Privacy Policy

Last updated: May 17, 2026 · GDPR Aware CCPA Aware HIPAA Controls

1. Information We Collect

We collect information you provide directly:

Account information: Name, email address, password (hashed), company name
Documents: PDFs you upload for processing and authentication
Signing data: Signer name, email, IP address, timestamp, browser agent
Payment information: Processed securely by Stripe — we do not store card details
Usage data: IP address, browser type, pages visited, actions taken, session duration
API usage: API key usage logs, request counts, timestamps

2. How We Use Your Information

Provide, maintain, and improve the Service
Process payments and send receipts
Send service notifications (expiry alerts, signing reminders, renewal confirmations)
Generate blockchain records (document hashes only — not content)
Maintain security and prevent fraud
Comply with legal obligations
Send weekly platform summaries (admin only)

3. Document Privacy

Your documents are private by default. We do not read, analyze, sell, or share your documents. Documents marked as "public" can be accessed by anyone with the share link. Blockchain records contain cryptographic hashes of documents only — not document content. Your documents are encrypted at rest using AES-256 encryption.

4. Data Retention

Account Lifecycle

Free accounts remain active for 365 days from registration. Paid subscriptions remain active for the duration of your current billing period. We send email notifications 30, 7, and 2 days before your account or subscription expires.

After expiry or subscription cancellation, your account enters a 30-day grace period with read-only access. During grace, you may renew your subscription, continue on a free plan (where eligible), or request immediate deletion. Reminder emails are sent at 7, 23, and 28 days into the grace period. If no action is taken by the end of grace, your account and all associated data are permanently deleted.

Retention Schedule

Active account data: Retained while your account is active
Documents you delete: Permanently purged within 30 days
Account deletion (by your choice or at end of grace): All account data — documents, signing records, audit trails, API keys, invoices, and payment records — is permanently and irrevocably deleted from our systems
Payment records held by Stripe: Stripe, our payment processor, retains transaction records independently for 7 years as the merchant of record. We do not control these records after our copies are deleted.
Login & security logs: 90 days
API usage logs: 90 days
Blockchain records: Cryptographic hashes recorded on Hyperledger Fabric are permanent and cannot be deleted. These hashes contain no personal data and no document content.

Important: If you require signed documents, audit trails, or invoices for legal, tax, or compliance purposes, please download them locally before account deletion or before your grace period expires. We cannot restore data once an account has been deleted.

5. Data Sharing

We do not sell your personal data. We share data only with:

Stripe: Payment processing
Hostinger: Email delivery via SMTP
Law enforcement: When required by valid legal process

All third-party processors are contractually bound to protect your data.

6. Security Measures

Technical Safeguards

TLS 1.2+ encryption for all data in transit
AES-256 encryption for data at rest
Bcrypt password hashing (never stored in plaintext)
Two-factor authentication (2FA) for all accounts
Rate limiting and account lockout protection
Virus scanning on all uploaded files (ClamAV)
CSRF protection on all forms and API endpoints
Automated daily database backups with offsite storage
Monthly secret key rotation
Comprehensive audit logging
Session timeout controls (7 days customer, 30 minutes admin)

These controls are consistent with HIPAA Technical Safeguard requirements under 45 CFR § 164.312.

7. GDPR Rights (EU Residents)

If you are located in the European Union, you have the following rights under GDPR:

Right of access: Request a copy of your personal data
Right to rectification: Correct inaccurate data
Right to erasure: Request immediate deletion of your data at any time, including during your subscription, from your account dashboard or by contacting support
Right to portability: Receive your data in a machine-readable format
Right to object: Object to processing of your data
Right to restriction: Request restriction of processing

To exercise any of these rights, contact [email protected]. We will respond within 30 days. For EU data processing details, see our Data Processing Agreement.

8. CCPA Rights (California Residents)

California residents have the right to know what personal information is collected, request deletion of personal information, and opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact [email protected].

9. HIPAA Notice

Health Information Notice

Credible Documents has implemented security controls consistent with HIPAA Technical Safeguard requirements. However, we are not currently HIPAA certified and do not offer a Business Associate Agreement (BAA). HIPAA certification is on our product roadmap. If you process Protected Health Information (PHI), you are responsible for ensuring compliance with applicable regulations.

10. Data Transfers

Your data is currently stored and processed in the United States. If you are located outside the US, your data will be transferred to and processed in the US. By using the Service, you consent to this transfer. We are working toward EU data residency options as a future product milestone.

11. Cookies

We use session cookies for authentication only. We do not use tracking, advertising, or analytics cookies. We do not use Google Analytics or similar third-party tracking services.

12. Children's Privacy

The Service is not directed to children under 18. We do not knowingly collect data from minors. If you believe we have collected data from a minor, contact us immediately.

13. Changes to This Policy

We may update this policy periodically. We will notify you of significant changes via email. Continued use of the Service after changes constitutes acceptance.

14. Contact & Data Controller

Blakiston Peak LLC is the data controller for personal data processed through Credible Documents.

13459 Romford Ave
Port Charlotte, FL 33981
United States

[email protected]