights",
      "originKey": "gdpr_transparency.article13.data_subject_rights",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.data_subject_rights",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

International data transfersAddresses transfers of personal data to other countries.Observed

JSON evidence

Policy source

Captured page title: Privacy Policy – Hugging Face — https://huggingface.co/privacy

Document heading: Hugging Face Privacy Policy

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:36:58.534Z.

Section: Not retained; effective date: March 28, 2023; update text: Effective Date: March 28, 2023.

Open policy source

Such information may be transferred to other countries around the world.

Matched disclosure snippet: Such information may be transferred to other countries around the world.

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "international_transfers_disclosure",
  "coverageArea": "International transfer disclosure",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence described international transfers or transfer-relevant endpoint/vendor context.",
  "note": "Whether retained privacy-policy evidence described international transfers or transfer-relevant endpoint/vendor context.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.international_transfers_disclosure.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.international_transfers_disclosure"
  },
  "statusBasis": "International transfer disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: International transfer disclosure",
      "Excerpt: Such information may be transferred to other countries around the world.",
      "Locale: en",
      "Policy URL: https://huggingface.co/privacy"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.86,
      "surfaceUrl": "https://huggingface.co/privacy",
      "evidenceText": "Such information may be transferred to other countries around the world.",
      "matchStrength": "equivalent",
      "matchedLocale": "en",
      "disclosureType": "international_transfers",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
      "classifierReasonCodes": [
        "matched_international_transfers",
        "match_strength_equivalent",
        "variant_semantic_clause"
      ],
      "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://huggingface.co/privacy",
      "selectedPolicySectionHeading": null
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://huggingface.co/privacy",
      "policyTitle": "Privacy Policy – Hugging Face",
      "artifactRefs": [
        "policy_excerpt_6ae2f3f0_b2dce9c4",
        "policy_surface_text_6ae2f3f0_a5512975"
      ],
      "effectiveDate": "March 28, 2023",
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "Hugging Face Privacy Policy",
      "lastUpdatedText": "Effective Date: March 28, 2023",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:36:58.534Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "Hugging Face",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "international_transfers",
      "originKey": "gdpr_transparency.article13.international_transfers",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.international_transfers",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

DPO contact (if applicable)This disclosure could not be confirmed from the saved policy evidence.Not confirmed

JSON evidence

Policy source

Captured page title: Privacy Policy – Hugging Face — https://huggingface.co/privacy

Document heading: Hugging Face Privacy Policy

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:36:58.534Z.

Section: Not retained; effective date: March 28, 2023; update text: Effective Date: March 28, 2023.

Open policy source

No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.

Full evidence JSON

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "dpo_contact_point_disclosure",
  "coverageArea": "DPO contact point (where applicable)",
  "evidenceState": "not_testable",
  "explanation": "Whether retained privacy-policy evidence identified a designated data protection officer or equivalent statutory DPO contact. A generic privacy mailbox is credited under controller/contact disclosure and does not by itself establish a DPO designation.",
  "note": "Whether retained privacy-policy evidence identified a designated data protection officer or equivalent statutory DPO contact. A generic privacy mailbox is credited under controller/contact disclosure and does not by itself establish a DPO designation.",
  "status": "Not confirmed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.dpo_contact_point_disclosure.not_confirmed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.dpo_contact_point_disclosure"
  },
  "statusBasis": "No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Review the governing policy section for an expressly designated Data Protection Officer and contact route, where applicable; retain the exact excerpt and source URL.",
        "Determine whether DPO designation is required separately. A generic privacy mailbox does not prove a designation.",
        "If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.",
        "Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording."
      ]
    },
    "signalObserved": "not_confirmed_canonical_projection_unavailable",
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "canonicalProjectionState": "normalized_concern_unavailable",
    "policyEvidenceAssessment": {
      "result": "extraction_incomplete",
      "scoreEffect": "none",
      "topicRelevance": "unknown",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://huggingface.co/privacy",
      "policyTitle": "Privacy Policy – Hugging Face",
      "artifactRefs": [
        "policy_excerpt_6ae2f3f0_b2dce9c4",
        "policy_surface_text_6ae2f3f0_a5512975"
      ],
      "effectiveDate": "March 28, 2023",
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "Hugging Face Privacy Policy",
      "lastUpdatedText": "Effective Date: March 28, 2023",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:36:58.534Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "Hugging Face",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "missing",
    "policyTextExtractionHealth": {
      "policyUrls": [
        "https://huggingface.co/privacy"
      ],
      "nanoInvoked": false,
      "contractVersion": "certscore.policy-text-extraction-health.v2",
      "policyTextQuality": {
        "usable": true,
        "codeSignalCount": 0,
        "codeSymbolRatio": 0.0002447231569287244,
        "policyTermCount": 14,
        "alphabeticWordRatio": 0.7939897192566232,
        "accessChallengeSignalCount": 0,
        "naturalLanguageSentenceCount": 91
      },
      "policyUrlRetained": true,
      "extractedTextLength": 16345,
      "policySurfaceObserved": true,
      "detectedPolicyLanguage": "en",
      "minimumTextLengthRequired": 500,
      "policyTextExtractionStatus": "ok",
      "verifiedPolicyDocumentCount": 1,
      "detectedPolicyLanguageSource": "policy_surface",
      "supportedGdprTransparencyLocales": [
        "en",
        "de",
        "fr",
        "es",
        "it",
        "nl",
        "pl",
        "pt",
        "ru",
        "ja",
        "zh",
        "ar",
        "sv",
        "ro",
        "cs",
        "el",
        "hu",
        "da",
        "fi",
        "sk",
        "bg",
        "hr",
        "nb",
        "sl",
        "lt",
        "lv",
        "et",
        "uk",
        "tr",
        "fa",
        "vi",
        "id",
        "ko",
        "th",
        "he",
        "sr",
        "ca",
        "hi",
        "az",
        "gl"
      ],
      "gdprTransparencyLanguageSupported": true,
      "policyTextEvidenceProjectionStatus": "verified_complete",
      "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
    },
    "selectedEvidenceArtifactId": "coverage_policy",
    "article13CoverageAssessment": {
      "topic": "dpo_contact",
      "status": "insufficient_retained_evidence",
      "sourceUrls": [
        "https://huggingface.co/privacy"
      ],
      "reasonCodes": [
        "policy_absence_coverage_preconditions_not_met",
        "typed_topic_coverage_diagnostic_missing_or_limited",
        "policy_document_content_coverage_incomplete"
      ],
      "coverageStatus": "insufficient",
      "policyDocumentIds": [
        "policy_surface_6ae2f3f0"
      ],
      "policyDocumentRoles": [
        "policy_document"
      ],
      "policyDocumentSha256": [
        "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
      ],
      "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
      "unresolvedMaterialPolicyChildUrls": []
    },
    "gdprTransparencyReportStatusContract": "observed_not_confirmed_no_match_found.v1"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the governing policy section for an expressly designated Data Protection Officer and contact route, where applicable; retain the exact excerpt and source URL.
2Determine whether DPO designation is required separately. A generic privacy mailbox does not prove a designation.
3If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.
4Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording.

Complaints to a regulatorThis disclosure could not be confirmed from the saved policy evidence.Not confirmed

JSON evidence

Policy source

Captured page title: Privacy Policy – Hugging Face — https://huggingface.co/privacy

Document heading: Hugging Face Privacy Policy

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:36:58.534Z.

Section: Not retained; effective date: March 28, 2023; update text: Effective Date: March 28, 2023.

Open policy source

No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.

Full evidence JSON

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "supervisory_authority_complaint_disclosure",
  "coverageArea": "Supervisory authority complaint",
  "evidenceState": "not_testable",
  "explanation": "Whether retained privacy-policy evidence referenced a right to complain to a supervisory authority.",
  "note": "Whether retained privacy-policy evidence referenced a right to complain to a supervisory authority.",
  "status": "Not confirmed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.supervisory_authority_complaint_disclosure.not_confirmed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.supervisory_authority_complaint_disclosure"
  },
  "statusBasis": "No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Review the governing policy section for the right to complain to a supervisory authority; retain the exact excerpt and source URL.",
        "If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.",
        "Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording."
      ]
    },
    "signalObserved": "not_confirmed_canonical_projection_unavailable",
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "canonicalProjectionState": "normalized_concern_unavailable",
    "policyEvidenceAssessment": {
      "result": "extraction_incomplete",
      "scoreEffect": "none",
      "topicRelevance": "unknown",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://huggingface.co/privacy",
      "policyTitle": "Privacy Policy – Hugging Face",
      "artifactRefs": [
        "policy_excerpt_6ae2f3f0_b2dce9c4",
        "policy_surface_text_6ae2f3f0_a5512975"
      ],
      "effectiveDate": "March 28, 2023",
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "Hugging Face Privacy Policy",
      "lastUpdatedText": "Effective Date: March 28, 2023",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:36:58.534Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "Hugging Face",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "missing",
    "policyTextExtractionHealth": {
      "policyUrls": [
        "https://huggingface.co/privacy"
      ],
      "nanoInvoked": false,
      "contractVersion": "certscore.policy-text-extraction-health.v2",
      "policyTextQuality": {
        "usable": true,
        "codeSignalCount": 0,
        "codeSymbolRatio": 0.0002447231569287244,
        "policyTermCount": 14,
        "alphabeticWordRatio": 0.7939897192566232,
        "accessChallengeSignalCount": 0,
        "naturalLanguageSentenceCount": 91
      },
      "policyUrlRetained": true,
      "extractedTextLength": 16345,
      "policySurfaceObserved": true,
      "detectedPolicyLanguage": "en",
      "minimumTextLengthRequired": 500,
      "policyTextExtractionStatus": "ok",
      "verifiedPolicyDocumentCount": 1,
      "detectedPolicyLanguageSource": "policy_surface",
      "supportedGdprTransparencyLocales": [
        "en",
        "de",
        "fr",
        "es",
        "it",
        "nl",
        "pl",
        "pt",
        "ru",
        "ja",
        "zh",
        "ar",
        "sv",
        "ro",
        "cs",
        "el",
        "hu",
        "da",
        "fi",
        "sk",
        "bg",
        "hr",
        "nb",
        "sl",
        "lt",
        "lv",
        "et",
        "uk",
        "tr",
        "fa",
        "vi",
        "id",
        "ko",
        "th",
        "he",
        "sr",
        "ca",
        "hi",
        "az",
        "gl"
      ],
      "gdprTransparencyLanguageSupported": true,
      "policyTextEvidenceProjectionStatus": "verified_complete",
      "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
    },
    "selectedEvidenceArtifactId": "coverage_policy",
    "article13CoverageAssessment": {
      "topic": "supervisory_authority",
      "status": "insufficient_retained_evidence",
      "sourceUrls": [
        "https://huggingface.co/privacy"
      ],
      "reasonCodes": [
        "policy_absence_coverage_preconditions_not_met",
        "typed_topic_coverage_diagnostic_missing_or_limited",
        "policy_document_content_coverage_incomplete"
      ],
      "coverageStatus": "insufficient",
      "policyDocumentIds": [
        "policy_surface_6ae2f3f0"
      ],
      "policyDocumentRoles": [
        "policy_document"
      ],
      "policyDocumentSha256": [
        "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
      ],
      "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
      "unresolvedMaterialPolicyChildUrls": []
    },
    "gdprTransparencyReportStatusContract": "observed_not_confirmed_no_match_found.v1"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the governing policy section for the right to complain to a supervisory authority; retain the exact excerpt and source URL.
2If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.
3Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording.

Profiling and automated decisionsThis disclosure could not be confirmed from the saved policy evidence.Not confirmed

JSON evidence

Policy source

Captured page title: Privacy Policy – Hugging Face — https://huggingface.co/privacy

Document heading: Hugging Face Privacy Policy

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Footer Link; directly linked from scanned page: Yes; retrieved during scan: 2026-10-12T19:36:58.534Z.

Section: Not retained; effective date: March 28, 2023; update text: Effective Date: March 28, 2023.

Open policy source

No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.

Full evidence JSON

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "automated_decision_making_profiling_disclosure",
  "coverageArea": "Profiling / automated decisions disclosure",
  "evidenceState": "not_testable",
  "explanation": "Whether adapter-approved Article 13 evidence retained automated decision-making or profiling disclosure context for review.",
  "note": "Whether adapter-approved Article 13 evidence retained automated decision-making or profiling disclosure context for review.",
  "status": "Not confirmed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.automated_decision_making_profiling_disclosure.not_confirmed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.automated_decision_making_profiling_disclosure"
  },
  "statusBasis": "No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Review the governing policy section for the applicable automated decision-making or profiling disclosures; retain the exact excerpt and source URL.",
        "If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.",
        "Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording."
      ]
    },
    "signalObserved": "not_confirmed_canonical_projection_unavailable",
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "canonicalProjectionState": "normalized_concern_unavailable",
    "policyEvidenceAssessment": {
      "result": "extraction_incomplete",
      "scoreEffect": "none",
      "topicRelevance": "unknown",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://huggingface.co/privacy",
      "policyTitle": "Privacy Policy – Hugging Face",
      "artifactRefs": [
        "policy_excerpt_6ae2f3f0_b2dce9c4",
        "policy_surface_text_6ae2f3f0_a5512975"
      ],
      "effectiveDate": "March 28, 2023",
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "footer_link",
      "documentHeading": "Hugging Face Privacy Policy",
      "lastUpdatedText": "Effective Date: March 28, 2023",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:36:58.534Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "Hugging Face",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "missing",
    "policyTextExtractionHealth": {
      "policyUrls": [
        "https://huggingface.co/privacy"
      ],
      "nanoInvoked": false,
      "contractVersion": "certscore.policy-text-extraction-health.v2",
      "policyTextQuality": {
        "usable": true,
        "codeSignalCount": 0,
        "codeSymbolRatio": 0.0002447231569287244,
        "policyTermCount": 14,
        "alphabeticWordRatio": 0.7939897192566232,
        "accessChallengeSignalCount": 0,
        "naturalLanguageSentenceCount": 91
      },
      "policyUrlRetained": true,
      "extractedTextLength": 16345,
      "policySurfaceObserved": true,
      "detectedPolicyLanguage": "en",
      "minimumTextLengthRequired": 500,
      "policyTextExtractionStatus": "ok",
      "verifiedPolicyDocumentCount": 1,
      "detectedPolicyLanguageSource": "policy_surface",
      "supportedGdprTransparencyLocales": [
        "en",
        "de",
        "fr",
        "es",
        "it",
        "nl",
        "pl",
        "pt",
        "ru",
        "ja",
        "zh",
        "ar",
        "sv",
        "ro",
        "cs",
        "el",
        "hu",
        "da",
        "fi",
        "sk",
        "bg",
        "hr",
        "nb",
        "sl",
        "lt",
        "lv",
        "et",
        "uk",
        "tr",
        "fa",
        "vi",
        "id",
        "ko",
        "th",
        "he",
        "sr",
        "ca",
        "hi",
        "az",
        "gl"
      ],
      "gdprTransparencyLanguageSupported": true,
      "policyTextEvidenceProjectionStatus": "verified_complete",
      "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
    },
    "selectedEvidenceArtifactId": "coverage_policy",
    "article13CoverageAssessment": {
      "topic": "automated_decision_making_or_profiling",
      "status": "insufficient_retained_evidence",
      "sourceUrls": [
        "https://huggingface.co/privacy"
      ],
      "reasonCodes": [
        "policy_absence_coverage_preconditions_not_met",
        "typed_topic_coverage_diagnostic_missing_or_limited",
        "policy_document_content_coverage_incomplete"
      ],
      "coverageStatus": "insufficient",
      "policyDocumentIds": [
        "policy_surface_6ae2f3f0"
      ],
      "policyDocumentRoles": [
        "policy_document"
      ],
      "policyDocumentSha256": [
        "a2bc80da6d84ce0d5c74bb643ab2c6137dd88b1e87da63c900d344eb8c444a18"
      ],
      "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
      "unresolvedMaterialPolicyChildUrls": []
    },
    "gdprTransparencyReportStatusContract": "observed_not_confirmed_no_match_found.v1"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the governing policy section for the applicable automated decision-making or profiling disclosures; retain the exact excerpt and source URL.
2If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.
3Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording.

Cookie disclosureA cookie policy or disclosure notice was found.Observed

JSON evidence

cookie policy or cookie disclosure surface retained

Not confirmed: granular named-cookie inventory

Not confirmed: cookie preference interface

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "cookie_notice_policy_availability",
  "coverageArea": "Cookie notice / cookie policy availability",
  "evidenceState": "observed",
  "explanation": "Whether a cookie notice, cookie policy, cookie settings surface, or equivalent cookie disclosure surface was retained.",
  "note": "Whether a cookie notice, cookie policy, cookie settings surface, or equivalent cookie disclosure surface was retained.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.cookie_notice_policy_availability.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.cookie_notice_policy_availability"
  },
  "statusBasis": "A durable cookie disclosure surface was retained in the tested context; a granular named-cookie inventory or preference interface was not confirmed.",
  "retainedEvidence": {
    "evidenceRefs": [
      "Evidence: cookie policy or cookie disclosure surface retained",
      "Not confirmed: granular named-cookie inventory",
      "Not confirmed: cookie preference interface",
      "Policy URL: https://huggingface.co/privacy"
    ],
    "cookiePolicyUrls": [
      "https://huggingface.co/privacy"
    ],
    "cookiePolicyPresent": true,
    "cookieNoticeObserved": true,
    "observedPolicyTopics": [
      "cookies",
      "advertising",
      "sale_or_share",
      "third_party_disclosures",
      "vendor_list",
      "consent_withdrawal"
    ],
    "missingEvidenceNeeded": [],
    "observedPolicyControls": [
      "consent_withdrawal"
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "preferenceInterfaceConfirmed": false,
    "granularCookieInventoryConfirmed": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Accessibility (WCAG)

Not evaluated · Coverage limited

Limited

WCAG 2.2 A/AA automated checks on the starting page.

axe-core 4.11.3

The audit did not return evaluable results.

Cookies & tracking

3 checks · 1 to review

Review

Pre-consent storage classification reviewCookies or browser storage were observed before consent, but the scan could not determine whether every item was essential or non-essential.Partial concern

JSON evidence

aws-waf-token (huggingface.co): unknown, present in a check performed before consent

Aggregate pre-consent storage count: 1

Assessment reconciliation: reconciled

Full evidence JSON

{
  "assessmentStatus": "review_signal",
  "checklistItemId": "pre_consent_cookies_storage",
  "coverageArea": "Pre-consent storage classification review",
  "evidenceState": "observed",
  "explanation": "Pre-consent storage was retained. 1 record remains unclassified. Review the retained storage inventory before drawing a conclusion.",
  "note": "Pre-consent storage was retained. 1 record remains unclassified. Review the retained storage inventory before drawing a conclusion.",
  "status": "Review signal",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.pre_consent_cookies_storage.review_signal",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.pre_consent_cookies_storage"
  },
  "statusBasis": "Pre-consent storage was retained. 1 record remains unclassified. Review the retained storage inventory before drawing a conclusion.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Inspect the listed cookie and storage identities, their purposes, and the retained timing evidence. Distinguish a directly observed write from snapshot presence.",
        "For items confirmed to require consent, gate their creation and use on the relevant affirmative choice; check the responsible tag or integration.",
        "Retest the same page and location in a fresh session. Verify those items are absent before consent and after Reject, and appear only after the applicable Accept choice."
      ]
    },
    "evidenceRefs": [
      "aws-waf-token (huggingface.co): unknown, present in periodic pre-consent snapshot",
      "Aggregate pre-consent storage count: 1",
      "Assessment reconciliation: reconciled"
    ],
    "cookiesSeenCount": 1,
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected retained concrete cookie/storage evidence for storage timing; request-only tracking evidence is not used as storage proof.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "limited",
    "cookiesBeforeConsentCount": 0,
    "selectedEvidenceArtifactId": "preConsentCookieOrStorageEvidence.missing",
    "preConsentStorageAssessment": {
      "status": "partially_classified",
      "evidenceRows": [
        {
          "name": "aws-waf-token",
          "party": "first_party",
          "domain": "huggingface.co",
          "category": "unknown",
          "storageType": "cookie",
          "essentiality": "unknown",
          "timingEvidence": "periodic_preconsent_snapshot",
          "exclusionReason": null,
          "firstObservedMs": 3413,
          "initiatorDomain": null,
          "initiatorVendor": null,
          "essentialitySource": "unknown",
          "exactStorageIdentity": "[\"aws-waf-token\",\".huggingface.co\",\"/\",null]"
        }
      ],
      "provenWriteCount": 0,
      "assessmentVersion": "pre-consent-storage-assessment-v1",
      "unclassifiedCount": 1,
      "reconciliationStatus": "reconciled",
      "snapshotPresenceCount": 1,
      "aggregateObservedCount": 1,
      "classifiedEssentialCount": 0,
      "classifiedNonEssentialCount": 0,
      "attributedPreConsentRecordCount": 1,
      "excludedFunctionalOrConsentCount": 0
    },
    "preConsentStorageAssessmentStatus": "partially_classified",
    "rowLevelEssentialityEvidenceRetained": true,
    "firstPreconsentCookieOrStorageObservedMs": 3413,
    "preConsentStorageClassificationLimitation": true,
    "preconsentCookieOrStorageExactTimingRetained": false,
    "eligibleNonEssentialCookieStorageFindingProjected": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Inspect the listed cookie and storage identities, their purposes, and the retained timing evidence. Distinguish a directly observed write from snapshot presence.
2For items confirmed to require consent, gate their creation and use on the relevant affirmative choice; check the responsible tag or integration.
3Retest the same page and location in a fresh session. Verify those items are absent before consent and after Reject, and appear only after the applicable Accept choice.

Session recordingNo session-recording service was detected during this scan.Not observed

JSON evidence

Context: browser API access retained

Observed host: huggingface.co

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "session_replay_fingerprinting_review",
  "coverageArea": "Session replay signal",
  "evidenceState": "not_observed",
  "explanation": "No eligible session replay, behavioral recording, or fingerprinting-like signal was observed in the tested context.",
  "note": "No eligible session replay, behavioral recording, or fingerprinting-like signal was observed in the tested context.",
  "status": "Not observed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.session_replay_fingerprinting_review.not_observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.session_replay_fingerprinting_review"
  },
  "statusBasis": "Browser API access was retained as device-identification context, but no session replay vendor or collection signal was observed. The browser/device context is evaluated separately in the device-identification row.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Context: browser API access retained",
      "Observed host: huggingface.co"
    ],
    "missingEvidenceNeeded": [],
    "sessionReplayObserved": false,
    "fingerprintingObserved": false,
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "missing",
    "selectedEvidenceArtifactId": "coverage_policy",
    "browserDeviceEntropyEvidence": {
      "hosts": [
        "huggingface.co"
      ],
      "observedMs": [
        3299,
        3300,
        3301
      ],
      "firstObservedMs": 3299,
      "browserApiSignals": [
        "Navigator.plugins",
        "HTMLCanvasElement.toDataURL",
        "CanvasRenderingContext2D.getImageData"
      ],
      "assessmentStrength": "contextual_only",
      "highEntropySignals": [
        "Navigator.plugins",
        "HTMLCanvasElement.toDataURL",
        "CanvasRenderingContext2D.getImageData",
        "plugins",
        "canvas"
      ],
      "assessmentContractVersion": "fingerprinting_evidence_assessment.v1",
      "entropyLinkedToIdentifier": false,
      "deviceDataLikeRequestCount": 0,
      "strongCorroboratorObserved": false,
      "entropyTransmissionObserved": false,
      "distinctAttributeFamilyCount": 2,
      "coordinatedSignalClusterObserved": false,
      "fingerprintingRuntimeEvidenceCount": 6
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Device fingerprintingNo device-fingerprinting activity was detected during this scan.Not observed

JSON evidence

Context only: browser capability access retained

Browser API access: Navigator.plugins

Browser API access: HTMLCanvasElement.toDataURL

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "device_identification_fingerprinting_signal_observed",
  "coverageArea": "Device identification / fingerprinting signal",
  "evidenceState": "not_observed",
  "explanation": "Whether browser/device entropy, fingerprinting, or identifier-like device collection signals were observed in retained runtime evidence.",
  "note": "Whether browser/device entropy, fingerprinting, or identifier-like device collection signals were observed in retained runtime evidence.",
  "status": "Not observed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.device_identification_fingerprinting_signal_observed.not_observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.device_identification_fingerprinting_signal_observed"
  },
  "statusBasis": "No eligible device-identification or fingerprinting signal was observed. Low-specificity browser capability access was retained as contextual evidence.",
  "retainedEvidence": {
    "evidenceRefs": [
      "Context only: browser capability access retained",
      "Browser API access: Navigator.plugins",
      "Browser API access: HTMLCanvasElement.toDataURL",
      "Browser API access: CanvasRenderingContext2D.getImageData",
      "Browser API access: plugins"
    ],
    "promotionEligible": false,
    "missingEvidenceNeeded": [],
    "fingerprintingObserved": false,
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "missing",
    "selectedEvidenceArtifactId": "coverage_policy",
    "browserDeviceEntropyEvidence": {
      "hosts": [
        "huggingface.co"
      ],
      "observedMs": [
        3299,
        3300,
        3301
      ],
      "firstObservedMs": 3299,
      "browserApiSignals": [
        "Navigator.plugins",
        "HTMLCanvasElement.toDataURL",
        "CanvasRenderingContext2D.getImageData"
      ],
      "assessmentStrength": "contextual_only",
      "highEntropySignals": [
        "Navigator.plugins",
        "HTMLCanvasElement.toDataURL",
        "CanvasRenderingContext2D.getImageData",
        "plugins",
        "canvas"
      ],
      "assessmentContractVersion": "fingerprinting_evidence_assessment.v1",
      "entropyLinkedToIdentifier": false,
      "deviceDataLikeRequestCount": 0,
      "strongCorroboratorObserved": false,
      "entropyTransmissionObserved": false,
      "distinctAttributeFamilyCount": 2,
      "coordinatedSignalClusterObserved": false,
      "fingerprintingRuntimeEvidenceCount": 6
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Connection security

5 checks · 5 observed

HTTPS deliveryThe scanned page used HTTPS.Observed

JSON evidence

ref_transport_security

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "transport_security_https_delivery",
  "coverageArea": "HTTPS delivery for scanned pages",
  "evidenceState": "observed",
  "explanation": "Whether the retained scanned page was served over HTTPS.",
  "note": "Whether the retained scanned page was served over HTTPS.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.transport_security_https_delivery.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.transport_security_https_delivery"
  },
  "statusBasis": "The scanned page was served over HTTPS in the retained transport observation.",
  "retainedEvidence": {
    "finalUrl": "https://huggingface.co/",
    "finalScheme": "https",
    "evidenceRefs": [
      "ref_transport_security"
    ],
    "httpProbeStatus": 200,
    "sampledPageUrls": [
      "https://huggingface.co/"
    ],
    "httpProbeOutcome": "redirected_to_https",
    "httpProbeFinalUrl": "https://huggingface.co/",
    "pageHttpsObserved": true,
    "tlsProbeAttempted": true,
    "formInventoryState": "complete",
    "formTransportCount": 1,
    "httpProbeAttempted": true,
    "validTlsCertificate": true,
    "httpProbeFinalScheme": "https",
    "httpRedirectsToHttps": true,
    "mixedContentObserved": false,
    "missingEvidenceNeeded": [],
    "httpProbeRedirectChain": [
      "http://huggingface.co/",
      "https://huggingface.co/"
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "moderate",
    "mixedContentObservedCount": 0,
    "selectedEvidenceArtifactId": "coverage_policy",
    "tlsCertificateObservations": [
      {
        "issuer": "CN=Amazon RSA 2048 M01, O=Amazon",
        "subject": "CN=huggingface.co",
        "validTo": "Feb 27 23:59:59 2027 GMT",
        "inputUrl": "https://huggingface.co/",
        "validFrom": "Aug 14 00:00:00 2026 GMT",
        "validCertificate": true,
        "chainCertificateCount": 4
      }
    ],
    "insecureFormTransportObserved": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

HTTPS certificateThe website's HTTPS certificate passed validation.Observed

JSON evidence

ref_transport_security

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "transport_security_tls_certificate",
  "coverageArea": "Valid SSL/TLS certificate",
  "evidenceState": "observed",
  "explanation": "Whether a strict TLS probe verified the HTTPS origin certificate separately from the normal scanner runtime.",
  "note": "Whether a strict TLS probe verified the HTTPS origin certificate separately from the normal scanner runtime.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.transport_security_tls_certificate.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.transport_security_tls_certificate"
  },
  "statusBasis": "Retained certificate validation verified the HTTPS origin certificate. Retained certificate evidence: https://huggingface.co/ presented CN=huggingface.co certificate valid Aug 14, 2026–Feb 27, 2027.",
  "retainedEvidence": {
    "finalUrl": "https://huggingface.co/",
    "finalScheme": "https",
    "evidenceRefs": [
      "ref_transport_security"
    ],
    "httpProbeStatus": 200,
    "sampledPageUrls": [
      "https://huggingface.co/"
    ],
    "httpProbeOutcome": "redirected_to_https",
    "httpProbeFinalUrl": "https://huggingface.co/",
    "pageHttpsObserved": true,
    "tlsProbeAttempted": true,
    "formInventoryState": "complete",
    "formTransportCount": 1,
    "httpProbeAttempted": true,
    "validTlsCertificate": true,
    "httpProbeFinalScheme": "https",
    "httpRedirectsToHttps": true,
    "mixedContentObserved": false,
    "missingEvidenceNeeded": [],
    "httpProbeRedirectChain": [
      "http://huggingface.co/",
      "https://huggingface.co/"
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "moderate",
    "mixedContentObservedCount": 0,
    "selectedEvidenceArtifactId": "coverage_policy",
    "tlsCertificateObservations": [
      {
        "issuer": "CN=Amazon RSA 2048 M01, O=Amazon",
        "subject": "CN=huggingface.co",
        "validTo": "Feb 27 23:59:59 2027 GMT",
        "inputUrl": "https://huggingface.co/",
        "validFrom": "Aug 14 00:00:00 2026 GMT",
        "validCertificate": true,
        "chainCertificateCount": 4
      }
    ],
    "insecureFormTransportObserved": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

HTTP-to-HTTPS redirectHTTP redirected to HTTPS.Observed

JSON evidence

ref_transport_security

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "transport_security_http_redirect",
  "coverageArea": "HTTP redirects to HTTPS",
  "evidenceState": "observed",
  "explanation": "Whether an explicit HTTP-origin probe redirected to HTTPS.",
  "note": "Whether an explicit HTTP-origin probe redirected to HTTPS.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.transport_security_http_redirect.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.transport_security_http_redirect"
  },
  "statusBasis": "The explicit HTTP-origin probe redirected to HTTPS.",
  "retainedEvidence": {
    "finalUrl": "https://huggingface.co/",
    "finalScheme": "https",
    "evidenceRefs": [
      "ref_transport_security"
    ],
    "httpProbeStatus": 200,
    "sampledPageUrls": [
      "https://huggingface.co/"
    ],
    "httpProbeOutcome": "redirected_to_https",
    "httpProbeFinalUrl": "https://huggingface.co/",
    "pageHttpsObserved": true,
    "tlsProbeAttempted": true,
    "formInventoryState": "complete",
    "formTransportCount": 1,
    "httpProbeAttempted": true,
    "validTlsCertificate": true,
    "httpProbeFinalScheme": "https",
    "httpRedirectsToHttps": true,
    "mixedContentObserved": false,
    "missingEvidenceNeeded": [],
    "httpProbeRedirectChain": [
      "http://huggingface.co/",
      "https://huggingface.co/"
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "moderate",
    "mixedContentObservedCount": 0,
    "selectedEvidenceArtifactId": "coverage_policy",
    "tlsCertificateObservations": [
      {
        "issuer": "CN=Amazon RSA 2048 M01, O=Amazon",
        "subject": "CN=huggingface.co",
        "validTo": "Feb 27 23:59:59 2027 GMT",
        "inputUrl": "https://huggingface.co/",
        "validFrom": "Aug 14 00:00:00 2026 GMT",
        "validCertificate": true,
        "chainCertificateCount": 4
      }
    ],
    "insecureFormTransportObserved": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Mixed contentNo insecure HTTP resources were found on the scanned HTTPS page.Observed

JSON evidence

ref_transport_security

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "transport_security_mixed_content",
  "coverageArea": "Mixed content",
  "evidenceState": "observed",
  "explanation": "Whether HTTP subresources were observed or blocked on a retained HTTPS page.",
  "note": "Whether HTTP subresources were observed or blocked on a retained HTTPS page.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.transport_security_mixed_content.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.transport_security_mixed_content"
  },
  "statusBasis": "No mixed-content HTTP subresources were retained for the scanned HTTPS page.",
  "retainedEvidence": {
    "finalUrl": "https://huggingface.co/",
    "finalScheme": "https",
    "evidenceRefs": [
      "ref_transport_security"
    ],
    "httpProbeStatus": 200,
    "sampledPageUrls": [
      "https://huggingface.co/"
    ],
    "httpProbeOutcome": "redirected_to_https",
    "httpProbeFinalUrl": "https://huggingface.co/",
    "pageHttpsObserved": true,
    "tlsProbeAttempted": true,
    "formInventoryState": "complete",
    "formTransportCount": 1,
    "httpProbeAttempted": true,
    "validTlsCertificate": true,
    "httpProbeFinalScheme": "https",
    "httpRedirectsToHttps": true,
    "mixedContentObserved": false,
    "missingEvidenceNeeded": [],
    "httpProbeRedirectChain": [
      "http://huggingface.co/",
      "https://huggingface.co/"
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "moderate",
    "mixedContentObservedCount": 0,
    "selectedEvidenceArtifactId": "coverage_policy",
    "tlsCertificateObservations": [
      {
        "issuer": "CN=Amazon RSA 2048 M01, O=Amazon",
        "subject": "CN=huggingface.co",
        "validTo": "Feb 27 23:59:59 2027 GMT",
        "inputUrl": "https://huggingface.co/",
        "validFrom": "Aug 14 00:00:00 2026 GMT",
        "validCertificate": true,
        "chainCertificateCount": 4
      }
    ],
    "insecureFormTransportObserved": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Form transport securityNo insecure form destinations were found during this scan.Observed

JSON evidence

ref_transport_security

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "transport_security_form_transport",
  "coverageArea": "Observed form transport",
  "evidenceState": "observed",
  "explanation": "Whether observed forms resolved to HTTPS transport without submitting form data.",
  "note": "Whether observed forms resolved to HTTPS transport without submitting form data.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.transport_security_form_transport.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.transport_security_form_transport"
  },
  "statusBasis": "No insecure observed form transport was retained for the scanned page.",
  "retainedEvidence": {
    "finalUrl": "https://huggingface.co/",
    "finalScheme": "https",
    "evidenceRefs": [
      "ref_transport_security"
    ],
    "httpProbeStatus": 200,
    "sampledPageUrls": [
      "https://huggingface.co/"
    ],
    "httpProbeOutcome": "redirected_to_https",
    "httpProbeFinalUrl": "https://huggingface.co/",
    "pageHttpsObserved": true,
    "tlsProbeAttempted": true,
    "formInventoryState": "complete",
    "formTransportCount": 1,
    "httpProbeAttempted": true,
    "validTlsCertificate": true,
    "httpProbeFinalScheme": "https",
    "httpRedirectsToHttps": true,
    "mixedContentObserved": false,
    "missingEvidenceNeeded": [],
    "httpProbeRedirectChain": [
      "http://huggingface.co/",
      "https://huggingface.co/"
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "moderate",
    "mixedContentObservedCount": 0,
    "selectedEvidenceArtifactId": "coverage_policy",
    "tlsCertificateObservations": [
      {
        "issuer": "CN=Amazon RSA 2048 M01, O=Amazon",
        "subject": "CN=huggingface.co",
        "validTo": "Feb 27 23:59:59 2027 GMT",
        "inputUrl": "https://huggingface.co/",
        "validFrom": "Aug 14 00:00:00 2026 GMT",
        "validCertificate": true,
        "chainCertificateCount": 4
      }
    ],
    "insecureFormTransportObserved": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Global Privacy Control

Response not determined

Limited

GPC comparisonThe paired scan could not determine whether classified tracking activity changed with GPC.Limited

No classified tracking requests were observed with GPC enabled.

Baseline → GPC

First 1,000 ms after each document commit

Observed requests	Baseline	GPC
Advertising / marketing	0	0
Analytics / session replay	0	0

How we measured this

Page request: Sec-GPC 1; browser setting: true.

60 retained request attempts; 60 retained requests with Sec-GPC.

GPC signal delivery was verified. The GPC lane did not reach the required 250 ms quiet period within the existing capture cap, so no response conclusion was made.

JSON evidence

{
  "assessment": {
    "contractVersion": "certscore.gpc-response-assessment.v3",
    "generatedAt": "2026-10-12T19:37:02.097Z",
    "status": "indeterminate",
    "findingTitle": "GPC response",
    "scoreEffect": "none",
    "legalInterpretation": "not_assessed",
    "comparison": {
      "comparable": false,
      "protocol": "passive_baseline_with_sec_gpc",
      "baselineArtifact": {
        "lane": "runtime_evidence",
        "sha256": "f77b9cd81b7370e90804a2ff79e1c8af1db37af51fd979049eb665c0510450b3",
        "sizeBytes": 433509,
        "uri": "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/cfe74173-c90a-48a7-859d-740b6c823180/lanes/runtime_evidence/CanonicalEvidenceBundle.json"
      },
      "gpcArtifact": {
        "lane": "gpc_observation",
        "sha256": "7f35b409bad9ac7217867cbc0c5d0a66b4ad58000abe54c17ff42388f3546893",
        "sizeBytes": 421494,
        "uri": "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/cfe74173-c90a-48a7-859d-740b6c823180/lanes/gpc_observation/CanonicalEvidenceBundle.json"
      },
      "enabledProof": {
        "secGpcHeaderValue": "1",
        "requestsWithSecGpc": 60,
        "requestEventIds": [
          "net_1040",
          "net_1043",
          "net_1045",
          "net_1047",
          "net_1049",
          "net_1051",
          "net_1053",
          "net_1055",
          "net_1063",
          "net_1065",
          "net_1068",
          "net_1070",
          "net_1072",
          "net_1074",
          "net_1076",
          "net_1078",
          "net_1080",
          "net_1082",
          "net_1084",
          "net_1086",
          "net_1088",
          "net_1090",
          "net_1092",
          "net_1094",
          "net_1096",
          "net_1098",
          "net_1100",
          "net_1102",
          "net_1104",
          "net_1106",
          "net_1108",
          "net_1110",
          "net_1112",
          "net_1114",
          "net_1118",
          "net_1125",
          "net_1146",
          "net_1150",
          "net_1153",
          "net_1155",
          "net_1157",
          "net_1159",
          "net_1161",
          "net_1163",
          "net_1165",
          "net_1167",
          "net_1169",
          "net_1171",
          "net_1173",
          "net_1184",
          "net_1189",
          "net_1192",
          "net_1196",
          "net_1199",
          "net_1202",
          "net_1204",
          "net_1207",
          "net_1209",
          "net_1211",
          "net_1213"
        ],
        "navigatorGlobalPrivacyControl": true
      },
      "delivery": {
        "status": "verified",
        "baseline": {
          "contractVersion": "certscore.gpc-signal-observation.v1",
          "expectedEnabled": false,
          "documentUrlSha256": "453cb49f45b2d3e3003607d9987cfb5ca578753f989a8319ebc27ad4ecfad156",
          "contextConfigSha256": "7a20ef851f83cb76f7294dc01169581c10ca30d0e11e444c9ec76cbcd4fd1bb3",
          "capturedAtMs": 3397,
          "documentStartedAtMs": 622,
          "frameCount": 1,
          "frames": [
            {
              "documentUrlSha256": "453cb49f45b2d3e3003607d9987cfb5ca578753f989a8319ebc27ad4ecfad156",
              "mainFrame": true,
              "navigatorValue": false
            }
          ],
          "workerCount": 0,
          "limitationKeys": []
        },
        "gpc": {
          "contractVersion": "certscore.gpc-signal-observation.v1",
          "expectedEnabled": true,
          "documentUrlSha256": "453cb49f45b2d3e3003607d9987cfb5ca578753f989a8319ebc27ad4ecfad156",
          "contextConfigSha256": "7a20ef851f83cb76f7294dc01169581c10ca30d0e11e444c9ec76cbcd4fd1bb3",
          "prototypeCaptureBinding": {
            "captureId": "a303609f-8bd5-4827-905d-5b369e1ac7a6",
            "documentIdentitySource": "cdp_loader_id",
            "documentToken": "1D4B18DBABE6FA9D9989E0ACB7E2D827"
          },
          "prototypeSessionSha256": "03e5d37fa2334e74db0a6e42640d1e9feb8d217e1f1fa322920e880128aa4f48",
          "capturedAtMs": 2861,
          "documentStartedAtMs": 545,
          "frameCount": 1,
          "frames": [
            {
              "documentUrlSha256": "453cb49f45b2d3e3003607d9987cfb5ca578753f989a8319ebc27ad4ecfad156",
              "mainFrame": true,
              "navigatorValue": true
            }
          ],
          "workerCount": 0,
          "limitationKeys": []
        }
      },
      "coverage": {
        "status": "limited",
        "comparedThroughMs": 2316
      },
      "responseBasis": "insufficient_evidence",
      "deltas": {
        "cookies": {
          "baselineCount": 1,
          "gpcCount": 1,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [
            "[\"aws-waf-token\",\".huggingface.co\",\"/\"]"
          ],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 1,
          "samplesTruncated": false
        },
        "webStorage": {
          "baselineCount": 2,
          "gpcCount": 2,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [
            "https://huggingface.co|localStorage|awswaf_session_storage",
            "https://huggingface.co|localStorage|awswaf_token_refresh_timestamp"
          ],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 2,
          "samplesTruncated": false
        },
        "trackers": {
          "baselineCount": 0,
          "gpcCount": 0,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 0,
          "samplesTruncated": false
        },
        "advertisingOrMeasurementActivity": {
          "baselineCount": 0,
          "gpcCount": 0,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 0,
          "samplesTruncated": false
        },
        "advertisingOrMarketingActivity": {
          "baselineCount": 0,
          "gpcCount": 0,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 0,
          "samplesTruncated": false
        },
        "consentOrCmpBehavior": {
          "baselineCount": 0,
          "gpcCount": 0,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 0,
          "samplesTruncated": false
        }
      },
      "evidenceRefs": [
        "net_1040",
        "net_1043",
        "net_1045",
        "net_1047",
        "net_1049",
        "net_1051",
        "net_1053",
        "net_1055",
        "net_1063",
        "net_1065",
        "net_1068",
        "net_1070",
        "net_1072",
        "net_1074",
        "net_1076",
        "net_1078",
        "net_1080",
        "net_1082",
        "net_1084",
        "net_1086",
        "net_1088",
        "net_1090",
        "net_1092",
        "net_1094",
        "net_1096",
        "net_1098",
        "net_1100",
        "net_1102",
        "net_1104",
        "net_1106",
        "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/cfe74173-c90a-48a7-859d-740b6c823180/lanes/gpc_observation/CanonicalEvidenceBundle.json",
        "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/cfe74173-c90a-48a7-859d-740b6c823180/lanes/runtime_evidence/CanonicalEvidenceBundle.json"
      ],
      "limitationKeys": [
        "gpc_settle_not_completed"
      ]
    },
    "observation": {
      "contractVersion": "certscore.gpc-bounded-observation.v1",
      "scope": "main_document_and_retained_http_requests",
      "status": "complete",
      "sourceSha256": "7f35b409bad9ac7217867cbc0c5d0a66b4ad58000abe54c17ff42388f3546893",
      "sessionSha256": "03e5d37fa2334e74db0a6e42640d1e9feb8d217e1f1fa322920e880128aa4f48",
      "documentUrlSha256": "453cb49f45b2d3e3003607d9987cfb5ca578753f989a8319ebc27ad4ecfad156",
      "delivery": {
        "httpHeaderRetained": true,
        "mainNavigatorReadbackRetained": true,
        "fullContextVerified": true
      },
      "semanticProbe": "unavailable",
      "registration": {
        "basis": "current_recorded_state",
        "sale": "unknown",
        "sharing": "unknown",
        "cmpGpcSignal": "unknown",
        "causedByGpc": "not_established"
      },
      "acknowledgment": {
        "observed": false,
        "captureComplete": true
      },
      "requests": {
        "count": 60,
        "blockedBeforeTransmissionCount": 0,
        "complete": true,
        "fromMs": 493,
        "documentCommittedAtMs": 606,
        "throughMs": 2932,
        "classifiedCount": 0,
        "collectionCount": 0,
        "evidenceIds": [],
        "samplesTruncated": false
      },
      "limitationKeys": [],
      "scoreEffect": "none",
      "legalInterpretation": "not_assessed"
    }
  },
  "evidenceRefs": [
    "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/cfe74173-c90a-48a7-859d-740b6c823180/lanes/runtime_evidence/CanonicalEvidenceBundle.json",
    "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/cfe74173-c90a-48a7-859d-740b6c823180/lanes/gpc_observation/CanonicalEvidenceBundle.json",
    "net_1040",
    "net_1043",
    "net_1045",
    "net_1047",
    "net_1049",
    "net_1051",
    "net_1053",
    "net_1055",
    "net_1063",
    "net_1065",
    "net_1068",
    "net_1070",
    "net_1072",
    "net_1074",
    "net_1076",
    "net_1078",
    "net_1080",
    "net_1082",
    "net_1084",
    "net_1086",
    "net_1088",
    "net_1090",
    "net_1092",
    "net_1094",
    "net_1096",
    "net_1098",
    "net_1100",
    "net_1102",
    "net_1104",
    "net_1106"
  ]
}

Loading report

Executive overview

Assessment highlights

Top issues on this page

Pre-consent page event timeline

Services & Resources

Type mix

Evidence mix

Purpose mix

Site relationship

Policy disclosure · Mentioned

Forms & fields

Form 1

Detailed evidence

CMP details

Consent management audit · 13 criteria

Consent choices

Tracking & embeds

Policies & disclosures

Accessibility (WCAG)

Cookies & tracking

Connection security

Global Privacy Control

Baseline → GPC