Privacy Policy
Last updated: 11 June 2026
1. Controller
This policy applies to personal data processed by Asqav where Asqav acts as controller: your account, authentication, website visits, analytics, transactional and newsletter email, and support correspondence.
Where Asqav processes data you place inside receipts and signature metadata on your behalf, Asqav acts as your processor. For that data, your organization is the controller and the Data Processing Agreement governs. Data subjects whose data appears in receipts should contact you (the customer) directly.
Contact for privacy questions: info@asqav.com. We have not appointed a Data Protection Officer; privacy questions go to the same address. You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or your local supervisory authority.
We do not use automated decision-making that produces legal effects on data subjects.
2. What we collect and why
| Purpose | Data | Legal basis |
|---|---|---|
| Account creation, login, MFA | Email, password hash (Argon2id), org membership | Art 6(1)(b) contract |
| Providing the service | API keys, agent records, signature metadata, usage counters | Art 6(1)(b) contract |
| Security: access logs, auth logs, fraud prevention | IP, user agent, key-access log rows, auth events | Art 6(1)(f) legitimate interest (security of the service) |
| Breached-password screening at signup | 5-char SHA-1 prefix of password only, never the password | Art 6(1)(f) legitimate interest |
| Transactional email (Resend) | Email address, message content | Art 6(1)(b) contract |
| Newsletter | Email address | Art 6(1)(a) consent, withdrawable via unsubscribe |
| Product analytics (Mixpanel EU) | Usage events, device identifiers | Art 6(1)(a) consent via the banner, withdrawable |
| Bookkeeping and tax records | Invoicing and account records | Art 6(1)(c) legal obligation |
3. Data Security
- All data is encrypted in transit using TLS 1.2 or higher (TLS 1.3 preferred).
- Passwords are hashed using Argon2id.
- API keys are hashed and never stored in plaintext.
- Session logs use ML-DSA cryptographic signatures for tamper-evident audit trails.
- If a personal-data breach affecting your account data occurs, we notify affected customers without undue delay.
4. Data Retention
We retain your data for as long as your account is active or as needed to provide services. Signature record retention by plan:
- Free: up to 30 days, unless a compliance retention floor applies as described below
- Enterprise: custom retention period per your agreement
When an organisation signs any receipt in compliance mode or declares a regulated regime via compliance_regimes, the longest applicable retention floor governs in addition to the plan baseline above. Signing in compliance mode alone extends retention for all of the organisation's signature records and activity logs to at least 184 days, or longer where a specific regulation requires it. The full regime-by-regime table is on /data-handling. The per-regime mapping is at /docs/compliance. The receipt format itself is profiled in the IETF Internet-Draft draft-marques-asqav-compliance-receipts.
The server is backed up daily through Hetzner's automated snapshot service, held on separate backup infrastructure in the EU. A database-level dump is also retained for 7 days on the primary server, with a secondary copy retained for 14 days; both dump copies are stored on the same server today, not at a separate off-site location.
5. Your Rights
Under GDPR you have the right to:
- Access your personal data.
- Correct inaccurate data (via account settings or info@asqav.com).
- Request deletion of your data. Email info@asqav.com and we will delete your account data within 30 days. Hashes anchored to public timestamping services cannot be withdrawn once anchored. What gets anchored is a digest over the receipt's signed bytes, not a digest of your action context. Those bytes carry a 128-bit random action identifier and server-assigned timestamps, so the anchored value cannot be matched back to a guessed action.
- Export your data (account data and receipt metadata) by writing to info@asqav.com.
- Object to or restrict specific processing by writing to info@asqav.com.
- Withdraw consent for analytics at any time via the cookie preference control.
- Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority.
We respond to requests within 30 days. If we need longer for a complex request we tell you why and when.
6. Sub-processors and International Transfers
The canonical sub-processor list is published at /security. Sub-processors include: Hetzner (Germany, EU, cloud hosting), Resend (US, transactional email), Mixpanel (EU endpoint, analytics on consent), Vercel and Cloudflare (US, website delivery and DNS only, no customer API data), trust services receiving cryptographic hashes only (OpenTimestamps calendars including Eternitywall, FPS BOSA, Izenpe), and GitHub (US, code hosting, no runtime customer data).
Customer and account data is hosted exclusively in the EU (Hetzner, Falkenstein, Germany). Mixpanel uses an EU data-residency endpoint (api-eu.mixpanel.com); its US parent is subject to Data Privacy Framework safeguards. Resend (US) processes transactional email addresses. Vercel and Cloudflare handle website traffic only and do not process customer API data. Where data flows to a sub-processor outside the EEA, we rely on Standard Contractual Clauses.
7. Cookies and analytics
Asqav uses two kinds of storage in your browser. Essential storage is always on. Analytics storage runs only after you agree to it.
Essential. These keep the site working and you signed in. The asqav_access cookie holds your session and a CSRF token guards form submissions, while a few local entries remember interface preferences. None of this tracks you, so we set it without asking and you cannot turn it off while you use the site.
Analytics. With your agreement, we load Mixpanel to measure usage events and find what to improve. It stores its data in your browser under localStorage through an EU endpoint, and we never load it until you opt in. The data lasts until you clear it or withdraw your agreement. Analytics do not use your email address to identify you; events are associated with a random device identifier only.
You can change your mind whenever you like. Clear cookies and site data in your browser to reset your choice, and the consent banner asks again on your next visit. Turning analytics off stops Mixpanel right away and keeps it from loading again.