Privacy Policy

1.Who we are and what this covers

Agrim E Sign is an electronic contracting platform operated in Nepal. It lets a person or an organization prepare a contract, send it for signature, and receive back a finished document whose authenticity anyone can check.

This policy applies to everyone who touches the service: people who hold an account, people who are sent a document to sign, and organizations that send documents through us. Where this policy and the Terms of Service overlap, both apply.

2.What we collect

We collect what a contract, an identity check or a security record actually needs, and not more.

• Account details — your name and email address, and optionally your phone number and postal address, given when you register or complete your profile.
• Identity documents — the citizenship certificate, passport, driving licence or PAN card you upload for verification, together with the number printed on it. Organizations additionally submit a registration certificate and a PAN document.
• Signature and stamp images — the signature you draw, type or upload, and an organization's stamp image.
• Contract data — the documents you upload or write, the values filled into their fields, and the names, email addresses and roles of every party to them.
• Signing and security events — the date, time and IP address of each view, read confirmation, one-time-code check and signature, along with your browser's user-agent string. These are the evidence that a signature happened, and they appear on the audit page of the finished document.
• Operational records — the emails we sent you and their delivery status, your sessions, rate-limit counters, and any abuse report that mentions you.

3.Why we collect it

To execute contracts. Names, field values and email addresses are what the document is made of and how it reaches the people who must sign it.

To verify identity. Identity documents are reviewed by a person so that a signature can be tied to a real, checked identity — which is the difference between an electronic signature that is worth something in a dispute and one that is not.

To build a legal evidentiary record. Timestamps, IP addresses, read confirmations and one-time-code results exist so the audit certificate attached to a completed contract can answer the question: who signed this, when, and what proved it was them.

To keep the platform safe. Rate-limit counters, session records and abuse reports exist to stop the service being used for phishing or fraud.

4.Encryption, and who can reach your documents

Every document and every identity image is encrypted before it is stored. Each file gets a key of its own, and that key is itself encrypted with a master key held separately from the files. A stolen copy of the storage is not a readable copy of your contracts.

Access is decided by role: the parties to a contract, the organization it belongs to, and anyone you have deliberately shared it with. Every decryption is written to an append-only log recording which account asked and why.

We will also be plain about the limit of that. Agrim E Sign is operated by people, and those people hold the infrastructure — the servers, the database and the key material. Platform operators therefore retain infrastructure-level access to stored data. That access is restricted to named administrators, is logged like any other decryption, and is used only to operate the service, to investigate abuse, or to comply with a lawful order. The administrative console itself has no path to a document's contents: it shows a contract's name, ID, hashes and metadata and nothing else. Anyone who tells you their platform's staff can never reach your files is describing a product where you alone hold the keys, and that is not what this is.

5.Photographs, thumbprints and location

A contract can ask for more than a signature. Depending on what the sender chose when the contract was sent, you may be asked for a photograph of yourself taken at the moment of signing, for a thumbprint, or for a photograph placed on the document itself.

A photograph of a face and a thumbprint are biometric information. We treat them as such: they are collected only when the contract you are signing asked for them, only after you have been told on screen what is being taken and why, and never without your agreement. If you do not want to be photographed you can close the page, and nothing is sent.

An identity photograph is taken on a second device, usually your phone, which you reach by scanning a code. When you take it we also record that phone’s network address, its browser, and the instruction you were asked to follow. If you allow it, we record the location your phone reports together with how accurate it says that reading is. Refusing location does not stop you signing, and the record simply says location was not provided.

We say plainly what this evidence is and is not. It is corroboration that a person was present and able to follow an instruction on camera. It is not proof that a camera was physically present: no website can establish that, and we do not claim to.

An identity photograph is visible to you, to the sender of the contract, and to our staff handling an abuse report or a dispute. It is not visible to the other parties on the contract. Every occasion on which anybody decrypts it is recorded in a log that cannot be edited.

We destroy identity photographs two years after the contract they belong to is completed, declined, voided or expired. When one is destroyed we keep the record that it was taken and destroyed, so you can always be told what we held and when it went. A thumbprint or a photograph placed on the document itself is part of that document, and is kept for as long as the document is.

6.Who else sees your information

The other parties to a contract see the document, the values in it, and each other's names, email addresses and signing timestamps. That is what signing a contract together means.

People you share a completed document with — by time-limited link or by a lasting grant — see it read-only. Every view is logged, and you can revoke a share at any time.

Our service providers, which are the email service that delivers notifications and the infrastructure that hosts the platform, process data on our instructions and only as far as the service requires.

We do not sell personal information, and we do not use your contracts or their contents for advertising or to train models.

We disclose information to an authority only where the law of Nepal requires it, and then only what is required.

7.How long we keep it

Retention follows our published data retention policy.

• Identity images are kept while the account is active and for one year after it closes — the window in which a fraud dispute can still be raised — and are then permanently deleted. If you ask for your account to be deleted sooner, the images go with it. The identification number itself is never kept: what remains, both after the year and after a deletion, is a one-way hash of it, so that the same document cannot be used to open a second account. A hash cannot be turned back into the number.
• Completed contracts are kept while any party's account is active, and stay downloadable by every party.
• Audit records — the names, roles and timestamps printed on an audit certificate, the entries in the contract event log, and the rows in the hash registry — are kept indefinitely. They are what makes a signed contract provable, and they cannot be rewritten, by you or by us.
• Contracts that end as drafts, or that are voided or declined, are purged 90 days after reaching that state.
• Abuse reports and administrative audit entries are kept as a security record.

8.Your rights

You can see and correct your own information at any time from your profile settings.

You can ask for your account to be deleted. Requests are acknowledged within 72 hours and completed within 30 days. Deletion removes your email address, phone number, postal address, identity documents, signature images and password; your name remains on contracts you signed as part of the legal record, and a one-way hash of your identification number remains for the duplicate check, both as the retention section above describes. Every session ends, your stored signatures are deactivated, and any document other people had shared with you stops being readable. A contract still waiting for your signature is declined, and the people waiting on it are told.

What a deletion cannot remove is the record of contracts other people also signed. The parties, timestamps and hashes of a completed contract — and the names already printed on audit pages that other parties hold — are retained as a legal record. The email address on those party records is replaced along with your account, so a future owner of that address inherits nothing. This is the exception we itemise in our reply to every deletion request.

To make a request, use the button in Settings, under Security, or write to the address at the foot of this page.

9.If something goes wrong

If personal data held by Agrim E Sign is exposed, we will contain the incident, establish its scope from our append-only logs, and notify the individuals affected and the relevant authority within the window Nepali law sets.

The notice will say what happened, what data was involved, what we have done about it, and what you should do.

10.Cookies and sessions

We set only the cookies the product cannot work without: one that keeps you signed in, one that remembers which workspace you are acting in, and one that remembers whether you read the site in English or Nepali. There are no advertising or analytics cookies.

11.Governing law and changes to this policy

This policy is governed by the laws of Nepal, including the Electronic Transactions Act 2063, the Privacy Act 2075 and the Data Act 2079.

If we change it, the version line at the top of this page changes with it, and account holders are told before a material change takes effect.