Privacy Policy

Account data: email address, display name, password (stored only as a salted hash — we cannot read it), and the versions of the Terms and Privacy Policy you consented to.

Profile and verification data: legal name and any information you submit for identity or rights verification. Verification documents are used only to assess verification level.

Your works and evidence: files you upload, their cryptographic hashes, metadata you choose to attach, contracts, listings, and messages you send through the platform. Metadata extraction from uploaded files happens only with your consent.

Payment data: handled by our payment processor (Stripe). We receive transaction confirmations and amounts — never your full card number.

Technical data: logs needed to run and secure the service. Where session activity is logged, IP addresses are hashed.

• operating your account, proof records, vault, and listings;
• generating certificates and, where you choose, public proof pages;
• processing payments and sending transactional email (receipts, notices);
• verification levels and marketplace trust signals you opt into;
• security, fraud prevention, and audit logging;
• legal compliance.

We do not sell your personal data. We do not use the contents of your private evidence vault for advertising or model training.

Private by default: your vault, contracts, deal rooms, and messages. Public only when you make them so: public proof certificates, marketplace listings, and any profile details you choose to display. Public proof pages show the proof summary — never your private evidence files, contracts, or codes.

Service providers that run the platform under contract: our hosting provider, database provider (Supabase), payment processor (Stripe), and email delivery provider. Each receives only what it needs to perform its function.

We disclose data to authorities only when legally required, and where lawful we will notify you of such requests.

Account data is kept while your account is active. Evidence records and audit logs are kept for the life of the proof record they support — that persistence is the product. Hashes anchored to public blockchains are permanent by design and cannot be deleted; they contain no personal data, only a fingerprint of a file.

You can access and update your profile at any time. You can request an export of your data or deletion of your account from your profile page or by emailing us. Deletion removes or anonymizes personal data, subject to the retention rules in Section 5 and any legal obligations.

Passwords are hashed, transport is encrypted (HTTPS), evidence files are stored with access controls and download logging, and administrative access is role-restricted and audit-logged. No system is perfectly secure — if we learn of a breach affecting your data, we will notify you as required by law.

BlockRight is not directed to children and may not be used by anyone under 18. We do not knowingly collect data from children.

Material changes will be versioned, dated, and presented for your consent on your next sign-in, the same way the Terms of Service are handled.

Privacy questions or requests: privacy@blockright.today.