Privacy Policy

DataHubz Attest

This section describes how DataHubz Attest (“Attest”, available at attest.datahubz.com) handles information. It supplements the rest of this Privacy Policy.

What Attest Cannot See

• Your documents. Documents in agreements are encrypted in your browser before upload and can be decrypted only in the browsers of the agreement’s parties. We store the encrypted data and cannot read it.
• Your keys. Your encryption key is created on your device. We store only its public part and copies of the private part that are encrypted under your passkeys or your recovery phrase, which we cannot decrypt. We never receive your recovery phrase.
• Your biometrics. Passkeys use your device’s Face ID, Touch ID, Windows Hello, or PIN. Biometric data never leaves your device and is never sent to us.
• The content behind a receipt. Files are fingerprinted (SHA-256) on your device and only the fingerprint is sent, unless you choose to send text for us to fingerprint.

What Attest Processes

• Account information: your email address and plan.
• Agreement information: titles, document file names and fingerprints, signers’ email addresses and names, signing times, and each signer’s passkey signature evidence (the signed statement, the passkey’s public key and credential identifier, and the signature).
• Passkey information: for each passkey, its public key, credential identifier, a device label (for example, “Mac · Chrome”), and when it was added and last used.
• Receipt information: fingerprints, the kind, the claims and metadata you attach, and timestamps.
• Proof information: the zero-knowledge proofs you generate and the information they reveal.
• Billing information: processed by Stripe; we do not store full payment card details.
• Sign-in emails: when you ask for one, your email address, where you were going, and hashes of its link, its code and a secret kept by your browser; they are deleted a day after the email expires (it works for 15 minutes) and when your account is deleted. To show you where a sign-in email was asked from, Attest reads the request’s IP address and your browser’s user agent, and puts in that email the browser, the operating system and the approximate place (city and country, as Vercel, our host, derives it from the IP address), with the time. Attest does not store them; they are only in the email, which Resend delivers.
• Signing problems: when a signing step doesn’t go through (for example, a passkey prompt that was closed or a key that didn’t unlock), we record which step it was, a short error code, and your browser and operating system family (for example, Chrome 141 on Windows) with that agreement, so we can notice when someone is stuck and help. We don’t record the document, anything you entered, your full browser details or your IP address, and we delete these records after 90 days, or sooner with your account or the agreement.
• Security counters: short-lived counters per email address, per browser and per IP address that limit sign-in emails and wrong sign-in codes; routine cleanup deletes them after two days.

Public Blockchains

Attest writes cryptographic fingerprints (hashes and Merkle roots, which contain no names, email addresses, or document content) to the Horizen public blockchain, from a blockchain account DataHubz operates for your Attest account. Zero-knowledge proofs and their public inputs are submitted to the zkVerify network through the Kurier relayer; public inputs are cryptographic values, not readable personal data. Information on public blockchains is permanent and cannot be deleted by DataHubz or anyone else, which is why we never put personal data or document content on them.

What Is Public

• Agreement certificates are public by default: anyone with the link can see the title, the signers’ names and email addresses, and when they signed, but not the document. The agreement’s creator can make a certificate private, after which only its parties can see it.
• Receipts can be verified by anyone with their identifier or the original file, which shows the fingerprint, kind, claim, and time.
• Zero-knowledge proofs show the statement they prove, which may include the email addresses of the parties they name.

Invited Signers

If you were invited to sign an agreement, the person or organization that invited you provided your email address to us so we could send you the agreement. For agreements, that customer determines why your information is processed, and DataHubz processes it on their behalf to provide Attest. If you create an Attest account, we process your account information under this Privacy Policy.

Service Providers

Attest uses the following providers: Vercel (hosting), Neon (database), Resend (email delivery), Stripe (payments), Cloudflare (storage of public cryptographic files that contain no personal data), the Kurier relayer and the zkVerify network (proof verification), and the Horizen network (anchoring).

Cookies and Local Storage

Attest uses only essential cookies: a session cookie that keeps you signed in (up to 30 days), a short-lived cookie (5 minutes) used during passkey setup and sign-in, and, when you ask for a sign-in email, two short-lived cookies: one (20 minutes) that lets only that browser use the email’s code, and one (1 hour) that counts the sign-in emails asked for from that browser. It stores your theme preference, whether you dismissed a notice, and that you signed in with an emailed code (so the dashboard can offer passkey sign-in once) in your browser’s local storage. Attest does not use advertising or tracking cookies.

The Attest Connector for AI Assistants

The Attest connector lets an AI assistant, such as ChatGPT or Claude, or another app that supports the Model Context Protocol (MCP), work with your Attest records. An app connects only after you sign in to Attest and allow it on Attest’s consent page. That page shows the name the app gives itself, the address it returns to, and the permissions it asks for. When an app publishes its registration as a document at its own web address, Attest reads that document and shows the domain it came from; otherwise Attest does not verify the app’s name. An app you configure with one of your Attest API keys instead skips the consent page and has every permission until you revoke the key.

What an assistant never receives. The connector never receives or returns the contents of your documents, which stay end-to-end encrypted, or your keys, passkeys, or recovery phrase. No app can sign for you: every signer signs in Attest with their own passkey.

What an assistant can receive. The permissions you allow decide which tools the app can use and what their results contain:

• Check records: the same public results anyone can see on Attest’s verify page. For an agreement with a public certificate: its title, document file name and fingerprint, status, the signers’ names and signing times, whether each passkey signature is valid, and its blockchain anchor. A private agreement is reported only as private. For a receipt: its fingerprint, kind, claim, time, and anchor. For a Share proof: the statement it proves, the email addresses it reveals, the completion date, and whether it is valid. For a file’s fingerprint: the receipt that matches it, and the public agreements and issued certificates that match it, with their titles and a certificate’s subject and issuer.
• Read your records: the agreements you created or were asked to sign, each with its title, status, dates, the sender’s email address, the signers’ names, email addresses, statuses and signing times, whose turn it is, its certificate link, and its blockchain anchor. For one agreement, it also returns the note to signers, the document’s file name and fingerprint, the signed copy’s fingerprint, the reason it was withdrawn (if it was), the audit trail up to completion (each step, when it happened, and the email address of the person who took it), and the Share proofs you made about it. It also returns your receipts (fingerprint, kind, claim, status, times, and anchor), and your account’s email address, plan, plan usage, and the name of the organization your plan comes from, if any.
• Act on your records: the app can record a receipt from a fingerprint or a short text (Attest stores only the text’s fingerprint), email a reminder to the signers whose turn it is, prepare a new agreement with the title, signers, note, and expiry date it provides, and create a Share proof. Results include the new receipt, the email addresses reminded, the prepared details and their link, and the Share proof’s link and statement. You attach the document and send the agreement yourself, in Attest.

Results come from your own records, except public checks, which return what anyone can see. Your records include other people’s information: the names and email addresses of the sender and signers of agreements you are a party to, and the email addresses a Share proof reveals. That information appears in results too.

Who receives it. Tool results go to the app you connected and its provider (for example, OpenAI for ChatGPT or Anthropic for Claude), only when your assistant requests them. The provider processes them under its own terms and privacy policy, which DataHubz does not control. When an app acts for you, Attest uses the service providers listed above, for example Resend to email a reminder and the zkVerify network to verify a Share proof.

What Attest stores about a connection.

• App registrations: the name the app gives itself, the addresses it returns to, the optional details it provides (its website, software identifier, and version), the permissions it registered for, a hash of its client secret if it has one, and when it last registered and when it was last used. For an app that publishes its registration at its own web address, Attest reads that public document only when a signed-in person starts connecting the app, keeps its contents for at most a day before reading it again, and records the address and when it was read. A registration describes the app, not you, and one registration can serve many people.
• Connections: for each app you allow, your account, the app, the permissions you allowed, the address it returns to, when you connected it, when it was last used, and when the connection ended. Your approval is recorded as the connection.
• Tokens and codes: access tokens, refresh tokens, and authorization codes, each stored only as a SHA-256 hash, with its permissions, expiry, and when it was used or revoked. An authorization code also records your account, the app, the address it returns to, and the app’s PKCE code challenge.
• Prepared agreements: the title, the signers’ email addresses and names, the signing order, the note, and the expiry date an app entered for you.
• Security records: request counters for rate limits, kept per connection, per account, and per API key, and per IP address for failed or unrecognized requests, new app registrations, the consent page, and the public verification endpoint. Each counter holds a count for a short time window. Attest also keeps a one-time identifier of each submitted consent form, so the same approval cannot be used twice.
• A Connector API key: receipts are recorded under an API key, so if your account has none, recording a receipt through the connector creates one named “Connector”.

Why we use it. We use this information only to provide the connector (to authenticate apps, act within the permissions you allowed, and show you your connected apps) and to keep it secure (to limit request rates, prevent abuse, and end a connection when a used code or refresh token is presented again).

How long we keep it.

• Access tokens expire after one hour. Refresh tokens expire after 30 days and are replaced each time they are used. Routine cleanup deletes token records 31 days after they expire.
• Authorization codes work once, for five minutes, and routine cleanup deletes them a day after they expire. The consent page’s approval expires after ten minutes.
• A prepared agreement works for 72 hours. It is deleted when you create the agreement from it, and otherwise by routine cleanup after it expires. You can have up to 50 open at a time; the connector prepares no more until you use or discard one.
• Routine cleanup deletes security counters and consent-form identifiers after two days.
• A connection works until you disconnect the app, sign out of Attest, or the app goes 30 days without refreshing its tokens. You can have up to 50 connections; connecting another ends the one used least recently. An ended connection’s record (the app, the permissions, and the dates) is kept until your account is deleted.
• When your account is deleted, its connections, tokens, pending authorization codes, and prepared agreements are deleted with it. App registrations are not part of your account. A registration an app made with Attest that no one has ever allowed is deleted 30 days after the app last registered; other registrations are kept.

Your choices.

• On the consent page, you decide whether to allow the app, and you can untick “Read your records” or “Act on your records” before you allow it. “Check records”, which uses only public information, is always included. Nothing is shared until you click Allow.
• The Security page in your Attest dashboard lists every app you connected, with its permissions, the address it returns to, when you connected it, and when it was last used. Disconnect ends that app’s connection and revokes every token it holds, at once.
• Signing out of Attest ends your sessions on every device and disconnects every app.
• Removing the connector in your assistant’s own settings stops the assistant from using it. To make sure its tokens stop working too, disconnect it on the Security page.
• To access or delete this information, or your account, contact us as described below.

Retention and Your Rights

Records are designed to remain verifiable, so receipts and signatures are kept for as long as your account exists and as needed to keep them verifiable, unless you ask us to delete them. You can request access to, correction of, or deletion of your personal information at contact@datahubz.com. We will delete or de-identify the personal information we store, such as names, email addresses, and certificates. Fingerprints already written to public blockchains cannot be removed, but they do not identify you on their own. Encrypted documents can be read only by their parties, and deleting them makes them permanently unrecoverable.