Contacting us
For privacy questions or requests about your account or your records, contact hello@iblocktechs.com. We reply within 30 days.
Who is responsible
iBlockTechs is responsible for platform accounts: sign-in, two-factor authentication, sessions and organization memberships.
For the content an organization enters into the products, including the people named in it and the email addresses it shares records with, the organization is responsible and we process that content on its behalf and on its instructions. Requests about that content should go to the organization first. If we receive one, we forward it to the organization.
Account data
We store your email address, a password hash managed by Supabase Auth, your two-factor authentication factor, hashed recovery codes, your organization memberships, roles and your language preference.
A browser stays signed in until you sign out or a security change, such as a password reset or account recovery, ends its session. We use account data to sign you in, protect your account, apply your organization’s permissions and keep an audit trail of actions.
Product data
Document files are never uploaded. Their hash is calculated in your browser. We store what your organization enters: record and document names, issuer details, products, batches and events, Evidence titles, descriptions, source links and recipient email addresses, Passport fields, and the names of the people who perform actions.
Verify writes salted commitments, not names or email addresses, to the public Ethereum Sepolia test network. Trace is built to do the same, but its anchoring is not yet enabled in production. Data on a public chain cannot be changed or deleted. Public Verify result pages and Passport pages show only the fields chosen for publication.
Where data is processed
Supabase stores the database and handles authentication in Frankfurt (eu-central-1). The application runs on Vercel; its server functions run in Frankfurt (fra1), next to the database. Signing keys are held in AWS KMS (eu-north-1). GitHub Actions runs scheduled proof processing and Alchemy provides blockchain network access.
Transactional email, such as invitations and the notifications you turn on, is sent through Resend from its EU region in Ireland (eu-west-1); Resend is a US company, so account data such as the recipient address may be processed in the US. Contact form protection (Cloudflare Turnstile) is not enabled in production at the moment. The current provider list is in the trust center.
How long we keep data
Sign-in attempt and challenge records expire within minutes and can no longer be used after that.
A Trace CSV import keeps the uploaded rows only to run the import. They are removed 90 days after the import’s last activity; the import’s row results and counts stay with the organization’s records.
Records, published revisions and audit events are kept while your organization’s agreement is active and are not edited or deleted during that time, because they are the evidence the products provide; the only change is replacing references to a deleted account (see Your choices). When an agreement ends, the organization’s administrators can still sign in and export its records for 90 days, while nothing new can be created. After that, the organization’s records are deleted, except Trace event history already shared with partner organizations (it is sealed into anchored records), billing records we must keep, Verify proofs that were never revoked, which keep only their hash so that people holding the document can still verify it (the document name is removed), and published passports, which stay public for up to 12 months unless you ask us to withdraw them sooner. Database backups are managed by Supabase; deleted data can remain in a backup until that backup expires.
Your choices
You can ask for access to, correction of or deletion of your account data. We complete deletion requests within 30 days: your sign-in, memberships, sessions and preferences are deleted, and references to your account in audit events, revisions and other product history are replaced by a random reference that is not linked to your account. Trace event history keeps the internal account identifier, because it is sealed into the anchored record; the account itself is deleted. If you are the only administrator of an organization, another administrator must be appointed first.
Organization administrators can revoke shares and withdraw public Passport pages at any time, and can download an export of their organization’s records from Trace, Evidence and Passport.
Security incidents
If an incident affects personal data, we inform the affected organizations without undue delay, and notify the KVKK Board and the people affected where the law requires it.