Privacy Policy & Data Processing Notice

Under applicable data protection frameworks (including EU GDPR, UK GDPR, California CCPA/CPRA, Brazilian LGPD, and equivalent international legislation), roles are strictly delineated:

a) The Customer Organization acts as the Data Controller. The Customer determines which documents, contracts, personnel files, or supplier invoices are uploaded, who must approve them, and the categories of personal data processed.

b) Ilithya Workflow acts strictly as the Data Processor. Ilithya processes technical, documentary, and personal information solely on behalf of, and pursuant to the documented operational instructions of, the Customer to deliver the B2B SaaS platform.

To orchestrate approval routes and stamp signatures on precise millimeter coordinates, our engine performs automated, strictly bounded technical operations:

• Document Metadata: Page dimensions, orientation, assigned tracking folio, original SHA-256 pre-signature checksum, and target signature placement coordinates.

• Signer Identity Data: Corporate SSO credentials authenticated via OAuth 2.0 (Google Workspace or Microsoft 365), including full name, business email, and designated enterprise role.

• Secure In-Memory Rendering: Ephemeral browser preview rendering allowing signers to inspect the document before executing legal approval.

To provide enterprise approvals with undeniable legal validity, shield our customers from vendor/employee repudiation, and defend against lawsuits, Ilithya Workflow generates and stores:

1. Immutable Cryptographic Audit Log: For every signature, stamp, or rejection, an indelible record is captured containing the UTC timestamp, origin public IP address, authenticated user ID, and SHA-256 cryptographic hash of the document.

2. Non-Repudiation Legal Grounding: Maintaining this cryptographic ledger is legally essential under the UNCITRAL Model Law on Electronic Commerce, the US ESIGN Act / UETA, and the EU eIDAS regulation to prevent signers from fraudulently claiming they never signed or authorized the transaction.

3. Dispute & Audit Defense: In the event of tax audits, labor arbitrations, or breach of contract claims, this forensic evidence trail serves as irrefutable technical proof of transaction integrity.

Unlike legacy signature platforms that lock your corporate documents in proprietary cloud silos to extract recurring storage fees, Ilithya Workflow implements a clean customer-first custody model:

• Hot Storage Processing Cache: Completed or in-transit PDF files are retained in encrypted temporary storage with PostgreSQL Row-Level Security (RLS) for up to thirty (30) days.

• Automated Transfer to Customer Cloud: Upon completion or on day 30, the system automatically transfers the sealed document bundle directly into the Customer’s corporate repository (Google Drive or Microsoft OneDrive).

• Hot Cache Purge: Once verified transfer to the Customer’s cloud is confirmed, the PDF binary is permanently purged from Ilithya’s hot processing servers. Ilithya retains only the lightweight cryptographic audit log (hashes, timestamps, and IP logs) required for legal certification.

Ilithya Workflow establishes strict, legally binding confidentiality commitments:

• Absolute Ban on Data Sales: We never sell, rent, lease, or monetize customer documents, employee contacts, or financial figures with data brokers, ad networks, or third parties.

• Absolute Ban on AI Model Training: No customer document, invoice, contractual clause, or personal record processed in Ilithya will ever be utilized to train, fine-tune, or calibrate public or proprietary Large Language Models (LLMs) or artificial intelligence algorithms.

To safeguard confidentiality and prevent data breaches:

• Enterprise Encryption: Full data encryption in transit via TLS 1.3 with modern cryptographic cipher suites, and AES-256 encryption at rest.

• Multi-Tenant Isolation (RLS): Database-level tenancy enforcement through PostgreSQL Row-Level Security, preventing any accidental cross-tenant data exposure.

• Role-Based Access Control (RBAC): Strict least-privilege policies ensuring only assigned approvers can view each respective case dossier.

Authorized users may exercise rights of Access, Rectification, Erasure, and Objection regarding their direct corporate account details by writing to our dedicated privacy desk.

For inquiries regarding personal data contained within customer enterprise documents, Ilithya will route the request to the respective Data Controller organization.