Privacy policy

This policy covers three groups of people, who are in different positions and should read different parts of it:

Account holders.

You created a DropTheDoc account and send documents. Everything here applies to you.

Recipients and signers.

Someone sent you a document. You may not have an account and you do not need one. Clause 2 explains who is responsible for your data, and clause 11 explains how to exercise your rights.

Visitors.

You are reading our website. We collect very little from you. See the cookie policy.

This is the most important clause in the policy, because it determines who you go to about what.

Where we act as a processor, our obligations to the account holder are set out in the data processing addendum, which forms part of our contract with them.

We do not collect personal data from third-party data brokers, we do not enrich your profile from external sources, and we run no advertising, analytics or behavioural tracking on any part of the service.

We do not ask for special category data under GDPR Article 9, or sensitive personal data under Rule 3 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, except that passwords are treated as sensitive personal data under those Rules and are stored only as bcrypt hashes.

For the avoidance of doubt: we do not sell sensitive personal data, we do not use or disclose it beyond providing the service you asked for, and there is therefore nothing for a Californian consumer to limit under the CCPA right to limit the use of sensitive personal information.

DropTheDoc is a business tool and is not directed at children. You must be at least 18 to hold an account.

Section 9 of the DPDP Act treats everyone under 18 as a child and requires verifiable consent from a parent or lawful guardian before their personal data is processed. It also prohibits tracking, behavioural monitoring and targeted advertising directed at children. We do none of those things for any user, and we do not knowingly process a child's personal data.

In the EU and UK the digital-consent age is 16, or lower where a member state has set it lower, and in the United States COPPA applies below 13. Whichever threshold applies, if you believe a child's personal data has reached us, write to privacy@dropthedoc.xyz and we will delete it, other than any audit entries we are required to retain, which we will anonymise.

We share personal data only in the situations listed here.

• Other parties to a document. Recipients of a document can see the sender's name and email, the document, and the names and signing status of the other recipients. That is inherent to signing something together.
• Members of your workspace. Depending on their role, colleagues in your workspace can see documents, recipients and activity in that workspace.
• Subprocessors. Vendors that run infrastructure and send email on our behalf, listed in full at subprocessors. Each is bound by a written contract that limits them to our instructions.
• Payment processor. For paid plans, to take payment and issue invoices. Card details go to them directly and are never stored by us.
• Professional advisers. Lawyers, auditors and accountants, under a duty of confidentiality, where they need it to advise us.
• Authorities and legal process. As described in clause 8.
• A buyer or successor. If we are involved in a merger, acquisition, financing or sale of assets, personal data may transfer as part of it. We will tell you before your data becomes subject to a materially different privacy policy, and the recipient stays bound by commitments at least as protective.

We disclose personal data to a public authority only where we are legally required to, and only to the extent required.

• We require valid legal process. In India that means an order or written request under the Code of Criminal Procedure or its successor, section 91 of the Bharatiya Nagarik Suraksha Sanhita, 2023, section 69 of the Information Technology Act, 2000, or another lawful basis. From outside India we generally require a request routed through a mutual legal assistance treaty or a letter rogatory, or an order enforceable against us.
• We check that the request is properly issued, is within the issuing authority's jurisdiction, and is not overbroad. We push back on requests that are not.
• We produce the narrowest data that answers the request. We do not give bulk or standing access to any authority.
• Where we act as a processor, we redirect the request to the account holder wherever we lawfully can, because the data is theirs.
• We notify the affected account holder before disclosing, unless we are legally prohibited from doing so or there is an emergency involving a risk of death or serious physical harm.

We may also disclose where necessary to establish, exercise or defend legal claims, or to prevent fraud, abuse or an imminent threat to someone's safety.

DropTheDoc is operated from India, and our infrastructure providers are established in the United States and operate globally. Personal data is therefore processed in India, in the United States, and in whichever region hosts the database and storage for your workspace. The full list of providers and their locations is at subprocessors.

From India.

Section 16 of the DPDP Act permits transfer outside India except to countries the Central Government restricts by notification. We monitor that list and will stop transfers to any restricted country.

From the EEA.

India has no adequacy decision under GDPR Article 45. We therefore rely on the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914, incorporated into our data processing addendum, together with a transfer impact assessment and the supplementary measures described in clause 10 and in our security page. Encryption at rest and in transit, and our policy on government requests, are part of those measures.

From the United Kingdom.

The International Data Transfer Addendum to the EU SCCs, issued under section 119A of the Data Protection Act 2018.

From Switzerland.

The SCCs as amended for Swiss law, with the Federal Data Protection and Information Commissioner as the competent authority.

You can request a copy of the safeguards we rely on by writing to privacy@dropthedoc.xyz. We may redact commercial terms.

We keep personal data only while there is a reason to, and then delete or anonymise it. Section 8(7) of the DPDP Act requires erasure once the purpose is no longer served, and GDPR Article 5(1)(e) says the same thing differently.

If you close your workspace, export what you need first. After the 30-day window, deletion is irreversible, and because documents are encrypted at rest we cannot reconstruct them.

Documents are encrypted at rest with AES-256-GCM and in transit with TLS. Passwords are hashed with bcrypt. Session tokens are stored only as SHA-256 hashes. Access is scoped to your workspace and checked on every request, not just in the interface. Uploads are size-limited, type-checked and virus-scanned. The audit trail is append-only and hash-chained.

Rule 8 of the SPDI Rules, 2011 requires reasonable security practices proportionate to the data held. The controls we operate are described in detail on the security page, and the contractual version of them is Annex II of the data processing addendum.

No system is perfectly secure. If something happens, clause 12 explains what we do about it.

Your rights depend on where you live. We apply the strongest applicable standard rather than the minimum, and we do not charge for exercising a right unless a request is manifestly unfounded or excessive, in which case we will tell you before doing anything.

If someone sent you a document, we hold your data as a processor for them. Send access, correction or deletion requests to that sender. If you cannot identify or reach them, write to us and we will either forward the request or tell you who to ask.

Email privacy@dropthedoc.xyz from the address on your account, or write to the Grievance Officer named in clause 14. Tell us what you want and which jurisdiction you are in.

We verify identity before acting, because handing someone's contract history to the wrong person is worse than being slow. For most requests, control of the account email is enough. For deletion or a large export we may ask for more. An authorised agent must supply written permission signed by you.

You can export your own documents and certificates from the dashboard at any time without asking us.

If personal data is breached, we will investigate immediately, contain it, and notify as follows:

• India. The Data Protection Board of India and every affected Data Principal, as required by section 8(6) of the DPDP Act and the rules made under it, without the delay those rules prohibit. We will also report to CERT-In within 6 hours of becoming aware where the incident falls within the categories in its directions of 28 April 2022.
• EEA and UK. The lead supervisory authority within 72 hours of becoming aware, under GDPR Article 33, and affected individuals without undue delay where the risk to their rights and freedoms is high, under Article 34.
• United States. Affected individuals and regulators within the deadlines set by the applicable state breach notification statutes.
• Our customers. Where we act as a processor, we notify the affected account holder without undue delay so that they can meet their own notification obligations, and we give them the information they need to do it.

Notifications will describe what happened, what data was involved, what we have done, and what you should do.

We do not make decisions producing legal or similarly significant effects about you by automated means, and we do not profile you. Rate limiting and abuse detection are automated, but they throttle or block a request rather than decide anything about you as a person, and you can reach a human at support@dropthedoc.xyz if you are affected.

You always have the right to complain to your own regulator. In India that is the Data Protection Board of India, in the EEA your national supervisory authority, and in the UK the Information Commissioner's Office. We would rather you came to us first, but nothing here requires it.

We will update this policy when the service or the law changes. The version number and effective date at the top always tell you which version you are reading, and clause history is listed at the foot of the page.

For material changes that reduce your rights or expand how we use personal data, we will give account holders at least 30 days' notice by email before they take effect. For clarifications and corrections we will update the page and bump the version.