FIPSign (fipsign.dev) is a post-quantum signing service operated by an independent developer based in Argentina. References to "we", "us", or "FIPSign" in this policy refer to that individual operator.

For any privacy-related inquiries, contact us at [email protected].

We collect the minimum data necessary to operate each product:

• Email address — provided by you when creating an account or requesting a trial or license. Used for authentication, license delivery, and service communications.
• Company name — provided when requesting a PQ-Proxy On-Premise trial or license. Used to identify the license tenant.
• Usage data (PQ-Sign) — number of tokens consumed per month, per project, and per API key. Used to enforce free tier limits and display your usage dashboard. No personally identifiable content from your signed payloads is stored.
• API key metadata (PQ-Sign) — hashed API keys (we never store raw keys), key names, creation dates, and last-used timestamps.
• Domain and backend configuration (PQ-Proxy Cloud) — the domain names and backend hosts you configure. Used to route post-quantum TLS connections to your backend.
• Connection logs (PQ-Proxy Cloud and On-Premise) — connection metadata including client IP address, domain, bytes transferred, and TLS handshake timing. No application-layer content is logged.
• Heartbeat data (PQ-Proxy On-Premise) — the IP address and version of your on-premise installation, sent to proxyonprem.fipsign.dev every 24 hours. Used to validate the license and detect unauthorized use.
• Payment data — email address and, where applicable, company name are shared with our payment processor (OxaPay) when making a purchase across any FIPSign product. We do not store or process payment card or cryptocurrency wallet details directly.

We do not collect names, phone numbers, payment card numbers, physical addresses, or the content of payloads signed through PQ-Sign.

Your email address is used exclusively for:

• Sending one-time password (OTP) codes for authentication.
• Transactional communications — account-related notices, service changes, security alerts.
• Service updates and product announcements from FIPSign. You may opt out of these at any time by contacting us at [email protected].

We do not use your data for advertising, profiling, or any purpose beyond operating and improving the FIPSign service.

We use the following third-party services to operate FIPSign. Each acts as a data processor under our instruction:

• Email delivery — we use Resend (resend.com) and Brevo (brevo.com) as primary and fallback email delivery providers for all FIPSign products. Both providers may receive your email address for the purpose of delivering transactional emails (OTP codes, license files, service notices) and, where applicable, product announcements. You may opt out of non-transactional communications at any time by contacting [email protected].
• Payment processing — we use OxaPay (oxapay.com) to process payments across all FIPSign products. Your email address and, where applicable, company name are shared with OxaPay solely to generate and fulfill a payment order. OxaPay processes cryptocurrency transactions and is subject to its own privacy policy.
• Infrastructure and hosting — FIPSign runs on a combination of cloud providers including Cloudflare (Workers, D1, KV) and third-party hosting platforms. These providers may process request metadata (IP addresses, request timestamps) as part of normal operations. See Cloudflare's Privacy Policy for details on Cloudflare's data handling.

We do not sell, rent, or share your personal data with any third party for their own purposes.

We retain your email address and account data for as long as your account is active. If you request account deletion, we will remove your email address and associated account data within 30 days.

Usage logs (token consumption records for PQ-Sign) may be retained for up to 12 months for billing and audit purposes, after which they are deleted.

Connection logs (PQ-Proxy Cloud and On-Premise) are retained for the period configured at installation (default 30 days for On-Premise) or as required for service operation, after which they are deleted.

Heartbeat records (PQ-Proxy On-Premise) — IP address and version — are retained for as long as the license is active. Records not updated in 90 days are automatically purged.

Trial and purchase records (email, company name, IP address) are retained for 12 months for fraud prevention and license audit purposes.

OTP codes are automatically expired and deleted after 10 minutes.

Under Argentine Law 25.326 (Personal Data Protection) and, where applicable, the GDPR, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and associated personal data.
• Opt out of non-transactional communications at any time.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

We implement industry-standard security measures including HTTPS/TLS for all connections, hashed storage of API keys (raw keys are never stored), HttpOnly session cookies, and infrastructure protected by Cloudflare's edge network.

No method of transmission over the internet is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security.

FIPSign cloud products use a session cookie to maintain your authenticated session in the dashboard. This cookie is HttpOnly, Secure, and expires after the configured session duration (default 24 hours). We do not use tracking cookies, analytics cookies, or any third-party advertising cookies.

PQ-Proxy On-Premise runs on your own server. Any session cookies set by the on-premise dashboard are stored in your browser and handled entirely by your own infrastructure — they are not accessible to FIPSign.

We may update this Privacy Policy from time to time. If we make material changes, we will notify registered users by email before the changes take effect. The effective date at the top of this page will always reflect the most recent version.

Continued use of the service after notification of changes constitutes acceptance of the updated policy.

For any questions or concerns about this Privacy Policy or your personal data, contact us at [email protected].