Privacy Policy

Sign by Kodar is an e-signing platform. Two roles matter under the GDPR:

The sender is the controller. When a business uploads a document and invites you to sign, that business decides why your data is processed and is the data controller for the signing. Kodar Tarkvara OÜ acts as their processor and handles your data only on their documented instructions (see our Data Processing Agreement).

We are the controller for the platform itself — account holders, billing, security logs, and running the service. For anything about a specific signing request, contact the sender who invited you; for the platform, contact us at privacy@kodar.io. Section 7 says which is which.

Signer identity

First and last name, national personal identity code, country, and email; phone number where Mobile-ID is used.

Signature data

Your qualified certificate, the cryptographic signature, verification timestamps, and OCSP validity proofs, sealed into the ASiC-E container.

Account data

For registered users: name, email, workspace and role. Sign-in credentials (the password hash) are held by our identity provider, Neon Auth — see section 4.

Signing records

Document and signer status timestamps (sent, reminded, opened, signed, declined with any reason you give, sealed), the technical record of each signing attempt, and delivery logs for webhooks a customer has configured.

Usage & billing

Metered events (signature, validation, e-seal) per workspace and, for paying workspaces, plan, billing email and payment order references — card data is handled by Montonio and never reaches our systems.

Rate-limit signals

IP addresses are used in memory to throttle abusive requests and are never written to our database.

To create your qualified electronic signature — your name and personal identity code are sent to SK ID Solutions AS (the Smart-ID / Mobile-ID trust service provider) to obtain your qualified certificate and produce the signature. The legal basis is the performance of, or steps toward, the contract you are signing (Art. 6(1)(b)), and the signing itself relies on your explicit action.

To run and secure the service — account management, fraud/abuse prevention, rate limiting, and audit logging, on the basis of our legitimate interests (Art. 6(1)(f)) and, for account holders, the contract with the workspace (Art. 6(1)(b)).

To meet legal obligations — retaining signed containers and audit records as evidence of a validly executed agreement, and keeping accounting records for the period Estonian law requires (Art. 6(1)(c)).

A national identity code is not a special category of data under Art. 9, but it is sensitive national-ID data; we process it only to request your qualified certificate and to bind the signature to you.

The sender who invited you receives the completed, signed container. Beyond that we use the service providers below, each bound by data-processing terms. This is the same list the DPA publishes for customers, rendered from one source so the two documents cannot disagree. We do not sell personal data and we run no advertising or analytics trackers.

Neon Inc.

Managed PostgreSQL database and, through Neon Auth, the identity store holding account credentials and sessions. EU — AWS eu-central-1 (Frankfurt).

Vercel Inc.

Application hosting, serverless request handling and scheduled jobs. US-incorporated; platform regions per deployment (see transfers).

Object storageNAMED ON REQUEST

S3-compatible object storage for uploaded PDFs and sealed ASiC-E containers. EU/EEA bucket (a deployment requirement).

Validation-engine hostingNAMED ON REQUEST

Hosts the container-validation service that re-checks an uploaded ASiC-E container against the EU Trusted List. It receives the container being validated. Engaged only where container validation is configured. Region set per deployment.

SK ID Solutions AS

Qualified trust service — issues signers' qualified certificates and performs Smart-ID / Mobile-ID signing. Estonia.

Send by Kodar (Kodar Tarkvara OÜ)

Transactional email — signing invitations, reminders and status notices. Estonia; sending worker hosted on Railway Corp. (below).

Railway Corp.

Hosts the Send by Kodar sending worker, which handles recipient names and addresses. US-incorporated; deployment region not confirmed (see transfers).

Montonio

Payment processing for paid workspaces. Card data never reaches our systems. Estonia.

Two entries are marked NAMED ON REQUEST: the object-storage provider and the host of our container-validation service are fixed per deployment rather than in our source code, so we name the live providers on request at privacy@kodar.io rather than publish one we may not be using.

Documents, signer records and the sealed containers are stored in the EU/EEA: the database runs in AWS eu-central-1 (Frankfurt) and the object-storage bucket is required to be in an EU/EEA region.

Two providers above are US-incorporated — Vercel Inc., which hosts the application, and Railway Corp., which hosts the Send by Kodar sending worker and therefore handles recipient names and email addresses. Their deployment regions are set per deployment and are not asserted here. Any resulting transfer relies on an adequacy decision or on Standard Contractual Clauses with supplementary measures as needed. The two providers marked NAMED ON REQUEST are fixed per deployment in the same way; we state their identity and region on request.

Documents, signers and sealed containers are never deleted on a timer by us. They are the legal record of an executed agreement, so their erasure is the sender's decision: a sender can erase a single document — its PDF, its container, every signer record and signing session — from the document page, or erase the entire workspace from Settings. Both are immediate and irreversible.

Everything else expires on a fixed schedule, enforced by a job that runs every night:

Webhook delivery logs

Deleted 90 days after the delivery attempt. They quote signer names (and any decline reason) back to a customer's endpoint and exist to debug delivery, not as a record.

Signing-attempt technical data

The trust-service response payload, the prepared-signature state, the data-to-sign digest and the on-screen verification code are erased 30 days after the attempt. The attempt itself (method, outcome, time) is kept as part of the signing evidence.

Declined access requests

Name, email, company name and registration code from a request we turned down are deleted 30 days after the decision.

Account data

Kept while the workspace is active, and erased with it. The sign-in identity itself lives with our identity provider and is deleted on request during workspace erasure.

Payment records

Payment records are retained 7 years under Estonian accounting law (raamatupidamise seadus § 12) and survive workspace erasure as an accounting record with the workspace reference removed; the raw payment-provider payload is erased at once.

Under the GDPR you have the right to access, rectify, erase, restrict, and object to the processing of your data, and to data portability. Which of us to ask depends on the data, because there are two controllers:

About a signing — ask the sender. The business that invited you is the controller for the document, your signer record and the signed container. They can erase a single document, with everything attached to it, from inside the product; we assist them as their processor and act on their instructions.

About the platform — ask us. For the data we control — your account, the platform-level records in section 2, and anything we hold about you that is not part of a specific signing — write to privacy@kodar.io. We respond within one month (Art. 12(3)). Because a personal identity code is not a secret, we will ask you to establish your identity before we act on a request about a signer record — we will not erase or disclose one on the strength of an identity code alone.

You may also lodge a complaint with your supervisory authority — in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon).

Sign-in credentials are hashed by our identity provider, single-use signing links are cryptographically bound to one signer and document, transport is encrypted, and access is scoped per workspace. Containers carry qualified timestamps and validity proofs so their integrity can be independently verified.

Found a vulnerability? Report it to security@kodar.io — our security page sets out how we handle reports and breaches.

We set only strictly-necessary cookies and no trackers, which is why you see no cookie banner. The Cookie Policy names each one.

We may update this policy; the effective date above reflects the latest version. Material changes will be communicated to account holders.