Legal

Privacy Policy

Last updated: August 2026

Draft — pending legal review. This document is a working draft provided for transparency and does not yet constitute the final, legally binding privacy policy.

agc.chain ("we", "us", "our") provides a blockchain-anchored compliance platform for airworthiness documentation. This policy explains what personal data we process, why, on what legal basis, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. Data controller

The data controller responsible for the personal data described in this policy is agc.chain. For any privacy request, contact us at privacy@agc.chain. Where agc.chain processes data on behalf of a customer organization (for example, records inside that organization's tenant), the customer is the controller and agc.chain acts as processor under a data processing agreement.

2. Data we collect

  • Account data: name, work email, organization, role and authentication details (including two-factor authenticator enrolment) for the people who use the platform.
  • Organization data: company name, billing contact, subscription plan and, where applicable, tax and payment identifiers.
  • Certificate content: the airworthiness certificates and supporting documents your organization creates or uploads, which may contain the names and signatures of your certifying staff. This content is stored in your tenant's database.
  • Usage and audit data: actions taken in the platform (certify, invalidate, verify, login, logout) logged with user, action, timestamp in UTC and IP address, for security and compliance.
  • Technical data: IP address, browser and device information, and cookies strictly necessary to operate the service and keep your session secure.

3. How and why we use your data

  • To provide, secure and operate the platform and its verification features.
  • To authenticate users and protect on-chain actions with an authenticator step-up.
  • To maintain an immutable audit trail for compliance and integrity purposes.
  • To manage subscriptions, billing and customer support.
  • To detect, prevent and investigate fraud, abuse and security incidents.
  • To comply with our legal and regulatory obligations.

4. Legal bases (GDPR Article 6)

  • Contract: providing the service to you and your organization.
  • Legitimate interests: securing the platform, preventing abuse and improving the service, balanced against your rights.
  • Legal obligation: retaining records where law requires it.
  • Consent: where we ask for it explicitly, such as optional communications; you may withdraw it at any time.

5. The blockchain: only a hash, never personal data

When a certificate is anchored, we compute a one-way cryptographic fingerprint (a SHA-256 hash) of the document and write only that hash to a private, permissioned blockchain. No personal data and no part of the document itself is ever written on-chain. The hash is non-reversible: it cannot be used to reconstruct the certificate or identify any individual. The certificate and its data remain in your organization's database, under your control.

6. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict and object to the processing of your personal data, the right to data portability, and the right to withdraw consent. Because the on-chain record is only a non-reversible hash and contains no personal data, erasure and rectification are applied to the personal data we hold off-chain in your tenant; the historical hash remains as a permanent integrity anchor. To exercise your rights, contact privacy@agc.chain. You also have the right to lodge a complaint with your local data protection authority.

7. Sub-processors

We use a limited number of vetted sub-processors to deliver the service — for example, cloud hosting, payment processing and transactional email. A current list of sub-processors will be published here. Each sub-processor is bound by contractual data protection obligations, and international transfers, where they occur, are covered by appropriate safeguards such as the EU Standard Contractual Clauses.

8. Data retention

We retain personal data for as long as your organization maintains an account and as required to provide the service, then for the periods necessary to meet legal, accounting and compliance obligations. Certificate records and their audit trail are retained as permanent, non-deletable records by design, consistent with airworthiness traceability requirements; the on-chain anchor is, by nature, immutable.

9. Security

We apply appropriate technical and organizational measures, including encryption in transit, strict per-organization (row-level) tenant isolation, role-based access control, mandatory authenticator step-up for on-chain actions, and continuous audit logging. No method of transmission or storage is perfectly secure, but we work to protect your data at every layer.

10. Changes to this policy

We may update this policy as the service evolves or as legal requirements change. Material changes will be communicated through the platform, and the "Last updated" date above will be revised.

11. Contact

For any question about this policy or your personal data, contact us at privacy@agc.chain or visit our contact page.