Privacy Policy

Summary

• Customers (people with a AiresDocs account): we are the controller of your account and billing data. We use it to provide the service, bill you and keep the service secure. We do not sell it or use it for advertising.
• Signers and recipients: the sender who invited you is the controller of the document and of your data in it. We process it as their processor. Questions about the document go to the sender first; we help with anything you cannot resolve.
• This website uses no analytics cookies, no advertising and no trackers. Cloudflare, which hosts it, processes connection data to deliver and protect the site.
• Data lives in London (database and files). Email and payments involve providers in the United States under appropriate transfer safeguards.

Who we are

AiresDocs is operated by Infinity Square Labs Ltd, a company registered in England and Wales (company number 16880965), registered office 483 Green Lanes, London, N13 4BS, United Kingdom ("AiresDocs", "we", "us"). For privacy questions or requests email privacy@airesdocs.com. We have not appointed a data protection officer because we are not required to; the privacy inbox is read by the people who run the service.

Whether we are controller or processor

The UK GDPR distinguishes a controller, who decides the purposes and means of processing, from a processor, who processes on the controller's behalf.

• We are the controller for: customer accounts, billing, support correspondence, this website, security logs, and verification requests.
• We are the processor for: the documents customers upload, the names, email addresses and signatures of recipients, the fields they complete, and the audit trail of each document. The customer who sends the document is the controller. Our processing of that data is governed by the data processing terms in our terms of service.

Data about customers

We do not use your documents or data for advertising, profiling or training models, and our staff do not read your documents except where you ask us to for support, or where necessary to investigate abuse or a security incident.

Data about signers and recipients

If someone sends you a document through AiresDocs, the sender gives us your name and email address and we email you a unique signing link. When you open it we record the time, your IP address and your browser's user agent; when you tick the consent box and sign, we record those events the same way, together with your signature (drawn, typed or uploaded) and the fields you complete. When the document completes we email you the final PDF with a certificate listing these events. CC recipients receive the final PDF only.

All of this is processed on the sender's instructions: the sender is the controller and decides the purpose (concluding a contract with you, for example) and how long to keep the document. Our role is to provide the service securely and to help the sender honour your rights. If you want a copy of the document, want details corrected, or object to the processing, contact the sender first; if you cannot, or you think we are processing your data wrongly, email privacy@airesdocs.com and we will help. The signing page itself contains no advertising or third-party scripts.

Visitors to this website

airesdocs.com is a static website hosted on Cloudflare. When your browser requests a page, Cloudflare necessarily processes your IP address, request headers and the page requested in order to deliver the site and protect it from abuse; it handles that data under its own privacy policy. We do not run analytics scripts, advertising or tracking cookies on this site. The only thing stored on your device is your colour-theme preference if you set it (see the cookie policy). If you email us, we keep the correspondence for as long as we need it to deal with your query.

Lawful bases

• Contract (UK GDPR Article 6(1)(b)): providing the service to account holders, billing, support.
• Legitimate interests (Article 6(1)(f)): security and fraud prevention (IP addresses, rate limiting, audit data), service improvement using aggregate usage, and defending legal claims. We have balanced these against your interests and consider the processing expected and proportionate.
• Legal obligation (Article 6(1)(c)): tax and accounting records, responding to lawful requests from authorities.
• Consent (Article 6(1)(a)): only where we ask for it specifically, such as product-update emails you opt into. The e-sign consent box on the signing page is a record of your agreement to sign electronically; the lawful basis for processing the document's data is the sender's.

For signer data we process as processor, the lawful basis is the sender's to determine; our guide on GDPR and electronic signatures explains what that usually is.

Sharing and sub-processors

We share personal data only with the providers we need to run the service, each bound by contract to process it only for us:

• Supabase (database, authentication, file storage), London region.
• Cloudflare (hosting, network security, running our API), global edge network with no document storage at the edge.
• Stripe (payments, invoices, billing portal).
• Resend (sending emails: invitations, reminders, completion notices, account emails).
• Only when a sender switches the feature on for a contract: Twilio (text-message codes to confirm a signer), Stripe Identity (government ID checks; we keep only the result), Stripe Connect (taking a payment during signing) and Anthropic (the optional AI summary; the contract text is sent to produce it). Details are in the trust centre.

The current list with locations is on the security page, and we update it before adding a provider. We may also disclose data where the law requires it, to protect our rights or the rights of others, or to a successor if the business is sold, in which case this policy continues to apply. We do not sell personal data.

International transfers

Documents, signatures and audit data are stored in the United Kingdom. Stripe and Resend are US companies and some of their processing takes place in the United States. For those transfers we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses and, where the provider is certified, the UK extension to the EU-US Data Privacy Framework (the UK-US data bridge). Cloudflare processes connection data at the edge location nearest you, under the same mechanisms.

Retention

Security

All traffic is encrypted with TLS; data is encrypted at rest; files are in private storage reachable only through short-lived signed links; signing tokens are stored hashed; the audit log is append-only; database access is restricted by row-level security; and production access by our staff is limited and protected by multi-factor authentication. Full details are on the security page. If we become aware of a personal data breach that affects you, we will notify you and, where required, the Information Commissioner's Office without undue delay; where we are a processor we notify the sender so they can meet their own obligations.

Your rights

Under the UK GDPR (and the EU GDPR where it applies) you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where consent is the basis. Account holders can exercise most of these themselves: settings let you edit your profile, export all your documents and audit data as a ZIP, and delete your account. For anything else, email privacy@airesdocs.com; we respond within one month. Some rights are limited where we need the data to meet a legal obligation or to establish, exercise or defend legal claims, for example a signed contract and its audit trail. Signers should contact the sender, who is the controller of the document, and we will assist.

Children

AiresDocs is a business service and accounts are for people aged 18 or over. We do not knowingly collect data from children. If a document is sent to a child for signature, that is the sender's decision and responsibility; a parent or guardian who is concerned can contact us.

Changes to this policy

We will post changes here with a new effective date and record them in the changelog. For material changes affecting account holders we will also email you before they take effect.

Contact and complaints

Email privacy@airesdocs.com or write to Infinity Square Labs Ltd, 483 Green Lanes, London, N13 4BS, United Kingdom. If you are unhappy with our response you can complain to the Information Commissioner's Office (ico.org.uk/make-a-complaint) or, if you are in the EU, to your local supervisory authority.