Privacy Policy

1. Data we collect

Account data: your name and email address, and, if you use social or passkey sign-in, the associated identifier or public credential (never your biometric or password).

Document and signer data: the documents you upload and the names, email addresses and (optionally) phone numbers of signers you invite.

Signing audit data: verification events, consent records, timestamps, IP address and browser/user-agent, retained as part of the signature audit trail.

Billing data: your plan and subscription status, and invoice references. Card payments are handled by Stripe; we do not store full card numbers.

Usage and support data: technical logs needed to run and secure the Service, and the content of support requests you send us.

2. How we use data and our legal bases

To provide the Service and perform our contract with you (accounts, sending, signing, verification, billing).

To secure the Service and prevent fraud and abuse (our legitimate interests).

To comply with legal obligations (for example, keeping records required by law).

To communicate with you about the Service, and — only where you have opted in — to generate an AI summary of a document (see below) or send you marketing.

3. How your documents are handled

Uploaded and executed files are stored in private, access-controlled storage (Vercel Blob) and are automatically deleted after 30 days. Only the SHA-256 hash of a document is written to the public Polygon and Bitcoin blockchains. A hash is a one-way fingerprint: it lets anyone confirm a document has not changed, but it cannot be reversed to reveal the document’s contents.

4. Optional AI document summaries

If the sender explicitly opts in, we generate a plain-language summary of a document to help signers, using Anthropic’s API. This processing happens only with that consent, and the content is not used to train AI models.

5. Subprocessors

We share personal data with the following subprocessors solely to provide the Service: Vercel (hosting, file storage and privacy-friendly analytics), Neon (database), Stripe (payments), Brevo (transactional and, where consented, marketing email), and Anthropic (optional AI summaries). Document hashes are published to the public Polygon and Bitcoin networks.

6. International transfers

Some subprocessors process data outside the UK/EEA (for example in the United States). Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement / EU Standard Contractual Clauses.

7. Retention

We keep account data while your account is active. Uploaded and executed documents are deleted after 30 days. Signature audit records and billing records are kept as long as needed for legal, evidential and accounting purposes. On-chain hashes are permanent and cannot be deleted.

8. Your rights

Subject to applicable law, you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. You can exercise these rights, including deleting your account, from your account settings or by emailing us. You also have the right to complain to the UK Information Commissioner’s Office (ICO) or your local supervisory authority.

9. Security

We protect data with encryption in transit, access controls and the principle of least privilege. Documents are identified and verified by cryptographic hash. No system is perfectly secure, but we work to protect your data and to notify you and regulators of incidents where required.

10. Cookies

We use only strictly necessary and preference cookies. See our Cookie Policy for details.

11. Children

The Service is not directed to children under 18 and we do not knowingly collect their data.

12. Changes and contact

We may update this Policy and will post changes here. For any question or request, contact support@bascribe.com. Controller: Aletheia Tech Ltd, a company incorporated in England and Wales, with its registered office in London, United Kingdom (“BAScribe”, “we”, “us”, “our”).