BoC Blockchain of Custody®

Privacy Policy

Controller: VeriBlock, Inc., 335 E. Linton Blvd, Suite B14-2099, Delray Beach, FL ("VeriBlock," "Company," "we," "us," or "our") is the controller of the personal data described in this Policy, except for third-party personal data that you choose to submit or anchor, for which you are the controller (or, for the limited processing described there, we are joint controllers) as described in Section 13. Service: the BoC / Blockchain of Custody® website, applications, and APIs (the "Service"). Contact: it@veriblock.com.

This Privacy Policy explains what personal data we collect, how we use and share it, and the choices and rights you have. It is incorporated by reference into our Terms of Service (the "Terms"); capitalized terms not defined here have the meaning given in the Terms. If you do not agree with this Policy, do not use the Service.

1. Summary (please also read the full Policy)

This data is public, immutable, and cannot be edited, deleted, or made private by us or by you — including in response to a deletion request. Do not anchor anything you are not prepared to make permanent and public. See Section 4.

2. Information we collect

We collect the following, and only the following, categories of personal data.

(a) Account and authentication data.

(b) Content and metadata you submit ("User Content").

Data-minimization caution. We discourage you from including sensitive personal information — health data, precise location, government identifiers, biometric or facial-image data of yourself or others, or other special-category data — in filenames, notes, tags, captured geolocation, captured/scanned images, or uploaded e-mail headers unless it is necessary for your evidentiary purpose. Anchoring permanently fixes a file's cryptographic fingerprint, so anyone who later holds the file can prove that its contents (including any sensitive data) correspond to a public, immutable anchor (see Section 4). Submit only the minimum data needed.

(c) Wallet, payment, and on-chain data.

(d) Usage, device, and security data.

(e) Information we do NOT collect. Except for the opt-in latitude/longitude capture described in Section 2(b) — which is precise geolocation and which we treat as sensitive personal information — we do not collect location data. We do not knowingly collect government identifiers, payment-card numbers, or biometric identifiers, and we ask you not to submit them (see the Terms, "Acceptable use"). Although photo capture and scanning may incidentally include images of identifiable people, we do not perform facial recognition and do not generate, derive, or store any biometric identifier or biometric information from them. Aside from the e-mail headers and any opt-in stored message body described in Section 2(b), we do not collect the contents of your communications. We use no advertising IDs, cross-site trackers, social-login providers, or data brokers.

3. How we use information

We use personal data to, and only to:

  1. Provide and operate the Service — authenticate you, create and display your records, compute and verify proofs, anchor hashes, process Credit purchases, and enable transfers and share links;
  2. Secure the Service — authenticate sessions, enforce rate limits, detect and prevent fraud, abuse, and unauthorized access, and maintain the integrity of custody and access logs;
  3. Communicate with you about the Service when necessary (for example, responses to your requests — note the Service currently sends no marketing or automated e-mail);
  4. Comply with law and respond to lawful requests, enforce our Terms, and establish, exercise, or defend legal claims; and
  5. Maintain and improve the Service; where we do so, we use only de-identified or aggregated data that does not identify you. The Service currently performs no analytics, telemetry, or usage tracking and so generates no such dataset today — this is a reserved right, not a current practice.

We do not engage in advertising profiling or solely-automated decision-making that produces legal or similarly significant effects about you.

Legal bases (EEA/UK). Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service you request); our legitimate interests (security, fraud prevention, operating and improving the Service, and making share-link access data available to the record owner, balanced against your rights); consent (for optional features such as geolocation capture and storing file contents); and compliance with a legal obligation. Where we rely on consent, you may withdraw it at any time without affecting prior processing: decline the relevant browser prompt or feature, or, for content you have already stored, e-mail it@veriblock.com — we action withdrawals promptly and at no charge (see Section 9). Withdrawal of consent for content already stored is handled by us on request rather than through a self-service control, because the Service has no self-service delete-record button.

Special categories (Article 9). Where content you choose to store or upload contains special categories of personal data about you (Article 9 GDPR/UK GDPR) — for example health information, or images revealing characteristics such as racial or ethnic origin — we process it solely on the basis of your explicit consent under Article 9(2)(a), given when you opt to store or upload that content, and you may withdraw that consent as described above. We ask you not to submit special-category data about other people; where you do, you are the controller and are responsible for the applicable Article 9(2) condition (see Section 13).

4. Blockchain data is public and permanent

This Section is important. When you anchor a record or pay with cryptocurrency:

You decide what to anchor. You are responsible for ensuring you have a lawful basis to anchor anything — especially any personal data about other people — knowing it cannot be erased (see the Terms, Acceptable Use). Do not anchor data you are not prepared to make permanent and public.

5. How we share information

We disclose personal data only as described here. We do not sell your personal data, we do not "share" it for cross-context behavioral advertising, and we do not disclose personal data to any third party for monetary or other valuable consideration.

  1. Public blockchains — as described in Section 4 (permanent, public, outside our control).
  2. Infrastructure providers and independent networks. We transmit the minimum data necessary to:

We share only what is necessary for these functions.

  1. People you choose — recipients to whom you transfer a record (the record and its custody log travel to them) and anyone with a share link you create (read-only access until you revoke it).
  2. Legal, safety, and rights protection — to comply with applicable law, regulation, legal process, or a governmental or law-enforcement request; to enforce our Terms; or to detect, prevent, or address fraud, security, or technical issues, or to protect the rights, property, or safety of VeriBlock, our users, or the public. If we obtain actual knowledge of apparent child sexual abuse material, we will report it as required by law.
  3. Business transfers — in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal data may be transferred to the successor entity, subject to this Policy or a successor policy.
  4. With your consent or at your direction, for any other purpose disclosed at the time.

We are not responsible for the privacy practices of third-party networks, wallets, RPC providers, block explorers (e.g., Etherscan), or other services you choose to use; their own policies govern.

6. Third-party services and links

The Service interoperates with independent third parties — public blockchains, RPC providers, wallet software (e.g., MetaMask), and, when you click a transaction link, block explorers such as Etherscan. We do not control these services, do not auto-load third-party scripts, and are not responsible for what they do with information you provide to or generate on them. Review their privacy policies.

7. Cookies and similar technologies

We set a single, strictly-necessary cookie, boc_session, which stores your session token, cryptographically signed for integrity (it is signed, not encrypted, and is not an advertising or tracking token). It is HttpOnly, SameSite=Strict, marked Secure so that it is transmitted only over encrypted HTTPS connections, and expires after 7 days. It is also cleared when you sign out, and it stops authenticating you when you change your password — a password change invalidates the session server-side, though the cookie may remain in your browser until it expires. It exists solely to keep you logged in; without it the Service cannot authenticate you.

We use no advertising, analytics, or cross-site tracking cookies, pixels, web beacons, or fingerprinting. Because we set only an essential cookie and do not sell, "share," or track you across sites, there is nothing for a Global Privacy Control or Do-Not-Track signal to opt out of; consistent with that, these signals do not change our current practices. (Do-Not-Track has no common industry standard and is deprecated in most browsers.) Should we ever sell or "share" personal information or use cross-context behavioral advertising (we currently do none), we will treat a Global Privacy Control signal as a valid opt-out of that sale or sharing.

If you choose to use the optional in-browser zero-knowledge prover ("Prove in browser"), your browser stores cryptographic proving parameters locally in IndexedDB as strictly necessary to perform, on your own device, the proof you requested. This data stays on your device, never leaves it, is not used for tracking, analytics, or advertising, and you can clear it at any time via your browser's site-data controls.

8. Data retention

We retain personal data only as long as needed for the purposes above, then delete or de-identify it, except where longer retention is required or permitted by law:

9. Your privacy rights and choices

In-product controls. You can update your e-mail/password, link or unlink a wallet, create and revoke API keys, and revoke share links in the Service. You can choose not to store file contents and not to grant geolocation. Revoking an API key or a share link takes effect immediately within the Service. Unlinking a wallet, however, only stops future anchors and transfers from being attributed to it; it cannot remove, retract, or make private any wallet address already written to a public blockchain — for example in a prior Hemi anchor or an on-chain transfer — which is permanent and outside our control (see Section 4). (Note: deleting a record or your entire account is handled by us on request — see "Requests" and "Important limits on deletion" below — rather than through a self-service button.)

Requests. Subject to applicable law, you may request to access, correct, delete, restrict or object to the processing of, or port your personal data, and (where we rely on consent) to withdraw consent. To make a request, e-mail it@veriblock.com. We will verify your identity (typically by confirming control of the account e-mail) before acting and will respond within the time required by applicable law. You may use an authorized agent to submit requests where the law allows; we may require the agent to provide proof that you gave them signed permission to act on your behalf, and we may require you to verify your own identity directly with us or to confirm that you authorized the agent, to the extent permitted by applicable law. We will not discriminate against you for exercising your rights. We may charge a reasonable fee or decline to act on requests that are manifestly unfounded, excessive, or repetitive, to the extent permitted by applicable law.

Important limits on deletion. On a verified request, we will delete your account and associated off-chain data (your account record, records, metadata, custody events, access logs, share links, transfer offers, and any encrypted stored file contents). Because account and record deletion is performed manually by our team, we complete it within the period required by applicable law — generally within one month under GDPR/UK GDPR, which we may extend by up to two further months for complex or numerous requests as permitted by Article 12(3) GDPR — and actual timing may vary within the period the law allows. However, (i) we cannot delete or alter data already written to public blockchains, including the on-chain payment transactions recorded there — that data is permanent and outside our control (see Section 4); and (ii) for integrity reasons we do not delete entries in our append-only transparency log or custody checkpoints, which by design record only that an event occurred at a time and contain opaque cryptographic commitments, not your personal data or file contents. We may also retain limited information as necessary to comply with law, resolve disputes, prevent fraud or abuse, and enforce our agreements.

EEA/UK residents. Where the GDPR or UK GDPR applies, you have the rights described above, and you may lodge a complaint with your supervisory authority (and, in the UK, the Information Commissioner's Office (ICO)), though we encourage you to contact us first. Article 27 representative. We have conducted, and keep under review, an assessment under Article 27 GDPR / UK GDPR of whether we must appoint an EEA and/or UK representative. We recognise that the Service is continuously available to EEA/UK users and can write personal data permanently and irreversibly to public blockchains, and we therefore do not treat the Article 27(2) exemption as settled. We will document and periodically re-run this assessment and will appoint and name EEA and UK representatives, and update this Policy, where required or as our EEA/UK user base or processing profile warrants. EEA/UK data subjects may contact us at it@veriblock.com on any matter relating to our processing of their personal data.

Share-link viewers. If you open a public share link (/s/<token>), the time and IP address of your access are recorded in the record owner's access log and are visible to the record owner, for security and the evidentiary integrity of custody records, on our and the owner's legitimate-interest basis. If you are such a viewer and wish to exercise data-subject rights regarding that log entry, contact the record owner who created the link (the controller for that record); you may also contact us at it@veriblock.com and we will assist as required by law.

California residents. In the prior 12 months we collected the following categories of personal information described in Section 2: identifiers (e-mail, wallet/IP address); commercial information (records of Credit purchases); internet or other network activity; precise geolocation (opt-in only); audio, electronic, or visual information (photos and scans you capture or upload); sensitive personal information (account log-in credentials; opt-in precise geolocation; and the contents of e-mail you upload, as described below); and the other User Content described in Section 2. We collected these for the business purposes in Section 3. We collected these categories from you; automatically from your (or, for share-link viewers, the viewer's) device, browser, and network connection (e.g., IP address, access-log entries, and the session cookie); and from the public blockchain.

Categories disclosed for a business purpose. In the prior 12 months we disclosed the following categories for a business purpose or at your direction — identifiers, commercial information, internet or other network activity, geolocation, audio, electronic, or visual information, and sensitive personal information — to our service providers and contractors and, at your direction, to public blockchain networks and to transfer recipients and share-link viewers. We disclosed no categories of personal information for monetary or other valuable consideration, and we sold and shared none.

We do not sell or share (for cross-context behavioral advertising) personal information, and have not done so, including about consumers under 16. You have the rights to know/access, delete, correct, to opt out of sale/sharing (not applicable, as we do none), to limit the use of sensitive personal information (addressed below), and the right to non-discrimination, and we honor these rights regardless of how submitted (including via Global Privacy Control, consistent with Section 7). We retain each category of personal information for the periods and on the criteria described in Section 8 (Data Retention). Submit requests to it@veriblock.com.

Sensitive personal information (CPRA). We collect the following categories of sensitive personal information: (i) account log-in credentials (your e-mail and password); (ii) only if you opt in, your precise geolocation; and (iii) the contents of e-mail messages you choose to upload for notarization (for example, the From, Subject, and Date headers we extract, and any message body you opt to store), of which we are not the intended recipient. We collect, use, and disclose each of these solely to provide the Service you request and to secure it — never to infer characteristics about you and never for advertising. Because our use is limited to the purposes permitted by Cal. Civ. Code §1798.121 and CCPA Regulation §7027(m), we are not required to offer, and do not offer, a separate "right to limit the use of sensitive personal information." We do not sell or share sensitive personal information, and we retain it no longer than reasonably necessary for the disclosed purposes (see Section 8). You may decline the location prompt, choose not to upload an e-mail, or request deletion of a record at any time.

10. Security

We maintain technical and organizational measures designed (but not guaranteed) to protect personal data. These measures currently include, by way of example and without warranty: scrypt password hashing; AES-256-GCM encryption at rest for opt-in stored file contents, with the encryption key held outside the database; signed, HttpOnly session cookies; a strict same-origin Content-Security-Policy with no third-party scripts; access controls and ownership checks; rate limiting; and tamper-evident, hash-chained logs. We may modify, add, or remove security measures over time as we see fit, and no particular measure is promised or warranted. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your password, API keys, and wallet keys; we never hold your private keys, and their loss is irreversible. Notify us promptly at it@veriblock.com of any suspected compromise.

In the event of a personal-data breach, we will notify affected users and/or regulators to the extent, in the manner, and within the timeframes required by applicable law. Because the Service sends no routine e-mail and your e-mail address is our only means of contacting you, we may give any such notice by posting a prominent notice on the Service and/or by e-mailing the address associated with your account, and you are responsible for providing and maintaining a current, valid, and monitored e-mail address; we are not responsible for a failure to receive notice caused by an out-of-date or unmonitored address. Nothing in this Policy guarantees that our security measures will prevent every breach or unauthorized access.

11. International data transfers

We operate from the United States, and our service providers and the public blockchains we use are global. If you access the Service from outside the United States, you understand that your personal data will be processed in the United States and other countries whose data-protection laws may differ from yours.

Transfers to our service providers. Where we engage service providers that process EEA/UK personal data outside the EEA/UK, we put in place appropriate safeguards before such transfers where required — including the European Commission's Standard Contractual Clauses for transfers from the EEA and, for transfers from the United Kingdom, the UK Information Commissioner's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures required following a transfer risk assessment.

Transfers to public blockchains and network RPC endpoints. Transmission of your data to public blockchains and to network RPC endpoints (including the default public Hemi RPC) occurs at your request and direction and is necessary to perform the anchoring and verification you initiate. No Chapter V safeguard such as the SCCs can bind a decentralised, uncontrolled blockchain network, which by its nature replicates data across independent nodes worldwide that we do not control. For these transfers we therefore rely on the derogations in Article 49(1)(b) (transfer necessary for the performance of a contract you request) and Article 49(1)(a) (your explicit consent) of the GDPR / UK GDPR.

12. Children's privacy

The Service is not directed to children or minors, and you must be at least 18 years old (or the age of majority in your jurisdiction, if higher) to register or use it, consistent with the Terms. By registering for or using the Service, you represent and warrant that you are at least 18 years old (or the age of majority in your jurisdiction, if higher) and that you are not accessing the Service on behalf of, or to submit data about, a child without a lawful basis. We do not knowingly collect personal data from anyone under 18, and we do not knowingly collect personal data from children under 13 as defined by the U.S. Children's Online Privacy Protection Act (COPPA) or equivalent law.

If we learn that we have collected personal data from a person under 18 (or under any higher applicable minimum age), we will promptly terminate the account and delete that data to the extent it is within our control. As explained in Sections 4, 8, and 9, however, any data already written to public blockchains, the on-chain payment transactions recorded there, or our append-only transparency log and custody checkpoints is permanent and cannot be deleted, retracted, or made private by us or by anyone. Because deletion is performed manually by our team, "promptly" means without undue delay rather than instantly. If you believe a minor has provided us personal data, contact it@veriblock.com and we will take prompt action.

Children's data submitted by users. You must not use the Service to collect, submit, store, or anchor the personal data of any child or minor — including photographs or scans depicting an identifiable child, or files containing a child's personal data — unless you have a lawful basis and any parental consent required by law. Because anchored data is permanent and public (Section 4), do not anchor children's personal data you are not entitled to make permanent and public (see also Section 13 and the Terms, Acceptable Use).

13. Your responsibilities regarding others' data

You determine the purpose and content of what you submit and anchor, and you are the controller of that content — including the From, Subject, and Date headers (and any stored body) of an uploaded e-mail, a recipient's e-mail address and wallet address on transfer, and any third-party personal data in your files, filenames, notes, or tags. You are responsible for the lawful basis for that processing, for any Article 13/14 (or equivalent) notices to those individuals, and for honoring their rights. Because we have no direct relationship with, or contact details for, those individuals, we cannot provide such notices or carry out substantive fulfilment of their rights on your behalf (for example, we cannot notify the sender of an e-mail you upload or a counterparty whose wallet address you anchor).

Joint controllership for the means we determine. To the extent we determine the essential means of processing this content — the blockchains used, batched-versus-realtime anchoring, the Merkle structure, the specific e-mail header fields we extract (From/Subject/Date) and the DKIM result, and retention/pruning — we and you are joint controllers for that limited processing under Article 26 GDPR/UK GDPR. The allocation of responsibilities is: you remain responsible for the lawful basis and for the Article 13/14 notices and substantive rights-fulfilment toward the individuals concerned (we hold no contact details for them); we are responsible only for the security and operational handling of that data within the Service. As Article 26 requires, data subjects may contact either of us — but because we hold no contact details for the individuals concerned, you remain responsible for providing Article 13/14 notices and for substantive fulfilment, and we will cooperate with you in responding to any request directed to us. To the extent applicable law requires a data processing agreement or joint-controller arrangement for personal data you submit about third parties, we will enter into one with you on request.

Because on-chain data cannot be erased, rectified, or made private, you must not anchor third-party personal data unless you have determined it is lawful to do so permanently (see the Terms, Acceptable Use). You will indemnify us for claims arising from data you choose to submit or anchor, as provided in the Terms.

14. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will provide reasonable notice (for example, by posting the updated Policy with a new effective date). Changes apply prospectively, and your continued use of the Service after they take effect constitutes acceptance.

15. Contact us

Questions, requests, or complaints: it@veriblock.com, or VeriBlock, Inc., 335 E. Linton Blvd, Suite B14-2099, Delray Beach, FL.

This Privacy Policy supplements, and is incorporated into, our Terms of Service.