Privacy Policy

1. Introduction

This Privacy Policy describes how NXFIN TECHNOLOGIES PRIVATE LIMITED ("we", "us", or "our"), a company incorporated in India, operating the Inscriben platform, collects, uses, processes, and protects your personal data. NXFIN TECHNOLOGIES PRIVATE LIMITED is the data fiduciary / data controller responsible for your personal data under the Digital Personal Data Protection Act, 2023 (DPDPA, India), the General Data Protection Regulation (GDPR, EU/UK), and other applicable global data privacy regulations.

2. Information We Collect

We collect the following categories of personal data:

• Account Information: Name, email address, password (cryptographically hashed), phone number, organization name, and role.
• Document Data: Documents uploaded for electronic signature, including file names, document contents, and associated structural metadata.
• Biometric & Identity Data: Dual-angle facial photographs and optional video selfie verification captured during the signing process to verify signatory identity and substantiate evidentiary audit trails.
• Electronic Signature Data: Drawn signatures, typed signature representations, timestamps, IP addresses, browser user-agents, and signer verification status.
• Usage & Audit Data: Interaction logs, document completion states, tamper-evident hash histories, and audit trail events.
• Device & Telemetry Information: IP address, geolocation coordinates (where permitted), operating system, browser specifications, and network parameters.

3. How We Use Your Information

• Service Delivery: To generate, execute, hash, encrypt, and deliver legally defensible electronic signatures and document certificates.
• Identity & Fraud Prevention: To verify signer identity, prevent document tampering or repudiation, and provide legal audit trails admissible in court.
• Operational Communications: To send signing invitations, completion certificates, security alerts, and customer support updates.
• Regulatory Compliance: To satisfy legal retention obligations under electronic transaction and evidentiary laws (e.g., Information Technology Act 2000, eIDAS, ESIGN Act).

4. Legal Grounds for Processing

We process your personal data under the following legal bases:

• Consent: Where you have provided unambiguous, informed consent (e.g., for biometric photo capture, cookie preferences, or optional identity verification).
• Contractual Necessity: Where processing is necessary to execute contracts, manage organizations, or complete electronic signing workflows requested by you.
• Legal Obligation: Where retention and audit trails are required to comply with statutory legal requirements under electronic commerce and signature statutes.
• Legitimate Uses / Legitimate Interests: To secure the platform against fraud, maintain cryptographic integrity, and prevent unauthorized access.

5. Biometric Data Protection

During signing workflows, Inscriben provides the capability to capture dual-angle facial photographs of each signatory. This biometric data is:

• Collected solely with explicit consent provided at the time of signing.
• Encrypted using military-grade AES-256-GCM encryption both at rest and in transit.
• Embedded cryptographically within the document's immutable completion certificate to serve as non-repudiation evidence.
• Retained strictly for the duration of the document's retention lifecycle, after which it is permanently purged.
• Never utilized for facial recognition marketing, automated profiling, advertising, or sold to third parties.

6. Document Security & Cryptography

• All uploaded documents are encrypted using authenticated AES-256-GCM encryption with unique per-document initialization vectors (IVs) and 128-bit authentication tags.
• Each document is hashed using SHA-256 prior to and following execution to detect any unauthorized modification or bit-level tampering.
• Completed documents are accompanied by a cryptographic Completion Certificate containing signer metadata, timestamps, IP records, and verification hashes.
• Upon account closure or document expiry, underlying document files are permanently purged within 30 days, subject to mandatory statutory retention requirements.

7. Data Sharing & Sub-processors

We never sell, monetize, or rent your personal information. We disclose personal data only to verified third-party service providers bound by rigorous data processing agreements:

• Electronic Signature Service Providers: Protean eGov Technologies Limited (India) for processing UIDAI Aadhaar eSign verification and OTP dispatch where selected.
• Cloud Storage & Infrastructure: Google Cloud Platform (GCP) for secure, encrypted cloud hosting and distributed database storage.
• Payment Gateways: Razorpay Software Private Limited for secure credit pack transactions, PCI-DSS compliant billing, and tax invoicing.
• Email Delivery Gateways: Resend and certified SMTP delivery services for transactional signing notices and token distribution.
• Legal & Regulatory Authorities: Competent judicial or government bodies when legally compelled by court orders, warrants, or governing statutory processes.

8. Cross-Border Data Transfers

Our platform infrastructure is deployed across enterprise-grade cloud facilities. Where personal data is transferred across international borders, NXFIN TECHNOLOGIES PRIVATE LIMITED ensures compliance with applicable international transfer regulations, utilizing Standard Contractual Clauses (SCCs), adequacy recognitions, and lawful data transfer safeguards under DPDPA and GDPR.

9. Data Retention & Erasure Exceptions

• Account profile details are retained for the duration of active use plus 30 days after account termination.
• Completed contracts, execution certificates, and audit trails are retained for a default minimum period of 7 years to satisfy statutory requirements under contract, evidence, and limitation statutes (e.g., Indian Limitation Act, EU/UK statutory evidence rules).
• While users have the right to request erasure of their personal profile information, completed signing audit logs and cryptographic hashes are maintained under lawful exceptions (such as GDPR Article 17(3)(b) & (e) and DPDPA compliance exemptions) to preserve the legal enforceability of contracts executed through the platform.

10. Signatory and User Rights

Depending on your jurisdiction (including under DPDPA 2023, GDPR, and global frameworks), you have the right to:

• Right to Access / Summary: Request confirmation of processing and obtain a summary of personal data held.
• Right to Correction & Updating: Request correction of inaccurate, incomplete, or outdated personal information.
• Right to Erasure: Request deletion of your personal data, subject to legal and contractual retention requirements.
• Right to Grievance Redressal: Access an expeditious grievance redressal mechanism regarding data processing.
• Right to Nominate: Nominate an individual to exercise privacy rights in the event of death or incapacity (under DPDPA).
• Right to Withdraw Consent: Withdraw previously granted consent at any time without affecting prior lawful processing.

To exercise your privacy rights, contact our Data Protection & Grievance Officer at privacy@inscriben.com or dpo@inscriben.com. We respond to all verified requests within statutory timeframes.

11. Cookies & Tracking Technologies

We use strictly necessary and functional cookies to maintain secure sessions and preserve user preferences. We do not use third-party advertising cookies or cross-site tracking pixels. For detailed information, review our Cookie Policy.

12. Security Measures

• Authenticated AES-256-GCM encryption for all stored documents and biometric imagery.
• SHA-256 cryptographic hashing for tamper-detection and non-repudiation.
• Role-based access controls (RBAC) and strict multi-tenant database isolation.
• End-to-end encrypted transmission over modern TLS 1.3.
• Continuous security auditing, vulnerability assessments, and access monitoring.

13. Policy Updates

We may update this Privacy Policy periodically to reflect legal, regulatory, or operational developments. We will notify registered users of material updates via email or prominent platform notices. Continued platform use after the effective date constitutes acknowledgment of the revised policy.

14. Data Controller & Contact Information

For inquiries, rights requests, or grievance redressal regarding this policy: