Data Processing Addendum
Last updated 22 July 2026
This addendum applies when you use BA | Signet to verify control of an address in the course of your work, where the address and related data are personal data of a counterparty — making you the controller and us your processor.
It should be read with our Privacy Policy and the Subprocessors list, and reviewed by your legal team before you rely on it.
Scope and roles
You are the data controller for the verifications you initiate. Aletheia Tech Ltd is the processor. We process only on your instructions, which for this service means: create the request, verify a submitted signature against the address, issue the certificate, anchor its hash if you asked, and delete on your instruction or valid request.
A processor that never holds key material
The service is architected so that we never receive a private key or seed phrase. The personal data we process on your behalf is limited to an address, a challenge, a signature, a timestamp and your reference. This materially limits the categories of processing we can perform and the exposure of that data.
Security, subprocessors, deletion
Data is encrypted in transit and at rest. We engage the subprocessors listed on the Subprocessors page and will give notice of changes.
On your instruction we delete records from our systems. We cannot delete a published on-chain hash; it contains no readable personal data.