Privacy Policy

DataHubz Attest

This section describes how DataHubz Attest (“Attest”, available at attest.datahubz.com) handles information. It supplements the rest of this Privacy Policy.

What Attest Cannot See

• Your documents. Documents in agreements are encrypted in your browser before upload and can be decrypted only in the browsers of the agreement’s parties. We store the encrypted data and cannot read it.
• Your keys. Your encryption key is created on your device. We store only its public part and copies of the private part that are encrypted under your passkeys or your recovery phrase, which we cannot decrypt. We never receive your recovery phrase.
• Your biometrics. Passkeys use your device’s Face ID, Touch ID, Windows Hello, or PIN. Biometric data never leaves your device and is never sent to us.
• The content behind a receipt. Files are fingerprinted (SHA-256) on your device and only the fingerprint is sent, unless you choose to send text for us to fingerprint.

What Attest Processes

• Account information: your email address and plan.
• Agreement information: titles, document file names and fingerprints, signers’ email addresses and names, signing times, and each signer’s passkey signature evidence (the signed statement, the passkey’s public key and credential identifier, and the signature).
• Passkey information: for each passkey, its public key, credential identifier, a device label (for example, “Mac · Chrome”), and when it was added and last used.
• Receipt information: fingerprints, the kind, the claims and metadata you attach, and timestamps.
• Proof information: the zero-knowledge proofs you generate and the information they reveal.
• Billing information: processed by Stripe; we do not store full payment card details.

Public Blockchains

Attest writes cryptographic fingerprints (hashes and Merkle roots, which contain no names, email addresses, or document content) to the Horizen public blockchain, from a blockchain account DataHubz operates for your Attest account. Zero-knowledge proofs and their public inputs are submitted to the zkVerify network through the Kurier relayer; public inputs are cryptographic values, not readable personal data. Information on public blockchains is permanent and cannot be deleted by DataHubz or anyone else, which is why we never put personal data or document content on them.

What Is Public

• Agreement certificates are public by default: anyone with the link can see the title, the signers’ names and email addresses, and when they signed, but not the document. The agreement’s creator can make a certificate private, after which only its parties can see it.
• Receipts can be verified by anyone with their identifier or the original file, which shows the fingerprint, kind, claim, and time.
• Zero-knowledge proofs show the statement they prove, which may include the email addresses of the parties they name.

Invited Signers

If you were invited to sign an agreement, the person or organization that invited you provided your email address to us so we could send you the agreement. For agreements, that customer determines why your information is processed, and DataHubz processes it on their behalf to provide Attest. If you create an Attest account, we process your account information under this Privacy Policy.

Service Providers

Attest uses the following providers: Vercel (hosting), Neon (database), Resend (email delivery), Stripe (payments), Cloudflare (storage of public cryptographic files that contain no personal data), the Kurier relayer and the zkVerify network (proof verification), and the Horizen network (anchoring).

Cookies and Local Storage

Attest uses only essential cookies: a session cookie that keeps you signed in (up to 30 days) and a short-lived cookie (5 minutes) used during passkey setup and sign-in. It stores your theme preference and whether you dismissed a notice in your browser’s local storage. Attest does not use advertising or tracking cookies.

Retention and Your Rights

Records are designed to remain verifiable, so receipts and signatures are kept for as long as your account exists and as needed to keep them verifiable, unless you ask us to delete them. You can request access to, correction of, or deletion of your personal information at contact@datahubz.com. We will delete or de-identify the personal information we store, such as names, email addresses, and certificates. Fingerprints already written to public blockchains cannot be removed, but they do not identify you on their own. Encrypted documents can be read only by their parties, and deleting them makes them permanently unrecoverable.