Privacy Policy

Last updated: 20 July 2026

1. What we hold

• Account holders: name, email, authentication data, billing records (via Stripe).
• Signers (no account needed): the name you type, your email, your entity and title if you sign for a company.
• Assent evidence: IP addresses, device user-agents, server timestamps, hashed one-time codes, WebAuthn public keys and assertions, and the transcript of any questions you asked the AI about the document.
• Content: the agreement variables (including the purpose line), executed PDFs, and certificates.

2. Why (lawful bases)

We process signing and delivery data to perform the signing service both parties engage us for (contract). We retain evidence records under our and both parties' legitimate interest in being able to prove the agreement was formed. Marketing is consent-only. For the content of what you discuss under an NDA, each party is an independent controller of their own copy; we hold only what the service needs.

3. Deletion — and the other party's copy

If you ask us to erase your data, we will delete your account, drafts, unexecuted ceremonies, and marketing data. We will not delete executed agreements, certificates, or their evidence records during the retention period: the other party has an equal right to proof of their contract, and retention for the establishment, exercise, or defence of legal claims is exempt from erasure (GDPR art. 17(3)(e)). Instead, the record is restricted — retained but not used — until the retention period ends, when it is purged for everyone.

4. Retention schedule

• Executed records: the NDA term + 6 years (default cap 7 years).
• Declined, cancelled, and never-signed expired ceremonies: personal data redacted after 30 days.
• One-time-code hashes: purged within 24 hours of ceremony close.
• Server logs: 90 days. Accounts: life of the account + 30 days.

5. Your rights

You can access, export (your executed PDFs and evidence records), correct, and — subject to section 3 — erase your data. Contact support@caseliq.com. EU/UK users may complain to their supervisory authority.

6. Cookies

We set strictly necessary first-party cookies only (session, security). No advertising or third-party analytics cookies — which is why there is no cookie banner.

7. Processors and transfers

We use a small set of subprocessors (hosting, email, payments) listed on the subprocessors page. Where data leaves the UK/EU we rely on adequacy decisions, the EU–US Data Privacy Framework, or standard contractual clauses.

Contact: support@caseliq.com