Privacy Policy

C-NDA Protocol™ is operated by WitUp Ltd, a company registered in England and Wales under Company No. 16572774, VAT GB499506632, with its registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

For any question about this page, or to exercise any of the rights described below, write to hub@witup.ai. Account holders can also start a data export or delete their account directly from Settings → Privacy.

For your own account (your profile, your plan, your billing) we are the data controller: we decide what is collected and why.

For the material you protect (the counterparties you invite, the documents you register, what is said in a meeting you protect) you are the controller and we act as your processor: we handle that data on your instructions, to deliver the evidence you asked us to produce. The one thing we decide ourselves is the integrity of the evidence, and that is what the immutability chapter below is about.

Account data: your email address, and the name, company, country and intended use you give us when you sign up, plus your interface language and, if you upload one, your logo. Legal basis: performance of our contract with you.

Plan and billing data: your plan, your monthly usage counters, and your Stripe customer identifier. Payment card details never reach our systems: checkout and subscription management happen on Stripe's own pages. Stripe collects your billing address and, if you give one, your VAT number. We keep a raw copy of the billing events Stripe sends us, so that a payment can always be reconciled. Legal basis: contract, and our legal obligation to keep accounting records.

How you found us: we no longer collect this. Until 24 August 2026, arriving on the site with a campaign link stored campaign parameters, a referral code and the referring site in a first-party cookie, which was then copied onto your account. If you signed up before that date, that data is still on your account and appears in the export you can request from your settings; ask us and we will delete it. Legal basis, while it lasted: our legitimate interest in knowing which channels brought us users.

Marketing consent: only if you tick the box when you create your account, and never inside the act of signing an agreement, which would make the consent conditional and therefore void. You can withdraw it at any time.

Waitlist: while registrations are open in waves, the signup page collects a name and an email address for one purpose: to invite you when a spot opens. We use them for nothing else, we send no marketing to that address unless you later opt in, and we notify our own inbox that you joined. Legal basis: the steps you asked us to take before entering a contract. Write to hub@witup.ai to be removed from the list at any time.

Signatory data, for every person invited to sign: the name they declare, their email address, optionally their company and role, how they were identified, and the exact moment they were identified and accepted. At the moment of acceptance we also record their IP address and browser user agent, because that is what makes the acceptance provable. For a protected meeting, consent to being recorded is a separate, mandatory tick alongside the signature, and its timestamp is recorded too.

For a protected meeting we also ask each signatory for the name they will appear under in the room, so that the person who signed can be matched to a tile in the meeting. Where a tile cannot be matched automatically, and always where a participant joins without a camera, the host confirms the match from the session panel, and that confirmation is recorded as an event inside the sealed evidence package, with the moment it was given and who gave it.

A participant who joins a protected meeting without a camera is identified with two factors rather than one, a passkey and a one-time code sent to their email address, and the certificate states plainly that this is how they were identified, that they were not visible in the room, and that the host confirmed them.

Meeting data, for a protected meeting: the recording (audio, and video only where your plan offers it and you switch it on), periodic screenshots of the participant view, the display names of the people in the room and how long each was present, the automatic transcript, the event log of what happened during the call and, if you ask for it and confirm it, an AI-generated summary.

Error data: when something breaks, a technical error report goes to our monitoring provider. Authorisation headers, cookies, request bodies, meeting links and one-time codes are stripped before it leaves. There is no session replay and no analytics anywhere on this site.

The database, authentication and documents are hosted on Supabase in the European Union, Frankfurt region. Meeting recordings and screenshots are stored on Cloudflare R2 in a bucket created with EU jurisdiction. The portal runs on Vercel; the recording witness runs in a container hosted by Railway in Amsterdam.

What is published on the public blockchain is only a 32-byte cryptographic hash, with a timestamp and the address of our own wallet. It contains no name, no email address, no IP address and no content, and it cannot be reversed into any of them.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

That commitment binds every piece of Google user data we receive, and here is exactly what we receive today.

If you choose “Continue with Google” to sign in, we receive the basic profile Google returns for sign-in (your name, your email address and your profile picture) and we use it only to create and open your account. We ask for no additional scopes.

If you choose to connect your Google Calendar (an optional feature you switch on yourself, behind a separate Google consent screen) we ask for one additional, read-only permission: https://www.googleapis.com/auth/calendar.events.readonly. With it we read your calendar events (title, start and end time, organiser, guest list and meeting link) for one purpose: recognising the meetings you want protected, preparing the session and having the witness join at the right moment. To keep that connection alive we hold a Google refresh token, stored encrypted and never sent to the browser, together with the email address of the connected Google account. Disconnecting the calendar from the app deletes the token, and you can also revoke our access at any time from your Google Account's security settings.

If you prefer to connect nothing, the invitation path exists instead: you may invite our own C-NDA mailbox to a meeting, exactly as you would invite any other guest. Our system then reads the invitations that arrive in that mailbox (the meeting title, its start and end time, the organiser's address, the guest list and the meeting link) for the same purpose. In both cases the meeting link is stored encrypted; the organiser's address and the meeting title are stored so that we can show you the meeting and avoid preparing it twice.

Data received from Google is never used to serve advertising, is never sold or transferred to data brokers, and is never used to create, train or improve any machine learning or artificial intelligence model. Calendar information is not placed in any AI prompt. No person on our side reads it except where you have asked us to look at a specific problem, or where security or the law requires it.

Most of the personal data we handle belongs to people who are not our customers: the counterparty invited to sign, the colleague sitting in a protected meeting, the guest listed on an invitation sent to our mailbox. We take that seriously, and we keep the footprint as small as the purpose allows.

An invited signatory receives an email that says who invited them and what they are being asked to sign, is identified before they can accept, and, for a meeting, is asked separately and explicitly for consent to being recorded before anything is captured. The legal basis is the agreement itself, entered into at their own request; and for us as processor, the instructions of the customer who invited them.

For guests listed on an invitation sent to our mailbox, the legal basis is our legitimate interest, and the customer's, in preparing the meeting they asked us to protect. Any of these people can write to hub@witup.ai to ask what we hold about them.

When a protected meeting ends, the certificate is issued automatically and sent by email to everyone bound by it, every signatory and the host, together with the automatic summary where the plan includes one. Both the transcript and the summary are labelled as automatic and not reviewed by anyone, because at that moment nobody has read them. The organiser of a meeting can choose, session by session, to have the summary sent only after they have reviewed it; the certificate itself is never held back.

The recording witness joins the call under the visible name “C-NDA Protocol”, appears in the participant list like anybody else, and is muted with no camera. It joins silently and records nothing (not a single byte, screenshots included) until the portal tells it that everyone required has signed and consented. If nobody signs, it leaves without having captured anything.

While recording, it captures the meeting audio and, when video is enabled, the meeting tab as it is displayed, which includes a shared screen while it is being shared. It takes periodic screenshots of the participant view. It reads the display names shown on screen in order to record who was present and for how long. It does not read the meeting chat, it does not read your other tabs, your browsing history or your cookies, and it never writes the meeting link anywhere.

When coverage is incomplete (the witness was disconnected, a video track died, a size budget ran out) that gap is declared in the certificate itself. It is never quietly hidden.

Before any audio is sent for transcription we measure whether it contains speech at all. If it does not, nothing is sent, no transcript is produced, and the certificate says so. The same check runs afterwards on what comes back: a transcript whose segments do not cover the recording is refused rather than sealed.

Both are optional tools for the person who organises a meeting; a participant never installs anything. Neither stores credentials: they act through the session cookie you already hold on this site, and if you are not signed in they send you to the sign-in page. They contain no analytics, no advertising and no tracking code, and they talk to C-NDA and to nothing else.

The Chrome extension runs on meet.google.com pages for one purpose: to read the meeting code out of the page address, so it can ask whether that meeting already has a C-NDA session. The meeting code travels to us as a one-way fingerprint rather than as a link, and is only ever matched against sessions belonging to your own account.

Supabase: database, authentication and document storage, in the EU (Frankfurt).

Cloudflare R2: storage for recordings and screenshots, in a bucket with EU jurisdiction.

Vercel: hosting for this site. Railway: hosting for the recording witness, in Amsterdam.

Stripe: subscriptions, checkout and invoicing. Stripe receives your email address, your name and the billing details you enter on its own pages.

Resend: delivery of transactional email: invitations, one-time codes, certificates, reminders and billing notices.

Automatic transcription runs on our own infrastructure (an open-source speech model on Railway, Amsterdam): the meeting audio is not sent to any third party to be transcribed.

Google (Gemini, via Google AI Studio): on plans that offer it, the draft summary of a meeting. This is the most substantial transfer in the system: the complete transcript is sent to draft the summary. Google does not receive the audio.

DeepSeek (Hangzhou DeepSeek Artificial Intelligence, China): emergency fallback for the draft summary only, used when Google does not respond. In that case the complete transcript is sent to DeepSeek, outside the European Union; the summary states which provider produced it. The audio is never sent.

Sentry: error monitoring for the portal and the witness, with authorisation headers, cookies, bodies, meeting links and one-time codes removed before sending, no session replay, and error reports delivered to the EU region.

An RPC provider (Alchemy): used only to send the hash to the Polygon network and to read the network back. It receives no personal data.

We do not sell personal data, and we do not share it with advertisers.

Meeting recordings on the Free plan: every recording is deleted 12 months after the session ends, whether or not the session was ever certified, and we email you 30 days before it happens. A session that was never certified is not exempt: it simply never produced a certificate, and keeping the recording of a meeting nobody ever sealed would be the worst outcome for the people who were recorded. The notice always comes first: if you move from a paid plan to Free with a recording already older than 12 months, we still give you the 30 days. On paid plans the recording stays until you ask us to destroy it, which you can do at any time once the session has been certified, or until 30 days after your paid plan ends without renewal (Terms §4): we email you 7 days and 1 day before that date, and a renewal cancels the deletion. Destroying a recording never touches the certificate, its evidence package or its anchor: the hash remains as evidence that the recording existed as certified, and the destruction is recorded in the session.

Other stored data when a paid plan ends: thirty days after a paid plan ends without renewal we also delete the media of sessions that were never certified, documents uploaded for protections that were never certified, your exports and your logo, with the same two notices. Each step is recorded with the count of what was removed.

Data exports: the download link we email you stops working after 7 days, and you can request one export per 24 hours. The archive itself is deleted from our storage once that link expires: what stays is the record that you asked for it and the date we removed the file.

Invitations: a signing invitation expires after 7 days, and a standalone registration expires after 14 days if nobody accepts. One-time codes last 10 minutes and allow three attempts. Links to a recording, a certificate PDF or an evidence package are signed and expire 10 minutes after they are issued.

Certificates and evidence packages: kept for as long as they can be needed as evidence, and in any case for at least five years from sealing, which is the point of the product. See the next chapter.

Meeting invitations sent to our mailbox, raw billing and meeting events and error reports: we have not yet set an automatic deletion period for these, but deleting your account redacts the personal content of the raw events straight away (see the next chapter). You can ask us to delete them at any time, and we will unless keeping them is required to reconcile a payment or to comply with the law.

You can ask for access to your data, correction of it, a copy of it in a portable format, deletion, restriction of processing, and you can object to processing based on our legitimate interest. Access and portability are self-service: Settings → Privacy produces a ZIP archive and emails you a link.

Deleting your account permanently removes your profile, your protections and your sessions, along with everything inside them: titles, drafts, transcripts, summaries and event logs. Some things deliberately survive, and you should know which.

Certificates already issued survive, and so do the records of the people who signed them: their name, email, company, the moment they accepted, and the IP address and user agent captured at that moment. A certificate is evidence that belongs to every bound party, not only to you, your counterparties keep their access to it for as long as we keep it, and anyone holding the code can still confirm that it exists and is intact.

The sealed evidence package cannot be edited. Once its hash is anchored on the blockchain, changing a single character would destroy the very proof the package exists to provide. That is why the name, email address, IP address and user agent of each signatory, along with the transcript and event log of a protected meeting, cannot be altered or erased from a package that has already been anchored. Corrections do not overwrite: they produce a new certificate in a documented revision chain.

What we can always do is destroy the stored recording of a protected meeting, on request and irreversibly, while the certificate stays valid: its hash remains as evidence that the recording existed as certified. Note that destroying the recording does not remove the periodic screenshots or the transcript, which remain part of the sealed package.

Raw billing and meeting events we receive from Stripe and from the recording witness are kept without a link to your account, because they arrive before we know whose they are and because they are what stops the same event from being processed twice. When you delete your account we redact them: the personal content of the event (billing name, email, address, VAT number, and the display names of people seen in a meeting) is replaced, and only the event identifier, its type and its timestamp remain.

Files in storage are treated by what they are evidence of. Deleting your account removes your logo, any data export archive, and the recordings, screenshots and uploaded NDA documents of protections that were never certified: none of those are sealed inside anything. What stays is what a certificate points at: certificate PDFs, evidence packages, and the recording and uploaded document of a certified protection. Removing those would destroy the very proof the package exists to provide, and that proof belongs to every bound party, not only to you. Ask us and we will remove anything of yours that is not required as evidence.

If you believe we have handled your data badly, we would like to hear it first at hub@witup.ai; you also have the right to complain to your data protection supervisory authority.

Anyone holding a certificate code can check it at c-nda.com/verify. That check returns only the code, the type of certificate, the package hash, the blockchain transaction, the timestamps and the number of bound parties. No name, no email address, no content.

There is also a public registry, and it is off by default. A certificate appears in it only if its owner switches it on, one certificate at a time, and only three fields can ever be published: the title, the declared names of the parties and their companies. Never an email address, an IP address, a document or a transcript. It can be de-listed at any time.

Data is encrypted in transit, and at rest by our hosting providers. Meeting links are additionally encrypted in the database with a key that is never sent to the browser and never appears in pages, logs or messages: a link is decrypted only when the corresponding participant has signed, so that before then it cannot be read by anyone in the browser, including us. Invitation tokens and one-time codes are stored only as hashes, never in readable form.

Access to the database from a browser is closed by row-level security on every table; the tables holding signatory data have no client-readable policy at all and are reachable only through our server, after a valid invitation token has been presented.

If we change what we do with personal data, we change this page, and the version and date at the top change with it. Material changes will be announced to account holders by email.

This policy is written in English and translated for convenience; if a translation and the English text differ, the English text prevails, as the Terms of Service state.

WitUp Ltd: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Company No. 16572774 · VAT GB499506632. Privacy requests: hub@witup.ai.