Data processing terms

Scope and roles

These terms apply to personal data that Infinity Square Labs Ltd ("AiresDocs", "we") processes on behalf of the customer ("you") in providing the service: the content of your documents, the names, email addresses, signatures, field values and audit events of your recipients, and your templates ("customer data"). For that data you are the controller and we are the processor within the meaning of the UK GDPR and, where it applies, the EU GDPR. For your own account and billing data we are the controller, as set out in the privacy policy. Where these terms conflict with the terms of service, these terms prevail for the processing of customer data.

Details of processing

Our obligations as processor

We will:

• process customer data only on your documented instructions, which are the actions you take in the service (upload, send, remind, void, export, delete) and these terms, unless UK or EU law requires otherwise, in which case we will tell you before processing unless the law prevents it;
• tell you if we believe an instruction infringes data protection law;
• ensure that everyone we authorise to process customer data is bound by confidentiality;
• implement the technical and organisational security measures described below and on the security page;
• engage sub-processors only as set out below, under written terms imposing the same obligations, remaining responsible for their performance;
• assist you, taking into account the nature of the processing, with data subject requests and with your obligations on security, breach notification, impact assessments and prior consultation;
• delete or return customer data at the end of the service as set out below;
• make available the information needed to show compliance and allow and contribute to audits as set out below;
• not transfer customer data outside the UK except as set out below.

Sub-processors

You authorise the sub-processors listed on the security page (currently Supabase, Cloudflare, Stripe and Resend, plus Twilio, Stripe Identity, Stripe Connect and Anthropic only for the optional features a sender switches on; the full list is in the trust centre). We will give at least 30 days' notice by email before adding or replacing a sub-processor that processes customer data; the notice will be recorded in the changelog. If you object on reasonable data protection grounds and we cannot resolve the objection, you may terminate the service and we will refund any prepaid period after termination.

International transfers

Customer data is stored in the United Kingdom (London). Transfers to sub-processors in the United States (Resend for email delivery, including attached completed PDFs; Stripe for billing, which concerns your data rather than recipients') are made under the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, and, where the provider is certified, the UK extension to the EU-US Data Privacy Framework. For EU customers, the EU standard contractual clauses apply to transfers from the EU to the UK and onward, with the UK's adequacy decision covering the EU-to-UK leg.

Security measures

In summary: TLS for all traffic; encryption at rest for the database and file storage; private storage buckets accessed only through signed URLs valid for five minutes; signing tokens of 256 bits stored hashed; optional access codes stored hashed with attempt limits; row-level security in the database; an append-only audit log enforced by database rules; secrets held in an encrypted secret store; schema validation of all inputs; rate limiting; security headers and a strict content security policy; limited, MFA-protected staff access; 30-day log retention with no document content in logs. Full details and updates are on the security page.

Breach notification

We will notify you without undue delay, and in any event within 48 hours of becoming aware, of a personal data breach affecting customer data, giving the information you need for your own assessment and any notification to a supervisory authority or to data subjects: the nature of the breach, the categories and approximate numbers of data subjects and records, likely consequences, measures taken, and a contact point. We will update you as the investigation proceeds.

Assistance and audit

Account holders can self-serve most assistance: export of documents and audit data, deletion of documents and accounts, and the audit trail itself. For anything else, email privacy@airesdocs.com. We will respond to data subject requests forwarded by you within five working days with the information we hold. For audit, we will on request provide our security documentation, sub-processor contracts' relevant terms, and our sub-processors' audit reports where they make them available to us; if that does not reasonably answer your question, you may conduct an audit once a year, on 30 days' notice, during business hours, by an auditor bound by confidentiality, at your cost.

Deletion at the end

You can delete individual documents and your whole account at any time from settings. When you delete your account, or on termination, we delete customer data within 30 days, including from backups as they roll off, unless UK or EU law requires us to keep some of it, in which case we keep only what the law requires and only for as long as it requires. Before deleting, use the export function to retain your own copy; we will provide a reasonable period to export on termination by us.

Your obligations as controller

• Ensure you have a lawful basis for sending each document to each recipient and for the data in it, and give recipients the privacy information your obligations require.
• Give instructions only through the service and these terms; do not ask us to process data in ways the service does not provide.
• Keep your account secure and do not share signing links with anyone other than the intended signer.
• Handle data subject requests from your recipients; we will assist.
• Set and apply your own retention schedule using the export and delete functions.

Our guide on GDPR and electronic signatures explains these responsibilities in practical terms. For a countersigned copy of these terms on your letterhead, email privacy@airesdocs.com.