Privacy notice
Version 0.1 (draft), 5 October 2026
Controller
AI 4 WATER LTD (company 15070420, England and Wales), [email protected].
What we store and why
| Data | Purpose | Kept |
|---|---|---|
| Name, e-mail, organisation, trial request text | Create and run your account, send sign-in links | While your account exists |
| Your signature image and your signing certificate's private key | Sign documents as you | While your account exists |
| Documents you sign and their records (purpose, description, dates, events, SHA-256) | Give you the signed file again, let others verify it, keep the audit trail | Records and fingerprints indefinitely for verification; signed files until you ask us to delete them |
| API key fingerprints and last-used time | Authenticate your systems | Until you revoke the key |
| IP addresses | Rate limiting against abuse, in memory only | Not stored |
Account and record data are encrypted at rest; e-mail addresses are only stored in readable form inside that encrypted data. What anyone with a QR code can see is limited to the signer's name, the public description you chose, the dates, the record state and the document fingerprint.
Who processes data for us
- Stripe (payments). Card details go to Stripe directly and never reach us.
- Brevo (sending sign-in e-mails: your name and address).
- Cloudflare (secure network connection to our server).
The service runs on our own server in the Netherlands. We do not use your documents to train AI models and do not send them to any AI service. If you connect your own AI agent, what that agent does with your documents is governed by your agreement with its provider.
Your rights
You can ask for a copy of your data, its correction or deletion, or object to processing, by writing to [email protected]. Deleting an account removes your personal data and signed files; the public ledger keeps only fingerprints that do not reveal content. You may complain to the UK Information Commissioner's Office or your local data protection authority.