Tersign Privacy Notice

Last updated 12 October 2026 Tersign ("Tersign", "we"). Contact: legal@tersign.ai.

1. What this notice covers

This notice covers personal data for which Tersign decides the purposes and means, as a controller. That is: visitors to tersign.ai, account holders and their personnel, billing contacts, and support correspondents.

It does not cover personal data in the Records our customers submit to the ledger. For that data we act on the customer's behalf as a processor under our Data Processing Addendum (https://tersign.ai/legal/dpa). If your personal data appears in a customer's Records, that customer is responsible for it — please contact them; we will redirect any request we receive to them.

We use Record content that is not personal data on our own account to build datasets, benchmarks, statistics, and published scores, which we may license to others, including for training and evaluating AI models (Terms of Service Section 9). The datasets identify no customer or counterparty; a published score may name the business principal it concerns. Personal data — such as names, postal and email addresses, tax identifiers, IP addresses, and wallet or account identifiers linkable to a person — is never included in any of them, in any form.

Tersign is a business-to-business service. We do not offer services to consumers or children and do not knowingly collect their data.

2. What we collect

• Account data: business name, your name and role, email, jurisdiction, authentication data.
• Billing data: subscription and invoice history. Card payments are processed by Stripe; we do not store card numbers. For crypto payments we record the paying wallet address and on-chain transaction reference.
• Usage and log data: IP address, user agent, API request metadata, and security logs, kept to run and defend the service.
• Support and correspondence: what you send us.

We do not run third-party advertising trackers on tersign.ai.

3. Why we use it (and legal bases where GDPR applies)

• Provide and operate the Services; manage accounts and billing (performance of a contract).
• Secure the Services: abuse prevention, rate-limit enforcement, sanctions screening (legitimate interests; legal obligation).
• Improve the Services, including service telemetry (legitimate interests).
• Communicate service, security, and legal-change notices (performance of a contract; legal obligation).
• Limited B2B marketing about our own services, with opt-out (legitimate interests).
• Comply with law, including tax and record-keeping duties (legal obligation).

4. Sharing

We share personal data only with: Cloudflare (infrastructure hosting, global); Stripe (payment processing); the AI model providers listed at https://tersign.ai/legal/subprocessors, for support and operating the service; professional advisers (lawyers, accountants) under confidentiality; and authorities where the law requires. We do not sell personal data.

Business transfers: if Tersign is involved in an incorporation, reorganization, financing, merger, acquisition, or a sale of assets, personal data and other business data may be transferred as part of that transaction, subject to this notice's commitments.

5. International transfers

We run on Cloudflare's global infrastructure, so data may be processed outside your jurisdiction. Where the GDPR applies to a transfer, we rely on the EU Standard Contractual Clauses or another lawful transfer mechanism.

6. Retention

Account and billing records: for the life of the account and then for as long as tax and business record-keeping law requires. Security and usage logs: shorter operational periods. We delete or anonymize data when it is no longer needed.

7. Your rights

You may request access to and correction of your personal data. Where the GDPR or a similar law applies, you may also request erasure, restriction, and portability, object to processing based on legitimate interests, and complain to your data-protection supervisory authority. To request access or correction, or to exercise any other right, write to our Data Protection Officer at legal@tersign.ai; objecting is always free of charge, and we respond within the timeframes the law sets.

8. Security

Encryption in transit and at rest, least-privilege access with multi-factor authentication, OS-keystore secret management, and logging. No system is perfectly secure; we will notify you of breaches as the law requires.

9. Changes

We will post changes here with a new "Last updated" date and, for material changes, notify account holders by email or dashboard at least 30 days in advance where practicable.