DocsChain Privacy Policy

1. Introduction

DocsChain Technologies is committed to protecting your privacy and ensuring the security of your personal data.
This Privacy Policy explains how we collect, use, store, share, and protect information when you use the DocsChain platform, which provides blockchain-based document certification and verification services on the Polygon network.

By using DocsChain, registering an account, or accessing any of our services, you agree to this Privacy Policy and consent to our data practices as described herein.

2. Scope of the Policy

This Privacy Policy applies to all DocsChain services, including but not limited to:

• Document upload, certification, and verification.
• User registration, authentication, and account management.
• Payment and subscription processing.
• Customer support and ticketing.
• APIs and integrations with third-party systems.

This policy covers all users, including individuals, organizations, and verifiers accessing DocsChain via web, mobile, or API.

3. Information We Collect

A. Personal Information

We collect personal information when you register, subscribe, or interact with the platform, including:

• Full name
• Email address and phone number
• Organization or company name (for institutional users)
• Payment and billing details
• IP address, browser type, device information
• Login logs and user activity records

B. Document Data

• DocsChain does not store your document content unless you explicitly authorize it.
• We generate and store only a cryptographic hash (digital fingerprint) of each document on the Polygon blockchain.
• If decentralized or cloud storage (e.g., IPFS) is used, documents are encrypted before upload.

C. Payment Data

• All payment transactions are processed via secure third-party gateways such as Moyasar or approved crypto wallets.
• DocsChain does not store credit card details or private wallet keys.

4. How We Use Your Data

We use collected information solely for legitimate business purposes, including:

1. Service Delivery
   

   • Enable document upload, certification, and verification.
   • Manage accounts, subscriptions, and transactions.

2. Platform Improvement
   
   

   • Analyze usage trends to enhance performance, usability, and reliability.

3. Security and Compliance
   
   

   • Verify user identity and prevent fraud or unauthorized activity.
   • Fulfill legal and regulatory obligations, including anti-fraud and data protection requirements.

4. Communication and Support
   

   • Provide notifications about document status, subscription renewals, or security alerts.
   • Respond to user inquiries and support tickets.

5. Marketing (Optional)
   

   • Send newsletters or promotional content only with explicit user consent.

5. Legal Basis for Processing

DocsChain processes data based on one or more of the following lawful grounds:

• User consent (e.g., during registration or when opting in to marketing).
• Performance of a contract (to provide paid or subscribed services).
• Legal obligations (compliance with Saudi PDPL and other applicable regulations).
• Legitimate interest (ensuring security, improving services, preventing fraud).

6. Data Security and Protection

We apply industry-standard security measures to protect your information:

1. Encryption:
   

   • Data in transit is encrypted using TLS/SSL.
   • Data at rest is encrypted using AES-256.

2. Access Control:
   

   • Role-Based Access Control (RBAC) restricts system access by privilege level.

3. Two-Factor Authentication (2FA):
   

   • Mandatory for admin and institutional accounts.

4. Auditing and Monitoring:
   

   • Regular security audits, penetration tests, and smart contract reviews.

5. Decentralized Storage:
   

   • When applicable, encrypted storage through IPFS or equivalent systems is used.

6. Data Retention Limitation:
   

   • Personal data is retained only as long as necessary for its intended purpose or as required by law.

7. Data Sharing with Third Parties

DocsChain may share limited data with trusted third-party service providers to operate efficiently, including:

• Payment Processors: Moyasar and approved crypto payment gateways.
• Cloud Infrastructure Providers: AWS, Google Cloud, or Microsoft Azure.
• Analytics Tools: Usage metrics to improve service performance.
• Regulatory Authorities: When required by law or court order.

DocsChain does not sell, rent, or trade user data to third parties for commercial purposes.

8. Cookies and Tracking Technologies

DocsChain uses cookies and similar technologies to enhance user experience, such as:

• Maintaining login sessions.
• Saving language and preference settings.
• Collecting analytics for performance optimization.

You can control or disable cookies through your browser settings; however, certain features may not function properly without them.

9. Data Retention

• Account Data: Retained as long as the account is active or as required by law.
• Document Hashes: Permanently recorded on the blockchain (immutable).
• Transaction Data: Retained for a minimum of five (5) years for accounting and compliance purposes.

10. Your Data Rights

Under applicable laws (including GDPR and Saudi PDPL), you have the following rights:

1. Access – Request a copy of your personal data.
2. Rectification – Correct inaccurate or incomplete information.
3. Deletion – Request deletion of your account and related personal data (except immutable blockchain records).
4. Withdrawal of Consent – Withdraw consent at any time for specific data uses.
5. Restriction of Processing – Limit the way your data is used in certain cases.
6. Objection – Object to processing for marketing or analytics purposes.

To exercise any of these rights, contact us at [email protected] with proof of identity.

11. Children’s Privacy

DocsChain services are not intended for children under 18 years of age.
We do not knowingly collect or process personal information from minors.
If such data is inadvertently collected, it will be deleted immediately upon discovery.

12. External Links

DocsChain may contain links to third-party websites or applications.
We are not responsible for their content, privacy practices, or data policies.
We encourage users to review the privacy policies of those external services before interaction.

13. Camera Access

Our application may request permission to access your device’s camera. This access is used solely to capture documents or images required before minting or verifying them through blockchain technology using the Venly tool.

• The camera is not used for continuous background recording.

• All images or document captures remain under your control and are processed securely for the purpose of document verification only.

• We do not store, share, or analyze your camera data beyond the scope of this verification process.

14. Storage Access

The app may also require access to your device storage or file system to allow you to upload existing documents for verification and minting on the blockchain through Venly.

• This access is used exclusively to select, read, and process documents that you choose to verify.

• The app will never modify or delete files on your device without your consent.

• Any document data processed for minting is handled securely, and when applicable, encrypted before being transmitted to blockchain services.

15. Contact Access

The application may request access to your contacts to enable you to share verified or minted documents directly with trusted recipients.

• This access is optional and is only used when you choose to share documents.

• We do not collect, store, or transmit your contacts to our servers.

• Shared documents are sent securely through your chosen communication channels.

16. Data Security

We take your privacy seriously. All interactions with blockchain tools such as Venly occur over secure, encrypted connections. Sensitive information (e.g., documents or metadata) is processed in compliance with relevant data protection laws and best practices.

17. User Consent 

By granting these permissions (Camera, Documents, Contacts), you agree that they are used only for the purposes described above. You can revoke permissions at any time in your device settings.

18. Changes to this Privacy Policy

DocsChain reserves the right to update or modify this Privacy Policy at any time.
Any significant changes will be communicated via email or platform notification.
Continued use of the platform after updates constitutes acceptance of the revised policy.

19. Legal and Regulatory Compliance

DocsChain complies with all applicable data protection regulations, including:

• Saudi Personal Data Protection Law (PDPL)
• EU General Data Protection Regulation (GDPR)
• California Consumer Privacy Act (CCPA)
• Saudi Anti-Cybercrime Law

20. Contact Us

For privacy inquiries, data access requests, or complaints, please contact:

DocsChain Technologies
[email protected]
www.docschain.io
Riyadh, Kingdom of Saudi Arabia

21. Acknowledgment and Consent

By creating an account or using DocsChain services, you confirm that you have read, understood, and agreed to this Privacy Policy and consent to the collection and processing of your personal data as described herein.