Privacy Policy
Last updated: 21 October 2026
1. Controller
This policy applies to personal data processed by Asqav where Asqav acts as controller: your account, authentication, website visits, analytics, transactional and newsletter email, and support correspondence.
Where Asqav processes data you place inside receipts and signature metadata on your behalf, Asqav acts as your processor. For that data, your organization is the controller and the Data Processing Agreement governs. Data subjects whose data appears in receipts should contact you (the customer) directly.
Contact for privacy questions: info@asqav.com. We have not appointed a Data Protection Officer; privacy questions go to the same address. You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or your local supervisory authority.
We do not use automated decision-making that produces legal effects on data subjects.
2. What we collect and why
| Purpose | Data | Legal basis |
|---|---|---|
| Account creation, login, MFA | Email, password hash (Argon2id), org membership | Art 6(1)(b) contract |
| Sign-in with Google, GitHub or Microsoft | Name, email address, the provider's account ID and profile picture link, and the sign-in tokens the provider issues | Art 6(1)(b) contract |
| Providing the service | API keys, agent records, signature metadata, usage counters | Art 6(1)(b) contract |
| Paid plans and billing (Stripe) | Email address, plan and billing period, payment and subscription status, Stripe customer and subscription IDs (you enter card details on Stripe's checkout page, and they never reach Asqav) | Art 6(1)(b) contract |
| Security: access logs, auth logs, fraud prevention | IP, user agent, key-access log rows, auth events | Art 6(1)(f) legitimate interest (security of the service) |
| Breached-password screening at signup | 5-char SHA-1 prefix of password only, never the password | Art 6(1)(f) legitimate interest |
| Transactional email (Resend) | Email address, message content | Art 6(1)(b) contract |
| Newsletter | Email address | Art 6(1)(a) consent, withdrawable via unsubscribe |
| Product analytics (Mixpanel EU) | Usage events, device identifiers | Art 6(1)(a) consent via the banner, withdrawable |
| Learning which companies visit our public pages (Leadfeeder by Dealfront) | IP address, matched to the company it belongs to; pages viewed, visit time and referrer; a random visitor ID in the _lfa cookie |
Art 6(1)(a) consent via the banner, withdrawable |
| Notices of illegal content and our decisions on them (how to report) | Your name and email address, the notice and our correspondence | Art 6(1)(c) legal obligation under the EU Digital Services Act |
| Bookkeeping and tax records | Invoicing and account records | Art 6(1)(c) legal obligation |
3. Data Security
- All data is encrypted in transit using TLS 1.2 or higher (TLS 1.3 preferred).
- Passwords are hashed using Argon2id.
- API keys are hashed and never stored in plaintext.
- Session logs use ML-DSA cryptographic signatures for tamper-evident audit trails.
- If a personal-data breach affecting your account data occurs, we notify affected customers without undue delay.
4. Data Retention
We retain your data for as long as your account is active or as needed to provide services. Signature record retention by plan:
- Free: up to 30 days, unless a compliance retention floor applies as described below
- Pro: up to 1 year, unless a compliance retention floor applies as described below
- Business: up to 3 years, unless a compliance retention floor applies as described below
- Enterprise: custom retention period per your agreement
When an organisation signs any receipt in compliance mode or declares a regulated regime via compliance_regimes, the longest applicable retention floor governs in addition to the plan baseline above. Signing in compliance mode alone extends retention for all of the organisation's signature records and activity logs to at least 184 days, or longer where a specific regulation requires it. The full regime-by-regime table is on /data-handling. The per-regime mapping is at /docs/compliance. The receipt format itself is profiled in the IETF Internet-Draft draft-marques-asqav-compliance-receipts.
We keep billing records, such as invoices and payment records, for seven years, the period Dutch law sets for business records (Ondernemersplein). We keep notices of illegal content, and our decisions on them, for as long as we need them to handle the notice, any request to review the decision, and repeat notices about the same account.
The server is backed up daily through Hetzner's automated snapshot service, held on separate backup infrastructure in the EU. A second database copy is kept in a daily set held off the server.
5. Your Rights
Under GDPR you have the right to:
- Access your personal data.
- Correct inaccurate data (via account settings or info@asqav.com).
- Request deletion of your data. Email info@asqav.com and we will delete your account data within 30 days. Hashes anchored to public timestamping services cannot be withdrawn once anchored. What gets anchored is a digest over the receipt's signed bytes, not a digest of your action context. Those bytes carry a 128-bit random action identifier and server-assigned timestamps, so the anchored value cannot be matched back to a guessed action.
- Export your data (account data and receipt metadata) by writing to info@asqav.com.
- Object to or restrict specific processing by writing to info@asqav.com.
- Withdraw consent for analytics at any time via the cookie preference control.
- Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority.
We respond to requests within 30 days. If we need longer for a complex request we tell you why and when.
6. Sub-processors and International Transfers
The canonical sub-processor list is published at /security. Sub-processors include: Hetzner (Germany, EU, cloud hosting), Cloudflare (US, DNS for asqav.com and a reverse proxy in front of the API that terminates TLS and filters attacks), Vercel (US, website hosting, no customer API data), Resend (US, transactional email), Stripe (Ireland and US, payments for paid plans), Mixpanel (EU endpoint, analytics on consent), Dealfront (Germany and Finland, EU, Leadfeeder company-level visitor identification on our public pages, on consent), Have I Been Pwned (US, breached-password screening, receives the first five characters of a password hash only), trust services receiving cryptographic hashes only (OpenTimestamps calendars (a.pool.opentimestamps.org, b.pool.opentimestamps.org, a.pool.eternitywall.com) and the RFC 3161 timestamp authorities FPS BOSA (tsa.belgium.be) and Izenpe (tsa.izenpe.com), all receiving SHA-256 digests only), public data read with no customer data sent (api.drand.sh for the drand beacon, blockstream.info for Bitcoin block headers), and GitHub (US, code hosting, no runtime customer data).
Customer and account data is stored only in the EU (Hetzner, Falkenstein, Germany). API requests reach those servers through Cloudflare, which handles them in transit at its location nearest the caller. That location can be outside the EEA. Mixpanel uses an EU data-residency endpoint (api-eu.mixpanel.com); its US parent is subject to Data Privacy Framework safeguards. Resend (US) processes transactional email addresses. Vercel serves the website only and does not process customer API data. Where data flows to a sub-processor outside the EEA, we rely on Standard Contractual Clauses.
If you sign in with Google, GitHub or Microsoft, that provider confirms your identity to us and shares the details listed in section 2. Its own privacy policy covers what it does with your account. Stripe handles card details itself, under its own privacy policy, and never passes them to us.
7. Children
Asqav is a service for businesses and is not directed at children. You must be 18 or older to create an account, as the Terms of Service say. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email info@asqav.com and we will delete it.
8. Cookies and analytics
Asqav uses two kinds of storage in your browser. Essential storage is always on. Analytics storage runs only after you agree to it.
Essential. These keep the site working and you signed in. The asqav_access cookie holds your session and a CSRF token guards form submissions, while a few local entries remember interface preferences. None of this tracks you, so we set it without asking and you cannot turn it off while you use the site.
Analytics. With your agreement, we load Mixpanel to measure usage events and find what to improve. It stores its data in your browser under localStorage through an EU endpoint, and we never load it until you opt in. The data lasts until you clear it or withdraw your agreement. Mixpanel does not use your email address to identify you; events are associated with a random device identifier only.
Company visits. The same agreement lets us load Leadfeeder, a service of Dealfront (Dealfront Group GmbH, Germany, with Leadfeeder run from Finland), on our public pages: the home page, pricing, documentation, blog and legal pages. It never runs in the dashboard, on the sign-in and sign-up pages, or in the receipt verifier. Leadfeeder matches the IP address of your visit against its register of businesses, so we learn which company visited and which pages it read, and we use that to decide which companies to contact about Asqav. It sets a first-party _lfa cookie holding a random visitor ID, which expires after one year. Dealfront processes this data for us under a data processing agreement. We keep the visit records in our Leadfeeder account only as long as we need them for that follow-up, and they are deleted when the account closes. If your browser sends Global Privacy Control or Do Not Track, we do not load Leadfeeder, even after you agree.
You can change your mind whenever you like. Clear cookies and site data in your browser to reset your choice, and the consent banner asks again on your next visit. Turning analytics off in Cookie settings stops Mixpanel and Leadfeeder right away, deletes the Leadfeeder visitor ID, and keeps both from loading again.