Privacy policy

Who we are

HaruDocs is run by Kensio Software Ltd, a company registered in England and Wales with company number 13374516. Its registered office is International House, 100 Menzies Road, Hastings, TN38 9BB. In this policy "we" means Kensio Software Ltd. For any question about your data, or to use any of the rights below, email support@harudocs.co.uk.

What we hold

About you, as a customer

• The email address you sign up with. Your password is held by Amazon Cognito, and HaruDocs itself never sees it.
• Your business's details: its name, contact name, email address, phone number, postal address, company and tax numbers, bank details for payment and logo.
• The invoices you create, the payments you record against them and the documents you upload or write.

About the people you deal with

• Your clients' names, contact names, email and postal addresses and tax numbers, as you enter them.
• The names and email addresses of the people you send a document to for signing or copy in on it.
• When someone signs or declines a document, we record their name and role, the time, the IP address their request came from and their browser's user agent string (which identifies their browser). These details form the document's audit trail and are printed on the signed document's certificate of completion.
• When an email we send for you bounces or the recipient marks it as spam, we record the recipient's address and the reason their mail server gave.

Our role

Kensio Software Ltd is the controller for your account data and your business's details. We decide why and how we use that data.

You are the controller for the personal data you put into HaruDocs about your clients, signers and copy recipients, and we are your processor. This includes personal data in invoices, documents and signing audit trails. We handle it on your instructions under our terms of service. You must have a lawful basis for using this data and sharing it with us, and permission to email people where the law requires it. If someone asks us about data we hold for you, we pass the request to you.

Each signer's name, role, signing time, IP address and browser details appear on the certificate of completion in the signed PDF. Anyone who has a signed PDF can check it against our records at app.harudocs.co.uk/verify.

We are also the controller for the records we use to prevent spam and keep HaruDocs secure. These are each business's daily sending count, a record of which business sent each email, the bounces and spam complaints those emails get, and the app's logs. We keep the record of which business sent each email for 180 days and the app's logs for 30 days.

Why we hold it

We use your account data to sign you in, run your account and contact you about it. Our lawful basis is our contract with you.

On your instructions, we use personal data about your clients, signers and copy recipients to create and send your invoices and documents, collect signatures and keep the records. We show you bounces and spam complaints against the invoice they concern.

We use our spam prevention and security records to investigate delivery problems, stop misuse and protect HaruDocs and the people it emails. A spam complaint pauses the sending business's email. Our lawful basis is our legitimate interest in doing this.

We don't sell personal data or use it for advertising. We share it with the people you send invoices and documents to and with the services below, and where the law requires it.

Where it is kept

HaruDocs runs on Amazon Web Services. Your account, your business's data, your invoices and your documents are held in AWS's London region (eu-west-2). The public website on www.harudocs.co.uk is served by Amazon CloudFront from locations worldwide. The website stores no customer data.

Who else handles it

• Amazon Web Services hosts HaruDocs and sends its email through Amazon Simple Email Service. AWS handles data for us as a processor.
• Fastmail hosts our support@harudocs.co.uk mailbox. It receives and stores the emails you send there, including your email address and anything you include in your message. Fastmail handles this data for us as a processor.
• DigiCert and FreeTSA timestamp each completed signed document. We send them a cryptographic hash of the document's signature and nothing else. Neither receives the document, a name or an email address.

When you send an invoice or a document, it goes by email to the addresses you enter, and those people's email providers handle it from there.

We store HaruDocs data in AWS's London region (eu-west-2). AWS is a US company. Its Service Terms include a UK GDPR Addendum, which applies automatically. For any transfer of the data out of the UK, it brings in the EU standard contractual clauses as amended by the UK's International Data Transfer Addendum. Emails go to the recipients' own email providers, which may handle them outside the UK.

How long we keep it

• We keep your account, business details, clients, invoices, draft invoices and unsigned documents while your account is open, and delete them within 30 days of its closing. An issued invoice can't be changed or deleted while your account is open.
• We keep signed documents while your account is open. Each one is also locked for six years from the day it was completed. The lock stops the app, or anyone by mistake, changing or deleting it. When your account closes, we put any signed document still under the lock beyond use: nobody can open it, and the verification page stops recognising it. We delete it when the lock ends, or at closure if you ask us to. A signed document whose lock has already ended is deleted within 30 days of closure.
• A logo you replace or remove is deleted after 30 days. A file you start to upload and don't finish is deleted after a day.
• We keep the record of which business sent each email for 180 days, and the app's logs for 30 days, including after an account closes. We keep your daily sending count and any spam complaint records while your account is open, and delete them with it.

To close your account, email support@harudocs.co.uk. Before you close it, you can download each invoice PDF and each signed PDF from the app, and you can ask us for your clients and invoices as a file. You and your signers each received the signed PDF by email when the document was completed.

Cookies

The app on app.harudocs.co.uk sets three cookies, all needed to sign you in and keep you signed in. One is used while you sign in and lasts ten minutes. The other two keep you signed in and last 30 days. Managed login on auth.harudocs.co.uk, run by Amazon Cognito, sets its own cookies for the sign-in it handles.

The website remembers your choice of light or dark colour scheme in your browser's local storage. It is never sent to us.

HaruDocs uses no analytics, advertising or tracking cookies, and its emails carry no tracking pixels.

Your rights

Under UK data protection law you can ask for a copy of the personal data we hold about you, and ask us to correct it, delete it, restrict how we use it, or give it to you in a form you can take elsewhere. You can object to how we use it. Email support@harudocs.co.uk. We can't always delete data when you ask. We keep some data because the law requires it, or because a signed document and its audit trail must stay checkable. We will tell you when this applies.

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

We will change this policy as HaruDocs changes. The date at the top says when it last changed.