Privacy notice

Stamp is run by JuriCloud (the “data fiduciary”). This notice explains what personal data Stamp processes, why, for how long, and how you can use your rights under the Digital Personal Data Protection Act, 2023. You can ask for it in any language listed in the Eighth Schedule to the Constitution by writing to the grievance officer below.

What we process

• Your account: name and email address from your Google or Microsoft sign-in, the organisations you belong to and your role.
• Agreements: names, addresses and email addresses of the parties and signatories, the agreement text, comments and versions.
• Signatures: from the licensed eSign provider, the name on your Aadhaar eSign certificate, the last 4 digits of your Aadhaar number and the certificate serial. Stamp never sees or stores your full Aadhaar number or OTP.
• Payments: wallet top-ups, invoices and GST details. Card and UPI details are handled by Razorpay, not Stamp.
• Claims: notices, replies, evidence and the records of mediation and arbitration.
• AI features: the agreement text and the brief you type, sent to our AI provider to produce suggestions you choose to accept.
• Security records: sign-in times and an audit trail of actions on each agreement.

Why

To create your account, prepare, seal and sign agreements, keep tamper-evident evidence of what was signed, send the emails the process needs, bill you, run breach claims you or the other side start, and meet our legal duties. We process your data on the basis of the consent you give when you sign up or sign, and, where the law allows, for legitimate uses such as complying with a law or a court order (s.7). We do not sell personal data or use it for advertising.

Who else processes it

Our processors, each under contract: Supabase (database, sign-in and file storage, India region), Resend (email), Razorpay (payments), the licensed eSign provider and e-stamp vendor, and our AI provider. They may only use the data to provide their service to us.

How long we keep it

• Drafts never sealed: deleted 365 days after their last change. Uploaded files never used: 30 days. AI working drafts: 90 days.
• Signed and sealed agreements, their audit trail and signature records: kept as evidence for as long as a claim could be brought on them.
• Invoices, wallet and payment records: at least 72 months (CGST Act, s.36). Claim and arbitration records: as the law requires.

Your rights

You can get a copy of your data (JSON and PDF), ask us to correct or erase it, withdraw consent, raise a grievance and nominate someone to act for you. Signed in, go to Settings → Your data; otherwise write to the grievance officer. We answer within 30 days. Erasing an account replaces your name and email and closes sign-in; records the law requires us to keep (above) stay, linked to the erased account. Withdrawing consent does not undo a signature already given. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Stamp is for adults (18 and over) acting for themselves or a business.

Grievance officer

The grievance officer’s details could not be loaded. Try again in a moment.