Data Protection

The Watch Desk is a private record room. Your watches, serials, documents, and media are visible to you and to no one else unless you deliberately share them through a controlled packet. Serial numbers are treated as the most sensitive field we hold: they are encrypted, redacted by default in any shared or support view, and never placed in a public surface or broad search index.

Optional AI features follow the same rule. When you use AI intake to read a watch from photos, images of the serial are excluded unless you explicitly choose serial reading for that single run — and even then the image is processed without storage or training use, and you confirm the result before anything is saved.

The possession check works the same way. An AI model reads the code photo only if you tick that option when you submit, and we keep only whether the code could be read, never what it read or a copy of the photo. A reviewer looks at your photos either way.

We are building a permissioned service that compares documented theft reports with records from sources that have given us written permission — registries, marketplaces with official APIs, and collector communities whose operators choose to take part. Its only purpose is to surface a possible re-appearance of a specifically reported stolen watch so that a human can review it and lawful recovery can be pursued.

What this service is not, by construction:

• Not a scraper. No source is read without recorded permission, and a source can halt us instantly with its own kill switch.
• Not an accusation engine. No machine output ever labels a person or a listing as stolen; every meaningful candidate passes human review before any external step, and image similarity alone is never treated as a match.
• Not a public serial directory. Full serials are restricted evidence — encrypted, access-logged, and never published or broadly indexed.
• Not a profiling tool. Records are minimized to watch-identity fields; seller and member identities are restricted, never published, and never used for any secondary purpose.
• Not a training dataset. Source data is never used to train models unless a source expressly permits it, which is denied by default.

• Every external source has a machine-checked permission record. Missing, expired, suspended, or narrower-than-requested permission means the connector does not run.
• Each processing step is gated: what may be collected, what may be derived (such as image fingerprints), how long it may be kept, and where it may be stored are enforced per source, not left to habit.
• Each source has a retention limit on record, and deletion is automatic: a record and everything derived from it are deleted once its retention window passes, or once the deletion deadline set when its source leaves. The deletion check runs every hour, and every run is logged and verified. Two kinds of record are kept back and reported instead: data under a legal hold, and records tied to a collector's theft report or watch.
• Referrals to an authorized recipient are minimized and logged; sensitive evidence travels only under an explicit consent gate.
• Public statistics are switched off until their exact counting method passes legal, security, evidence, and product sign-off — so we cannot quietly inflate claims.

Because this work involves comparing datasets, monitoring publicly accessible sources, and theft-adjacent context, it meets the legal threshold for a Data Protection Impact Assessment (DPIA) under UK and EU law. We treat the DPIA as a blocking gate, not paperwork: production matching stays disabled until the assessment is completed and signed, with independent counsel consulted.

Current status, stated plainly: a working draft of the assessment and its underlying data map exist and are maintained alongside the code, and the production matching gate is closed. We will update this page as the assessment progresses. We publish this status because we would rather be checked than trusted blindly.

If you believe data about you — a listing, a forum post, a record — has been processed by this work, you can object, request correction or deletion, or contest a match. Write to support@crownquorum.com and we will respond through a documented workflow rather than an ad-hoc reply. Source operators (such as forum owners) additionally hold their own controls: correction and removal routes, visible activity logs, and an immediate stop mechanism.

This page is a summary, and summaries deserve scrutiny. If you find a gap between what this page promises and what the product does, or you are a privacy professional who wants the underlying framework in more detail, contact us at the address above. Corrections are welcome and acted on.