Privacy Policy

Chaindoc provides blockchain-backed document workflows and electronic signatures. This Privacy Policy explains how we collect, use, share, and protect personal data when you use Chaindoc products, visit our sites, or interact with our team.

Chaindoc acts as a processor for documents, signatures, and audit trails you upload to the platform. We act as a controller for account administration, billing, product analytics, marketing communications (where permitted), security monitoring, and site operations.

Account and billing data

• Workspace details, billing contacts, plan selections, and administrator credentials.
• Authentication data needed for MFA and device trust.

Transaction data

• Document metadata (file names, MIME types, expiry windows) and encrypted signature payloads.
• Immutable blockchain hashes proving document state at signing time.
• System logs for who initiated, viewed, or completed signing workflows.

Technical and usage data

• IP address, device and browser information, language, timestamps, session identifiers.
• Aggregated product analytics on feature adoption and reliability (e.g., API latency, webhook delivery).

Communications

• Messages you send to Chaindoc (support, sales, partnerships) and survey responses.

• Provide, secure, and improve document preparation, signing, and verification features.
• Maintain immutable audit trails and compliance evidence.
• Deliver customer support, incident response, and service communications.
• Operate product analytics to guide reliability and usability improvements.
• Send marketing communications where permitted and honor your opt-out choices.

We process personal data based on: (a) contract performance (providing Chaindoc services), (b) legitimate interests (security, fraud prevention, service improvement), (c) consent (where required for marketing or cookies), and (d) legal obligations.

Chaindoc uses cookies and similar technologies to secure sessions, remember workspace preferences, and understand product adoption. Optional analytics or marketing cookies run only with appropriate consent. Manage preferences in the Cookie Manager or your browser settings.

We use vetted infrastructure and service providers (for example cloud hosting, security, analytics, support tools). Subprocessors receive only the data necessary to perform their services and are bound by confidentiality and security obligations. We do not sell personal data.

Data may be processed in the EU, US, or other locations where Chaindoc or its subprocessors operate. When required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.

We apply layered security including encryption in transit and at rest, dedicated signing enclaves, access controls, logging, continuous vulnerability testing, and independent audits (e.g., SOC 2 Type II, ISO/IEC 27001). Access to production systems is limited to authorized personnel under least-privilege principles.

We retain customer workspace data for the subscription term and any legally required periods. You may export or delete documents at any time; blockchain hashes remain immutable but do not reveal document contents. Backups are encrypted with scheduled deletion.

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing or withdraw consent. Submit requests to legal@chaindoc.io and we will respond within applicable timelines.

Chaindoc is not directed to children under 16, and we do not knowingly collect their personal data.

We may update this Privacy Policy to reflect legal, technical, or business changes. Material updates will be notified through the product, email, or our site before they take effect when required.

Questions about this policy or our data protection practices can be sent to legal@chaindoc.io.

Company address

Harju maakond, Tallinn, Lasnamäe linnaosa, Katusepapi tn 6-502, 11412, Estonia.