Privacy Policy

1. Zero-Knowledge Cryptographic Privacy Principle

At VeeSign (operated by Veebase LLC), our privacy framework is built on cryptographic data minimization. We treat customer agreements as private, sealed digital assets. When you use the Public Verification Portal, document hashing (SHA-256) is executed locally inside your client browser using Web Crypto APIs. Your document contents are never transmitted across the network or stored on external servers during verification.

2. Information We Collect

To maintain non-repudiable audit evidence and comply with international electronic signature legislation, we collect only the necessary verification telemetry:

• Account Identifiers: Name, professional email address, organization name, and encrypted credentials.
• Signer Authentication Telemetry: IP address, browser user-agent, UTC timestamps, and affirmative consent declarations.
• Cryptographic Proofs: SHA-256 byte-level digests, digital certificate serial numbers, and HSM signature stamps.
• Optional National eID Telemetry: Cryptographic assertions returned from verified providers (e.g. Nafath, UAE Pass, WebAuthn Passkeys). Plaintext biometric scans are never stored.

3. Data Residency & Sovereign Storage

We enforce strict geographic pinning. Enterprise customer data is stored in isolated, single-tenant or regional sovereign cloud vaults adhering to GDPR Article 28, Saudi Personal Data Protection Law (PDPL), and UAE Data Protection Law. Your data is encrypted at rest using AES-256 with keys managed by your enterprise (BYOK).

4. Third-Party Sharing & Disclosure

Veebase LLC does not monetize, sell, or rent your personal data, transaction histories, or document contents to advertisers or third-party data brokers. Data is disclosed only to authorized cryptographic service providers (such as qualified Timestamp Authorities and HSM infrastructure) strictly necessary to finalize legally binding signatures.

5. Data Subject Rights & Contact

You maintain full statutory rights to access, rectify, or request the defensible deletion of your personal account data, subject to mandatory legal preservation schedules.