Privacy Policy

1. Introduction & Scope

TeamDeed Technologies Inc. ("TeamDeed", "we", "us", or "our") provides a SaaS platform for partnership agreement management, e-signatures, and emergency nominee dead-man's switch vaults (accessible via teamdeed.com and app.teamdeed.com).

This Privacy Policy explains how we collect, use, store, process, and disclose information when you access or use our services, communicate with us, or are designated as a nominee partner or emergency referee.

2. Information We Collect

We collect information in the following categories:

• Account & Profile Information: Name, work email address, company or legal entity name, country of registration, and saved script/drawn signature representation.
• Partner & Beneficiary Identifiers: Email addresses and names of co-founders, nominee successors, and Level-3 Emergency Welfare Referees you explicitly invite or designate.
• Encrypted Vault Data: Encrypted payload blobs, 12-byte initialization vectors (IV), 16-byte authentication tags, and encrypted Data Encryption Keys (DEKs). We only store the resulting ciphertext; we never store or transmit your plaintext secrets or master passphrase.
• Forensic Audit & Legal Signature Metadata: In accordance with the US ESIGN Act, UETA, and EU eIDAS requirements, we record immutable cryptographic metadata when a deed is approved or a pulse ping is sent. This includes IP address, user-agent string, cryptographic SHA-256 document hash, and timestamp.
• Billing Information: Payments and subscriptions are processed by our merchant-of-record partner, Freemius. We do not store credit card numbers on TeamDeed servers.

3. Purpose of Processing

We process your information strictly for the following purposes:

• To provide, operate, maintain, and upgrade the TeamDeed platform and dashboard.
• To monitor and execute automated Dead Man's Switch heartbeat check-ins (e.g. 30-day email and WhatsApp reminders).
• To initiate the 72-hour grace period siren and send emergency unresponsiveness alerts to primary account holders.
• To render tamper-evident, legally enforceable DomPDF partnership agreements with valid cryptographic seals.
• To prevent rogue takeovers, fraudulent account claims, and unauthorized data breaches.
• To comply with binding legal obligations, tax filings, and law enforcement requests that do not require decrypting customer secrets.

4. Sub-processors & Third-Party Services

We share metadata only with audited infrastructure sub-processors who meet strict SOC2, ISO 27001, or GDPR adequacy standards:

5. Data Retention & Deletion

You may soft-delete or permanently purge encrypted vault items at any time through your dashboard. When you delete an encrypted vault item, its ciphertext and encrypted DEK are permanently scrubbed from our active databases. Executed legal partnership agreements bearing partner digital signatures are retained in archive to maintain evidentiary validity under the applicable statutory limitation period (typically 7 years).

6. Your Privacy Rights (GDPR, CCPA & Global)

Depending on your jurisdiction, you hold specific legal rights:

• Right to Access & Portability: You can export your data and decrypted vault items in JSON format at any time.
• Right to Rectification: You can amend profile details and business registration numbers.
• Right to Erasure ("Right to be Forgotten"): You may request full account and workspace termination.
• Right to Object & Restrict: You may opt out of non-essential communications (though core pulse heartbeat notifications cannot be disabled while a switch is active).

7. Security Safeguards

All network traffic is encrypted in transit via TLS 1.3 with HSTS enabled. Data at rest is encrypted with AES-256. Access to production environments requires multi-factor authentication, hardware security keys, and least-privilege role boundaries.