1. What We Collect

NotaryOS collects only the minimum data necessary to operate the service:

• API keys -- stored as irreversible SHA-256 hashes. We never retain your raw key after initial creation.
• Email address -- collected during authentication via Clerk. Used for account identification and service communications.
• Usage metadata -- receipt count, timestamps, and tier information. This data is used for billing and rate-limit enforcement.

2. What We Do NOT Collect

• Raw payloads -- receipt contents are hashed with SHA-256 before storage. NotaryOS never sees or stores the original payload data.
• Credit card or bank details -- all payment processing is handled entirely by Stripe. Card numbers never touch NotaryOS servers.
• Biometric data -- we do not collect fingerprints, facial recognition data, or any biometric identifiers.

3. How We Use Your Data

• Service operation -- authenticating requests, generating cryptographic receipts, and maintaining hash chains.
• Abuse prevention -- rate-limiting, anomaly detection, and protecting the integrity of the receipt infrastructure.
• Billing -- tracking usage against your tier limits and generating invoices via Stripe.

4. Data Retention

Cryptographic receipts are retained indefinitely to preserve audit trail integrity. Deleting receipts would break the hash chain, which is the core guarantee of the service.

API keys can be revoked at any time from your dashboard. Upon revocation the hashed key is marked inactive. Account deletion requests can be submitted to hello@notaryos.org.

5. Third-Party Services

NotaryOS integrates with the following third-party providers, each governed by their own privacy policies:

• Clerk -- authentication and user management.
• Stripe -- payment processing and subscription billing.
• DigitalOcean -- infrastructure hosting and data storage.

6. Contact

For privacy-related inquiries, data export requests, or account deletion, contact us at hello@notaryos.org.