Privacy Policy — YourProDesk

1. Information We Collect

We collect information you provide directly:

Account information: Name, email address, password (hashed), company name
Documents: PDFs you upload for processing and authentication
Signing data: Signer name, email, IP address, timestamp, browser agent
Payment information: Processed securely by Stripe — we do not store card details
Usage data: IP address, browser type, pages visited, actions taken, session duration
API usage: API key usage logs, request counts, timestamps

2. How We Use Your Information

Provide, maintain, and improve the Service
Process payments and send receipts
Send service notifications (expiry alerts, signing reminders, renewal confirmations)
Generate blockchain records (document hashes only — not content)
Maintain security and prevent fraud
Comply with legal obligations
Send weekly platform summaries (admin only)

3. Document Privacy

Your documents are private by default. We do not read, analyze, sell, or share your documents. Documents marked as "public" can be accessed by anyone with the share link. Blockchain records contain cryptographic hashes of documents only — not document content. Your documents are encrypted at rest using AES-256 encryption.

4. Data Retention

Account Lifecycle

Free accounts remain active for 365 days from registration. Paid subscriptions remain active for the duration of your current billing period. We send email notifications 30, 7, and 2 days before your account or subscription expires.

After expiry or subscription cancellation, your account enters a 30-day grace period with read-only access. During grace, you may renew your subscription, continue on a free plan (where eligible), or request immediate deletion. If no action is taken by the end of grace, your account and all associated data are permanently deleted.

Retention Schedule

Active account data: Retained while your account is active
Documents you delete: Permanently purged within 30 days
Account deletion: All account data — documents, signing records, audit trails, API keys, invoices, and payment records — is permanently and irrevocably deleted
Payment records held by Stripe: Stripe retains transaction records independently for 7 years as the merchant of record
Login & security logs: 90 days
API usage logs: 90 days
Blockchain records: Cryptographic hashes recorded on Hyperledger Fabric are permanent and cannot be deleted. These hashes contain no personal data and no document content.

Important: If you require signed documents, audit trails, or invoices for legal, tax, or compliance purposes, please download them locally before account deletion or before your grace period expires.

5. Data Sharing

We do not sell your personal data. We share data only with:

Stripe: Payment processing
Hostinger: Email delivery via SMTP
Law enforcement: When required by valid legal process

All third-party processors are contractually bound to protect your data.

6. Distribution: Buyer Data

When a Merchant sells you a PDF through YourProDesk Distribution, we receive from the Merchant's storefront (via WooCommerce webhook): your email address, name, and order ID. This information is used to create a passwordless YourProDesk buyer account and to personalize your PDF.

What appears on your PDF

Your name, order ID, and purchase date are embedded in the delivered PDF as watermarks and, if enabled by the Merchant, on the appended copyright page. This personalization is applied at fulfillment and cannot be removed from copies already downloaded.

Magic-link authentication

We send you an email containing a magic-link token so you can access your purchase without a password. The token expires 7 days after issue. You can request a new token at any time.

Data shared with the Merchant

The Merchant sees your email and name so they can respond to your customer-support requests, process refunds, and comply with tax reporting obligations. YourProDesk does not share your data with third parties beyond the Merchant and required payment/service providers.

Blockchain records

Cryptographic hashes stored on the Hyperledger Fabric blockchain for tamper-evidence purposes contain only a hash of the PDF file and the order ID. No name, email, or other personal identifier is written to the blockchain.

Buyer account deletion

You may delete your YourProDesk buyer account at any time by contacting [email protected]. Deletion removes all personal data from our systems and severs access to purchased PDFs. Blockchain hashes remain (they contain no personally identifiable information) but are no longer linked to any active account.

7. Security Measures

Technical Safeguards

TLS 1.2+ encryption for all data in transit
AES-256 encryption for data at rest
Bcrypt password hashing (never stored in plaintext)
Two-factor authentication (2FA) for all accounts
Rate limiting and account lockout protection
Virus scanning on all uploaded files (ClamAV)
CSRF protection on all forms and API endpoints
Automated daily database backups with offsite storage
Monthly secret key rotation
Comprehensive audit logging
Session timeout controls (7 days customer, 30 minutes admin)

These controls are consistent with HIPAA Technical Safeguard requirements under 45 CFR § 164.312.

8. GDPR Rights (EU Residents)

If you are located in the European Union, you have the following rights under GDPR:

Right of access: Request a copy of your personal data
Right to rectification: Correct inaccurate data
Right to erasure: Request immediate deletion of your data at any time from your account dashboard or by contacting support
Right to portability: Receive your data in a machine-readable format
Right to object: Object to processing of your data
Right to restriction: Request restriction of processing

To exercise any of these rights, contact [email protected]. We will respond within 30 days. For EU data processing details, see our Data Processing Agreement.

9. CCPA Rights (California Residents)

California residents have the right to know what personal information is collected, request deletion of personal information, and opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact [email protected].

10. HIPAA Notice

Health Information Notice

YourProDesk has implemented security controls consistent with HIPAA Technical Safeguard requirements. However, we are not currently HIPAA certified and do not offer a Business Associate Agreement (BAA). HIPAA certification is on our product roadmap. If you process Protected Health Information (PHI), you are responsible for ensuring compliance with applicable regulations.

11. Data Transfers

Your data is currently stored and processed in the United States. If you are located outside the US, your data will be transferred to and processed in the US. By using the Service, you consent to this transfer. We are working toward EU data residency options as a future product milestone.

12. Cookies

We use session cookies for authentication only. We do not use tracking, advertising, or analytics cookies. We do not use Google Analytics or similar third-party tracking services.

13. Children's Privacy

The Service is not directed to children under 18. We do not knowingly collect data from minors. If you believe we have collected data from a minor, contact us immediately.

14. Changes to This Policy

We may update this policy periodically. We will notify you of significant changes via email. Continued use of the Service after changes constitutes acceptance.

15. Contact & Data Controller

Blakiston Peak LLC is the data controller for personal data processed through YourProDesk.

13459 Romford Ave
Port Charlotte, FL 33981
United States

[email protected]