Privacy Policy.

1. Introduction

This Privacy Policy explains how Docsliy, Inc. ("Docsliy," "we," "us," or "our") collects, uses, discloses and safeguards personal data when you visit our website, create an account, or use the Docsliy platform (collectively, the "Service"). It applies to visitors, customers, and the individuals whose data our customers process through the Service.

If you have questions about this policy, see Section 13 for how to reach us.

2. Information We Collect

2.1 Information You Provide

• Account information: name, work email, company, and password when you create a workspace.
• Billing information: billing address and payment details, processed by our PCI-compliant payment processor — we do not store full card numbers.
• Customer Content: the contracts, clauses, templates and related data you create or upload while using the Service, including the jurisdiction each agreement is governed by.
• Signer identity data: where a document requires verified identity, our verification partner collects government ID images, a biometric selfie used for liveness comparison, and screening results against sanctions, politically-exposed-person and adverse-media lists. We receive the verification outcome and a reference; we do not retain raw biometric templates.
• Aadhaar e-KYC data (India): where a signer chooses Aadhaar eSign, authentication is performed by a Certifying Authority licensed by the Controller of Certifying Authorities. We receive confirmation of a successful authentication and the resulting signature certificate. We never receive or store your full Aadhaar number, and Aadhaar data is not used for any purpose beyond executing that signature.
• Formalities and statutory data: where stamp duty, notarisation or registration applies, we process the instrument type, the state or jurisdiction of execution, the duty computed and the resulting e-Stamp certificate reference.
• Communications: messages you send through our contact form, support chat, or email.

2.2 Information Collected Automatically

• Log data such as IP address, browser type, device information and pages visited.
• Usage data describing how you interact with the platform, used to improve reliability and product design.
• Cookies and similar technologies, described further in Section 8.

3. How We Use Information

We use personal data to:

• Provide, maintain and improve the Service, including drafting from counsel-reviewed clause libraries, jurisdiction risk review, and electronic signature;
• Verify signer identity to the standard the applicable law requires, and retain the evidence needed if a signature is later challenged;
• Calculate and remit statutory charges such as stamp duty, and attach the resulting certificate to the executed document;
• Process transactions and send related billing communications;
• Respond to support requests and communicate service-related updates;
• Detect, investigate and prevent fraud, abuse and security incidents;
• Comply with legal obligations and enforce our Terms of Service.

4. Legal Bases for Processing

Where the General Data Protection Regulation (GDPR) applies, we rely on the following legal bases: performance of a contract (to provide the Service you signed up for), legitimate interests (such as securing our platform and improving our product), consent (for optional communications), and compliance with legal obligations.

Where India's Digital Personal Data Protection Act, 2023 applies, we process personal data on the basis of consent or for the legitimate uses the Act permits, and act as a Data Fiduciary in respect of the data we determine the purpose of. Where we process Customer Content on your instructions, you are the Data Fiduciary and we act as a Data Processor.

5. Data Sharing & Third Parties

We do not sell your personal data. We share data only in the following circumstances:

• Service providers: vetted vendors who help us operate the Service (cloud hosting, payment processing, email delivery), bound by confidentiality and data protection obligations.
• Identity verification: our verification partner receives the identity documents and biometric capture a signer submits, in order to return a verification result. It does not receive the contract.
• Licensed signature providers: where the law requires a signature to be applied by a licensed Certifying Authority or trust service provider, that provider receives only what it needs to issue the signature.
• Stamp duty and registration authorities: where duty applies, the instrument type, jurisdiction and duty amount are shared with the authorised collection agency in order to obtain a valid certificate.
• Integrations you enable: third-party tools you connect (CRM, Slack, identity providers) receive only the data necessary for that integration to function.
• Legal requirements: when required to comply with applicable law, regulation, or valid legal process.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to standard confidentiality terms.

Your document does not travel to the signature provider. Where a licensed provider must apply the signature, we send a cryptographic hash of the document rather than the document itself. The hash is sufficient to bind the signature to that exact file and to detect any later alteration, but it cannot be reversed to reveal the contents. The contract itself never transits a third party.

6. Data Retention

We retain personal data for as long as your account is active or as needed to provide the Service. Customer Content is retained according to your workspace's settings and deleted within 90 days of account closure, except where longer retention is required for legal, tax, or audit purposes. Backup copies may persist for a limited additional period before being purged from backup systems.

Signature audit trails are treated differently. Because their purpose is to prove who signed what and when, the audit record for an executed document — timestamp, authentication method, verification outcome and document hash — is retained for the period required to remain useful as evidence under the law of the executing jurisdiction, even where the underlying Customer Content has been deleted.

7. Your Privacy Rights

Depending on where you live, you may have the right to:

• Access, correct, or delete the personal data we hold about you;
• Object to or restrict certain processing of your data;
• Request a portable copy of your data in a machine-readable format;
• Withdraw consent at any time, where processing is based on consent;
• Opt out of the sale or sharing of personal data (no such sale currently occurs) under the CCPA.

To exercise any of these rights, contact us at privacy@docsliy.io. We will respond within the timeframe required by applicable law.

8. Cookies & Tracking Technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Service is used. You can control cookies through your browser settings; disabling certain cookies may affect the functionality of the Service.

9. Data Security

We protect personal data with industry-standard safeguards, including 256-bit encryption in transit and at rest, role-based access controls, and regular internal security reviews. See our Trust & Security page for more detail. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. International Data Transfers

Docsliy operates globally, which means personal data may be transferred to and processed in countries other than your own. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses to protect data transferred outside the European Economic Area, United Kingdom, or Switzerland.

11. Children's Privacy

The Service is not directed to individuals under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacy@docsliy.io and we will take appropriate steps to delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or an in-app notice before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact Us

For privacy questions or to exercise your rights, reach our privacy team at privacy@docsliy.io or through our contact page.