Skip to content
BlockchainSign

Privacy policy

Last updated 14 August 2026

This policy explains what BlockchainSign does with your information. The short version:

  • We never receive your files. Your browser computes a SHA-256 hash locally and only that hash is sent to us.
  • We keep your email address, your certificate details, and your purchase history, because we cannot deliver a certificate without them.
  • Our website analytics are self-hosted and cookieless. We run no advertising, no ad networks, and no cross-site tracking, and we do not sell or share your data for marketing.
  • One thing we cannot undo: the hash written to the Ethereum blockchain is public and permanent. See What goes on the blockchain.

1. Who we are

The data controller for the information described here is P/E Aleksei Khaliapin, an individual entrepreneur registered in Georgia, with registered address at street 07, house N07, Varkhani, Adigeni region 0305, Georgia. State registration number: [to be completed].

For any question about this policy, or to exercise the rights described in section 11, write to [email protected]. We have not appointed a data protection officer, as we are not required to.

2. Scope

This policy covers the website at blockchainsign.io, the application at app.blockchainsign.io, and the support we provide by email. Where we link to third-party services, their own policies apply to what they do; the ones we rely on are listed in section 7.

3. We never receive your files

This is the core of how the service is built, so it belongs at the top.

When you timestamp a document, your browser computes its SHA-256 hash using the Web Crypto API, on your own device. Only that 64-character hash is transmitted. There is no endpoint on our side that accepts file contents, and you can confirm this by watching your browser’s network tab while you use the tool.

A hash cannot be reversed into the file it came from. It does let anyone who already holds an identical copy of the file confirm that it matches.

4. What we collect, why, and on what basis

Account information. Your email address, any name you provide, how you signed in, and sign-in metadata such as timestamps, IP address and device information. Accounts are handled by our authentication provider, Clerk. We need this to give you an account and keep it secure. Legal basis: performance of our contract with you, and our legitimate interest in securing accounts.

Certificate information. For each certificate: the SHA-256 hash of every file it covers, the description you supply, the email address you choose to include (this is optional — see section 8), the resulting payload and payload hash, the Ethereum transaction hash and link, and the status and timestamps of the order. We need this to create and reissue your certificate. Legal basis: performance of our contract.

Your private labels. The optional name and notes you can attach to an order are for your own filing. They stay in our database, are never sent to our timestamping service, and never reach the payload, the certificate, or the blockchain. Legal basis: performance of our contract.

Purchase information. The package bought, the amount and currency, the payment provider, its checkout and payment references, the status, and the date. We never receive or store your card number, expiry date, or security code — those go directly to the payment provider. Legal basis: performance of our contract, and compliance with tax and accounting obligations.

Support correspondence. Emails you send us and our replies, including anything you choose to attach. Legal basis: performance of our contract, and our legitimate interest in answering and keeping a record of enquiries.

Technical and security data. Server logs and error reports containing IP address, browser and device information, pages or endpoints requested, and timestamps; plus signals used to block abusive traffic. Legal basis: our legitimate interest in operating a secure, working service and preventing fraud and abuse.

Website analytics. Aggregate counts of page views, referrers, countries, and clicks on a few buttons, collected by our self-hosted Plausible instance. Plausible sets no cookies, stores no identifier for you, does not follow you across sites, and produces statistics that cannot be traced back to an individual. Legal basis: our legitimate interest in understanding which pages are useful.

We do not use your data to make automated decisions with legal or similarly significant effects, and we do not profile you.

5. How we use it

We use the information above to create and deliver certificates and keep them verifiable; to run your account and let you sign in; to take payment, issue receipts, and handle refunds; to answer support requests; to keep the service secure and to detect and prevent fraud and abuse; to fix errors and improve the service; and to comply with our legal obligations.

We send service emails you cannot opt out of while you have an account, such as receipts, certificate confirmations, and important changes to these policies. We only send marketing email if you ask for it, and every marketing email has an unsubscribe link.

6. Cookies

The blockchainsign.io website sets no cookies at all. Our analytics are cookieless, which is why you see no cookie banner.

The application at app.blockchainsign.io uses only strictly necessary cookies: session and security cookies set by Clerk to keep you signed in and to protect against cross-site request forgery, and a cookie that remembers whether you left the dashboard sidebar open. These are required for the application to work and are not used for advertising or tracking.

We run no advertising cookies, no ad networks, no web beacons or tracking pixels, and no third-party marketing trackers. You can block or delete cookies in your browser, but the application cannot keep you signed in without the ones above.

7. Who else processes your data

We do not sell your personal data, and we do not share it for anyone else’s marketing. We share it only with the providers that operate parts of the service for us, each bound by a contract to use it only on our instructions:

  • Clerk — accounts and authentication (email address, name, sign-in metadata).
  • Creem — payment processing and the affiliate program (email address, purchase details, card data handled by them, never by us). Creem is our default checkout provider.
  • Stripe — payment processing, used as an alternative provider, on the same basis.
  • Sentry — error monitoring and diagnostics (error details, IP address, browser and device information, and account identifier). Session recordings are captured at a low sample rate for diagnosing faults, with all text and form input masked and media blocked, so the content of your notes and descriptions is not recorded.
  • Arcjet — protection against attacks and abusive traffic (IP address and request metadata).
  • Better Stack — application logging, where enabled (log entries, which may contain IP addresses and account identifiers).
  • Our hosting provider — [to be completed], which hosts the application, the database, and the timestamping service.

We also disclose information where we are legally required to, for example in response to a valid order from a competent authority, and we may transfer data to a successor if the business is sold, in which case this policy continues to apply until you are told otherwise.

8. What goes on the blockchain, and why it cannot be erased

Please read this section before you create a certificate.

We assemble your file hashes, your description, and any email address you chose to include into a certificate payload, take the SHA-256 hash of that payload, and write only that single hash into an Ethereum transaction. Your file, your description, and your email address are not written to the chain.

That transaction is public, permanent, and beyond anyone’s control once broadcast. Neither we nor you can edit, hide, or delete it. Closing your account, asking us to delete your data, or exercising the right of erasure cannot remove it, because we do not control the Ethereum network. That permanence is the point of the product, and it is also its one irreversible privacy consequence. Everything else we hold about you can be deleted.

If you include an email address, it appears in your certificate file in plain text. It is part of the payload, so it has to be there for anyone to reproduce the payload hash and verify the record, and it cannot be removed afterwards without invalidating the certificate. Whoever you show the certificate to therefore sees that address. Use one you are willing to disclose, or leave the field empty: no address is then written into the payload at all, and the certificate still verifies.

Do not put confidential information in the certificate description. It appears in the certificate file, and once its hash is on the chain the description cannot be changed without invalidating the certificate.

9. International transfers

We are established in Georgia and process data there. Our providers are located in other countries, including the United States and the European Union, so your data is transferred outside your own country when you use the service.

If you are in the European Economic Area or the United Kingdom, transfers to countries that have not received an adequacy decision are made under the European Commission’s Standard Contractual Clauses, or the UK Addendum where it applies, together with the additional measures our providers have in place. [Confirm before publishing: the safeguard you rely on for transfers to Georgia.] You can ask us for details of the safeguards that apply by writing to [email protected].

10. How long we keep it

Certificate and order records: for as long as you have an account, and afterwards for as long as needed to let you re-download or prove a certificate you paid for. Because certificates are meant to last, we keep them by default rather than deleting them, and you can ask us to delete yours at any time.

Purchase and payment records: for the period our tax and accounting obligations require, which is generally six years from the end of the year of the transaction.

Account data: for as long as your account is open. When you close it, we delete or anonymise your account data within 30 days, apart from what we must keep under the paragraph above.

Support emails: up to three years after the matter is closed.

Server logs and error reports: up to 90 days, other than where an entry is needed for an ongoing security investigation.

Analytics: aggregate statistics only, with no personal data, kept indefinitely.

The blockchain record described in section 8 is outside all of this and cannot be deleted.

11. Security

Access to production systems is restricted and authenticated. Traffic is encrypted in transit with TLS. Payment card data never reaches our systems. Our timestamping service holds the Ethereum private key in isolation, and the application can reach it only through an authenticated internal API. The strongest safeguard is structural: because your files never leave your browser, they cannot be exposed by any breach of ours.

No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the competent supervisory authority and, where required, you, without undue delay.

12. Your rights

Subject to the conditions in the law that applies to you, you have the right to:

  • access the personal data we hold about you and receive a copy;
  • rectify data that is inaccurate or incomplete;
  • erase your data, except where we must keep it and except for the blockchain record described in section 8;
  • restrict our processing in certain circumstances;
  • object to processing based on our legitimate interests, and to direct marketing at any time;
  • portability — receive the data you gave us in a structured, machine-readable format, or have it sent to another provider;
  • withdraw consent at any time where we rely on consent, without affecting processing already carried out; and
  • lodge a complaint with a supervisory authority.

To exercise any of these, email [email protected] from the address on your account. We respond within one month and may extend that by two further months for complex requests, telling you if we do. Exercising your rights is free; we may charge a reasonable fee, or decline, only where a request is manifestly unfounded or excessive, and we will explain why. We may ask you to confirm your identity before acting.

If you are in the EEA or the UK you may complain to the data protection authority in your country of residence, work, or where you think the problem occurred. If you are in Georgia, you may complain to the Personal Data Protection Service of Georgia. We would rather hear from you first, so please give us the chance to put it right.

13. Residents of US states

If you live in a US state with a consumer privacy law, such as California, you may have the right to know what personal information we collect and why, to receive a copy of it, to correct it, to delete it, and not to be treated differently for exercising those rights.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the past twelve months, so there is nothing to opt out of.

To make a request, email [email protected]. We confirm receipt within 10 business days and respond within 45 days, extending by a further 45 days where necessary and telling you if we do. You may use an authorised agent, in which case we will ask for proof of their authority.

14. Children

The service is for adults. You must be at least 18 to use it, and we do not knowingly collect personal data from anyone under that age. If you believe a child has given us personal data, write to [email protected] and we will delete it.

15. Changes to this policy

We update this policy when the service or the law changes. The date at the top always shows the current version. If a change materially affects how we use your data, we will tell you by email or in the application before it takes effect.

16. Contact

Questions, requests, and complaints about privacy:

[email protected]

P/E Aleksei Khaliapin
street 07, house N07, Varkhani
Adigeni region 0305, Georgia