隐私政策

This Privacy Policy explains how the PQC Imza service processes your personal data. If you are in Türkiye, our Turkish notice under Law No. 6698 (KVKK Aydınlatma Metni), at https://pqc-imza.com/tr/legal/kvkk, explains how ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. processes your personal data and how to exercise your rights.

1. Data controller

PQC Imza is a ZincirX product, provided by two companies: ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. ("ZincirX A.Ş."), established in Türkiye, and ZincirX Inc., a Delaware corporation. Which of them is responsible for your data, that is the data controller, depends on where you are:

• If you are in Türkiye, ZincirX A.Ş. is the controller of your personal data. Our KVKK notice (in Turkish) describes this processing in detail.
• If you are anywhere else, ZincirX Inc. is the controller.
• Paid plans and document fees are sold to every buyer, including buyers in Türkiye, by ZincirX Inc. through Stripe, so ZincirX Inc. is the controller of purchase and payment records.

ZincirX A.Ş. runs the Service from Türkiye for both companies. It processes the data ZincirX Inc. is responsible for on ZincirX Inc.'s behalf, only on its instructions and to provide the Service, under a data processing agreement between the two companies. The two companies are separate controllers, not joint controllers. Our contact details are at the end of this page.

2. The data we process

Category	Data
Identity	Full name and Turkish national ID number; if you verify your identity in the mobile app, the document number, document type and expiry date read from your ID card's chip
Contact	Email address
Account	If you sign in with Google, your Google account ID, name, email and profile picture; if you sign in with Apple, your Apple account ID, name and email; your language preference
Wallet and signature	Your PQC wallet addresses, public keys, signatures, the messages signed, signing times and your identity assurance level (L0–L3)
Documents	The documents you upload or create, their titles and descriptions, document hashes, signer lists and document history
Payments	Amount, currency, date, status and Stripe transaction reference. Your card details are processed by Stripe; we never see or store your card number.
Team plans	If you invite someone to your plan, the email address you give, used to send the invitation; while they are a member, you see their email address and whether they accepted, and they see your name as the person paying for the plan
Security	IP address, session data, browser information and server logs
Usage (only if you allow analytics)	What Google Analytics records on the public pages and the dashboard: see the Cookie Policy. Never on pages that show your documents or signatures.

Biometric data: the face match in the mobile app happens only on your phone. Your face image or biometric template is not sent to our servers and we do not store it; we receive only the result of the check (your identity assurance level).

Other people's data inside documents: if the documents you upload contain other people's data, you are the data controller for that data; we process it only on your instructions, as data processor, to provide the Service.

3. Why we process it, and on what legal basis

Purpose	Legal basis (KVKK Art. 5(2))
Opening and running your account, storing documents, running the signing process, sending notification emails	Formation and performance of a contract (c)
Verifying who signed and that the signature is valid, keeping the signature and document as evidence, recording on the blockchain	Performance of a contract (c); establishing, exercising or protecting a right (e)
Taking payments, keeping invoicing and accounting records	Performance of a contract (c); legal obligation (ç)
Keeping the Service secure, preventing abuse and fraud, fixing faults	Legitimate interest (f); legal obligation (ç)
Responding to authorities and courts	Legal obligation (ç)
Measuring how the public pages and the dashboard are used (Google Analytics 4), only if you allow it in the cookie banner	Your explicit consent (KVKK Art. 5(1)); you can withdraw it at any time with "Cookie settings"

We do not send marketing email and we do not use your data for advertising.

4. How we collect it

Electronically, by automatic or partly automatic means: through the website's forms, Google or Apple sign-in, the mobile app (including reading your ID card's chip), our payment provider Stripe, and cookies.

5. Who receives it

We share your data only as far as needed to provide the Service:

Recipient	Purpose	Location
ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş.	Running the Service, support and maintenance; controller for users in Türkiye, and ZincirX Inc.'s processor for the data ZincirX Inc. is responsible for	Türkiye
ZincirX Inc.	Seller of paid plans and documents; controller for users outside Türkiye	USA
Hostinger	Hosting the Service and its data; sending notification emails	Lithuania (EU)
Stripe	Taking payments	USA / Ireland
Google	Google sign-in; the text you write if you use the AI assistant in the document builder (Gemini); Google Analytics, only if you allow it	USA
Apple	Sign in with Apple	USA
SciChain blockchain	Recording documents (see below)	Public network
Competent authorities and courts	Legal requests	Türkiye

Some of these recipients are outside Türkiye, so your data is transferred abroad. Such transfers are made in line with the procedures and safeguards of KVKK Article 9.

About the blockchain record: when a document is recorded on the blockchain, its hash, the signature hashes, the signers' wallet addresses and a label of the form "PQC Imza #document number" are stored on SciChain permanently and publicly. By the nature of a blockchain this record cannot later be changed or deleted. The document's content and title, your name, national ID number and email are not written to the blockchain. Documents recorded before 25 September 2026 carry their title instead of the label.

The signature verification page shows anyone checking a document the signers' names and a partly masked ID number; showing who signed is what that page is for.

6. How long we keep it

• Account, document and signature records: for as long as your account is open. Because signatures are evidence, they may be kept after the account is closed for the relevant statutory limitation periods (generally 10 years), then deleted or anonymised.
• Payment and accounting records: for the periods set by tax and commercial law (5–10 years).
• Server and security logs: as long as needed for security, and no longer than 2 years.
• The blockchain record: permanent; it cannot be deleted (see above).

7. Your rights (KVKK Article 11)

You can ask the data controller:

• whether your personal data is processed, and for information about it if so;
• why it is processed and whether it is used for that purpose;
• who it has been transferred to, in Türkiye or abroad;
• to correct it if it is incomplete or wrong;
• to delete or destroy it under the conditions of KVKK Article 7;
• to tell the third parties it was transferred to about a correction, deletion or destruction;
• to object to a result against you that arises solely from automated analysis;
• to be compensated for damage caused by unlawful processing.

Two of these you can do yourself, under “Your data” on your profile page: download a copy of the data we hold about you, and close your account. Closing removes your name, email, national ID number and wallet links; the documents and signatures other people rely on are kept as section 6 describes.

Write to hello@pqc-imza.com from the email address registered to your account, so that we can confirm it is you, or send a written request to the address below. We will answer free of charge within 30 days. If we reject your request or you find the answer insufficient, you can complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

8. Cookies

We use the cookies the Service needs to work (pqc-imza-session, XSRF-TOKEN, remember_web_…, sign_in_locale and zx_consent, which keeps your cookie choice for 6 months) and, only if you allow it, the Google Analytics cookies _ga and _ga_5P2X21YMVX (Google LLC, USA, up to 2 years), never on pages that show your documents or signatures. Our fonts are served from our own site. See the Cookie Policy; you can change your choice at any time with "Cookie settings" at the foot of every page.

9. Security

Connections are encrypted with TLS; documents are kept in storage that is not publicly accessible; your signing keys never leave your device. No system is completely secure; if a data breach occurs we will notify the people affected and the Board as KVKK requires.

10. Changes

We may update this notice. The current version is always on this page, and we will announce material changes separately.