Privacy Policy

Effective Date: July 2, 2026 · Last Updated: October 1, 2026

This Privacy Policy explains how Bloc Doc Inc., trading as Arkova ("Arkova," "we," "us"), collects, uses, shares, and protects information when you use our website, application, and verification API (together, the "Service"). Arkova provides verification infrastructure: a document fingerprint can be compared with a later file copy, and related public-network anchoring data can be looked up for a record.

1. Our Foundational Guarantee

For documents you upload directly, the file never leaves your device. This is not a feature — it is the architecture. A SHA-256 fingerprint of the file is computed entirely in your browser using the Web Crypto API, and only that fingerprint (plus PII-stripped metadata) is transmitted. We never receive, store, or have access to your original files.

One narrow exception — connector-sourced documents. If you connect a third-party source you already control and authorize (for example, DocuSign or Google Drive), a document you select there is fetched and fingerprinted in memory on our servers, because there is no browser on your device in that flow to compute the fingerprint. In that case the raw file bytes are used only to compute the fingerprint and are then immediately discarded: they are never written to our database, our logs, our error-monitoring, or any temporary storage, and only the resulting fingerprint and PII-stripped metadata are retained. Documents you upload directly are always fingerprinted client-side and never transmitted at all.

2. When We Are Responsible, and When Your Organization Is

Some of the information described below is information we decide how to use, such as the details we hold to run your account, take payment, and keep the service secure. We are responsible for that information, and this policy explains how we handle it.

Other information reaches us because an organization has asked us to verify a document or credential. That organization decides what is submitted and why, and it remains responsible for that information. We act only on its instructions. If your document or credential was verified through Arkova by an organization you deal with, that organization's privacy notice applies, and you should contact them to exercise your rights. We will help them respond, but we cannot answer for them.

3. Information We Collect

Document fingerprints: We retain a SHA-256 fingerprint of your file. A fingerprint does not itself recreate the original file. Depending on the file and information linked to its fingerprint, it may be personal information.

Account information: Email address, name, and organization name when you create an account.

Record metadata: Issuer name, credential type, issue/expiry dates, jurisdiction, and field labels. These fields may be personal information depending on their contents and links to other information.

Billing information: Subscription tier and payment status. Card details are handled by our payment processor (Stripe) and are never stored on Arkova's servers.

Usage and diagnostic data: Page views, feature usage, API call counts, and error diagnostics used to operate and improve the Service.

Contact and newsletter submissions: When you contact us, the name, email address, and message you submit. When you request newsletter updates, your email address. These forms also include the request purpose, source, and notice version.

4. What We Never Collect

• Original documents, PDFs, images, or file contents (beyond the in-memory fingerprinting described in Section 1)
• Raw OCR text extracted from your documents
• Social Security numbers, student IDs, or other personal identifiers from within documents
• Your browsing history outside of Arkova
• Payment card numbers (held only by our PCI-compliant payment processor)

5. AI Metadata Processing

When AI-assisted extraction is enabled, only PII-stripped structured metadata (credential type, issuer, dates, field labels) may be sent to our AI processor for structuring. Personal information is removed before any metadata is sent to our AI processor. For documents you upload directly, that removal happens in your browser, before anything is transmitted. Documents fetched from a source you connect, such as DocuSign or Google Drive, are not subject to AI metadata processing at all. They are fingerprinted in memory on our servers, the file is discarded immediately, and only the fingerprint and a fixed set of technical fields are retained. In neither case is raw document text or document bytes transmitted to the AI processor.

6. How We Use Information

• To provide verification, anchoring, and API services you request.
• To authenticate you and secure your account.
• To process payments and manage subscriptions.
• To operate, maintain, monitor, and improve the Service.
• To communicate with you about the Service and, where you have opted in, product updates.
• To comply with legal obligations and enforce our Terms.

Under the GDPR, our legal bases are: performance of a contract (providing the Service), legitimate interests (securing and improving the Service), consent (marketing email), and legal obligation. Under the Kenya Data Protection Act, 2019, we rely on the equivalent bases: our legitimate interests in operating an authenticated and secure service, performance of our contract with your organization, your consent for marketing email, and compliance with our legal obligations. We do not sell your personal information, and we do not use it for cross-context behavioral advertising.

7. Service Providers & Sub-Processors

We share the minimum data necessary with vetted providers who process it only on our instructions:

A public network records an anchoring transaction associated with a record. Public entries may persist and may be linked with information held elsewhere. The public verification lookup does not return the original document.

8. Data Retention

We retain account and record metadata for as long as your account is active and as needed to provide the Service. When you delete your account, we delete or anonymize the personal information associated with it within approximately 30 days, except where longer retention is required by law.

Security and audit logs are retained for up to 90 days. Billing and tax records are retained for 7 years from the end of the relevant financial period, as required by law.

Anchored proof data on a public network may remain after account deletion. Whether that data is personal information depends on its content and links to other information. For questions about deletion and other rights, contact us as described in Section 11.

9. Cookies & Analytics

The marketing website uses privacy-friendly, cookieless analytics (Vercel Speed Insights) that measure aggregate performance and usage without tracking you across sites. The application uses a session cookie or local storage strictly to keep you signed in. We do not use advertising or cross-site tracking cookies.

10. Data Security

Data is encrypted in transit (TLS) and at rest. Database access is enforced through Row Level Security, so every table has mandatory tenant isolation. API keys are stored only as HMAC-SHA256 fingerprints, never in raw form. Audit events are written to an append-only, PII-scrubbed trail. Our security controls are published as a CSA STAR Level 1 self-assessment (a public disclosure of our controls, not a third-party audit or certification).

11. Your Rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing.

GDPR / UK GDPR (EEA & UK): access, rectification, erasure, portability, restriction, and objection, and the right to lodge a complaint with your supervisory authority.

CCPA / CPRA (California): the right to know, delete, and correct your personal information, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined by law, and we will not discriminate against you for exercising your rights.

To exercise any right, email hello@arkova.ai. We will respond within the timeframe required by applicable law.

12. International Data Transfers

Arkova is based in the United States and processes data there. Where we transfer personal information from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

13. Public Verification

Verification is public by design. Anyone with a record's public ID can look up available public fields, which may include status, issuer name, and anchoring time. Public metadata can sometimes identify a person when combined with other information. The lookup does not return the original document.

14. Children's Privacy

The Service is a business service and is not directed to children. We do not knowingly collect personal information from children. Where local law defines a child as a person under 18, including under the Kenya Data Protection Act, 2019, that definition applies. If you believe a child has provided us information, contact us and we will delete it.

15. Changes to This Policy

We may update this Policy. If we make material changes, we will update the "Last Updated" date and, where appropriate, notify you by email or in-app notice.

16. Contact

For privacy inquiries: hello@arkova.ai

Arkova is a trading name of Bloc Doc Inc., a Delaware corporation. Registered office: 131 Continental Drive, Suite 305, Newark, Delaware 19713, New Castle County, United States.