Privacy Policy

TrustChain ("we", "us", "our") is a digital agreement registry and trust infrastructure service operated by Kirillskiy Construction Ltd. This Privacy Policy explains how we collect, use, and protect personal information when you use our platform at trustchain.biz.

By using TrustChain, you agree to the practices described in this policy.

We collect the following categories of information:

• Account data: Email address, display name, profile photo (if provided via Google sign-in)
• Agreement data: Agreement text, metadata (parties, dates, amounts), cryptographic fingerprints, and audit events
• Record file: On an anchored agreement's Proof tab, either person on the agreement can download a record file. It holds the agreement's TrustChain ID, title, terms and amount, the dates it was created, signed and anchored, the anchoring transaction, and both people's internal TrustChain account IDs, so the fingerprint on Polygon can be checked with the open verifier. The file is made in your browser from the agreement as we store it. We don't keep a copy of the file or send it anywhere, and who you share it with is up to you.
• Negotiation chat data: Messages exchanged while negotiating an agreement. The message contents are end-to-end encrypted; the keys are held on your own devices and we cannot read them. The metadata around each message is not encrypted and is visible to us: who sent it (their account identifier and email address) and when. Only the body is ciphertext.
• Identity verification data: Your ID document and selfie are captured and held by Sumsub, not by TrustChain (see section 5). To learn the status of your check, our servers ask Sumsub for your applicant record, and Sumsub's reply may include details it holds on file, such as information read from your ID; we do not keep those details. We store only the outcome: whether the check passed, Sumsub's status codes, a reference number and the time.
• Blockchain data: Anchoring is optional. When either party anchors a signed agreement, one transaction records these values on the Polygon public blockchain: TrustChain's internal ID for the agreement, its Keccak-256 fingerprint, and two wallet address slots, which are empty (all-zero) for every agreement TrustChain anchors. The fingerprint is computed from the agreement's ID, title, terms, amount and both parties' TrustChain account IDs. The title, terms, amount and account IDs are not written on-chain, and neither are names or email addresses. You do not connect a wallet and we do not store one: the transaction is signed and paid for by a wallet TrustChain operates, so you pay no gas and sign nothing on-chain. Entries on Polygon are publicly visible and cannot be deleted by us or by you.
• Payment data: Subscription plan, billing history (payment card details are processed by Stripe, and we do not store card numbers)
• Usage data: IP address, browser/device type, pages visited, activity timestamps

• Providing and securing the TrustChain registry service
• Creating, storing, and verifying digital agreements
• Identity verification (KYC), which is required before a signature is accepted
• Processing subscription payments and managing billing
• Sending transactional notifications (agreement activity, signing invitations)
• Improving the platform and detecting misuse
• Complying with legal obligations

User data and agreement records are stored in Google Firebase (Firestore and Firebase Authentication), hosted in the United States. When an agreement is anchored, its fingerprint and TrustChain's ID for it are written to the Polygon public blockchain (see section 2). Entries on Polygon are publicly visible and cannot be deleted by us or by you.

Transport is HTTPS/TLS throughout, and incoming payment webhooks are verified by HMAC-SHA256 signature before they are acted on.

Three controls specifically protect the integrity of a signature, which is the thing this registry exists to protect:

• A signature cannot be created by writing to the database directly. Database rules restrict what a party may change on their own agreement to a short whitelist of fields, and the signature fields are not on it: they can only be set by the signing function on our servers.
• That function checks identity verification status server-side at the moment of signing. A request from an account that has not reached verified status is refused, whatever the interface shows.
• Requests that change state, such as signing, anchoring and inviting, reject a session that has been revoked, or that belongs to an account which has since been disabled or deleted, rather than accepting a token that is merely unexpired.

The negotiation chat is end-to-end encrypted. Encryption keys are held on the parties' own devices, not on our servers, so the contents of the negotiation chat are not readable by TrustChain. This is distinct from the agreement record itself, which we store as described above in order to operate the registry.

We share data with the following third-party providers:

• Sumsub: identity verification (KYC/AML). When you complete identity verification, your documents and biometric data are processed by Sumsub under their own privacy policy. Sumsub acts as a data processor on our behalf.
• Stripe: payment processing. Stripe collects and processes payment card information directly. We receive only non-sensitive billing metadata (subscription status, customer ID).
• OpenAI: AI assistance, through the flows below. First, when you use the AI Advisor or a review, the text you submit is sent to OpenAI's chat API; for an agreement-specific review this includes the agreement's title, amounts, dates, party fields and terms. Second, the question itself is sent to OpenAI's embeddings API (model text-embedding-3-large), which is how the system finds the relevant provisions of the legislation it has indexed. The indexed statute text is public law and is embedded once when we build the index, not per request. Separately, when you send Pip, the TrustChain guide, a question for its AI to answer (when the FAQ has no match, or you press Ask Pip instead), your question, the name of the page you're on and, for a follow-up, your previous question and Pip's answer are sent to OpenAI's chat API to write the answer. Pip refuses a question that contains a link, an email address, a phone number or an ID or card number before anything is sent. When you ask Pip to tidy the wording of a field in the agreement form (Scope of Work or one Deliverable), that field's text, the agreement title and the deal type you picked are sent too; never the form's separate email, amount, currency, date or jurisdiction fields. Anything you typed inside the field itself, such as a price or a date, is sent as part of its text. We don't store these suggestions or answers, and we store questions only in this case: questions people send to the Pip guide that it could not answer, or that they marked as not helpful, are kept without any account details for up to 30 days to improve the guide's answers. We keep a count of today's questions for your account or guest session, so the daily limit works, and a short technical log line for each request (account ID, page, length and outcome, never the text). For guest sessions we also keep a daily count per network, stored under a one-way code that can't be turned back into your IP address. Your end-to-end encrypted negotiation chat is never sent to OpenAI. Do not put information you would not want processed by OpenAI into AI-assisted fields.
• Google Firebase: authentication, database, and cloud functions infrastructure.
• Resend: sends TrustChain's emails, such as invitations, signature notices and requests for a new invitation link. For each email it receives the recipient's address and the content of the email.
• Google Analytics 4 and Meta Pixel: usage measurement and advertising attribution, only after you accept the consent banner. What they receive and never receive is listed in section 6.

When measurement is switched on for the site, TrustChain uses two tools, and only if you accept the banner shown on your first visit: Google Analytics 4 and the Meta Pixel. Until you accept, neither script is loaded and nothing is sent. If you decline, the site works exactly the same and your choice is remembered in your browser. To change your mind later, clear this site's storage and the banner returns.

What these tools receive: the pages you open, the fact that an account was created, that an agreement was created, and that a payment completed, and, from Pip the guide (Google Analytics 4 only), which tour or tip was shown, skipped or closed, whether a question was answered from the FAQ or by AI, and when a suggested wording was used (never the question, the answer or which record you were on), together with the technical data such tools collect by default (approximate location from IP address, device and browser type, the site that referred you). Before anything is sent, the address of the page is reduced to its route: agreement, invitation and proof identifiers are replaced by a placeholder, and the links that open an agreement or an invitation are never passed on. We never send them your name, your email, the text of any agreement, which agreement you opened, the identity of a counterparty, or wallet data. We use the results to see which pages and campaigns bring people here and whether they get value from the product. Google and Meta process this data under their own policies; the Meta Pixel can also be used to show TrustChain advertising to people who visited this site. Firebase Analytics is not used.

What is stored in your browser: Firebase Authentication keeps your session in local storage and IndexedDB so you are not asked to log in on every page, and the app keeps a small amount of interface state alongside it; none of that is shared with a third party. While you are signed in to your account, the app also keeps a copy of what you open in this browser's IndexedDB: your agreements with their history (which can include the other person's email and IP address), invitations, encrypted chat messages, AI Advisor answers, your notifications and your account details. That way they appear at once on your next visit. Signing out removes that copy. On a shared computer, sign out when you finish. Your consent choice is stored as tc_consent. If you accept measurement, Google Analytics sets the _ga and _ga_* cookies and the Meta Pixel sets _fbp (and, after a Meta ad click, _fbc); the Meta cookies are advertising identifiers. If you decline, none of these cookies are set.

When a page fails to load or display, the app may send our own server a short technical report: the error message with email addresses, links, query strings, numbers, identifiers and quoted text removed, the names of the code files involved, which kind of page it was (never its address), your browser family and the app version. It goes to TrustChain's server, not to an analytics or advertising company, is kept in our server logs for up to 30 days, and we do not share it. Like every request, it also appears in the server request logs described below.

To be straightforward about what you can and cannot control: clearing your browser storage for this site, or signing out, removes the session data and the saved copy of your agreements, and you will simply be signed out. Disabling JavaScript is not an opt-out, because TrustChain is a JavaScript application and will not run at all without it; the earlier version of this policy suggesting otherwise was wrong. Server request logs, which include IP address and browser type, are produced by our hosting provider for security and reliability and cannot be opted out of while using the site.

Account data is retained while your account is active. Agreement records and cryptographic proofs may be retained indefinitely as they form part of the verifiable registry. Entries on Polygon cannot be deleted by us or by you, including after your account is deleted.

KYC data is retained as required by applicable law and Sumsub's data retention policies. You may request deletion of your off-chain account data by contacting us.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and off-chain data
• Object to certain processing activities
• Data portability (export of your agreement records)

To exercise these rights, contact us at founder@trustchain.biz.

TrustChain is not intended for use by persons under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has created an account, contact us and we will remove it promptly.

We may update this Privacy Policy periodically. Significant changes will be communicated via email or a notice on the platform. Continued use of TrustChain after changes constitutes acceptance of the updated policy.

For any privacy-related questions or requests, contact: