Privacy Policy — QRYPTA

QRYPTA — Quantum-Safe Contract Integrity System | Faihoplo Inc.

📅 Effective Date: August 17, 2026 | Version 1.0

Faihoplo Inc. ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use QRYPTA. We comply with the General Data Protection Regulation (GDPR) and applicable US privacy laws including the ESIGN Act and UETA.

1. Information We Collect

1.1 Account Registration Data

Data Type	Purpose	Required
Full name	Account identification, contract signing	Yes
Email address	Authentication, OTP verification, account recovery	Yes
Phone number	SMS OTP authentication (future)	Yes
Date of birth	Client key recovery (3-factor auth) only	Yes
Country & address	Legal jurisdiction, compliance	Yes
Password (hashed)	Account authentication	Yes

1.2 Contract & Signing Data

Data Type	Purpose	Stored
IP address	Legal audit trail per party	In signed PDF + S3
Device type & browser	Legal audit trail per party	In signed PDF + S3
Signing timestamp	Legal record of when signed	In signed PDF + S3
Contract PDF	Vault storage	AWS S3 Object Lock
SHA-256 hash	Contract integrity verification	In signed PDF + S3

1.3 Usage & Access Logs

We record vault access events (STORE, VIEW, DOWNLOAD) in AWS S3 faihoplo-vault-logs bucket. Each log includes: event type, contract ID, user email, user ID, IP address, device type, and timestamp. These logs are required by GDPR and US regulations for data access accountability.

2. How We Use Your Information

Service delivery: Providing contract signing, vault storage, and verification services
Authentication: Email OTP verification, password authentication, client key recovery
Legal compliance: Maintaining audit trails as required by ESIGN Act, UETA, and eIDAS
Security: Detecting and preventing unauthorized access or fraudulent use
Service improvement: Analyzing usage patterns to improve the QRYPTA system
Communication: Sending verification OTPs and important service notifications

We do NOT use your personal information for advertising, marketing to third parties, or selling to data brokers.

3. How We Store Your Information

3.1 Account Data

Account information is stored on our secure AWS EC2 server (Ubuntu 24.04) located in the US East (N. Virginia) region. Passwords are hashed using bcrypt — plaintext passwords are never stored.

3.2 Contract Data

Executed contracts are stored in AWS S3 with Object Lock Compliance Mode. Contract data is encrypted using AES-256-CBC. Once stored with Object Lock, contracts cannot be deleted or modified by anyone — including Faihoplo Inc. — until the retention period expires.

3.3 Access Logs

Vault access event logs are stored in AWS S3 faihoplo-vault-logs bucket with versioning enabled. These logs satisfy GDPR Article 30 records of processing activities.

We share your information only in the following limited circumstances:

Amazon Web Services: For cloud infrastructure, S3 storage, and computing services. AWS processes data as a data processor under our instructions.
Amazon Web Services SES (Simple Email Service): For email OTP delivery and client key notifications. Only your email address and OTP code are shared. AWS SES is part of our secure AWS infrastructure.
PayPal: For payment processing. PayPal processes payment information independently under their privacy policy.
Legal requirements: We may disclose information if required by law, court order, or government authority.

    ⚠️ We never sell, rent, or trade your personal information to any third party for commercial purposes.
  

5. Audit Trail & Access Logging

QRYPTA records the following information in the legal audit trail embedded in signed contract PDFs:

Signer's full name and email address
IP address at time of signing
Physical device type, operating system, and browser
PQC algorithm used
Authentication method (Email OTP)
Action performed and UTC timestamp
Signature verification status

This information is embedded permanently in the signed PDF and stored in AWS S3. It constitutes the legal audit trail required by ESIGN Act, UETA, and eIDAS. By signing a contract through QRYPTA, you consent to this information being permanently recorded in the contract PDF.

6. Date of Birth — Special Notice

Your date of birth is collected exclusively for client key recovery through three-factor authentication (email + password + date of birth). It is:

Never displayed publicly or shared with other parties
Never included in contract audit trails or signed PDFs
Never used for age verification, marketing, or profiling
Stored securely on our server and never transmitted in plaintext

Your date of birth is a private security factor — treat it like a password. Do not share it with anyone claiming to be from Faihoplo Inc. We will never ask for your date of birth via email or phone.

7. Data Retention

Data Type	Retention Period
Account data (name, email, etc.)	Duration of account + 3 years after deletion
Password hash	Duration of account only
Date of birth	Duration of account only
Contract PDFs in vault	Selected retention period (3-30 years) — Object Lock
Vault access logs	5 years minimum (US regulatory requirement)
Payment records	7 years (financial record requirement)
OTP codes	10 minutes (automatically deleted)

8. Your Privacy Rights

✅ Right to Access Request a copy of your personal data we hold

✅ Right to Rectification Correct inaccurate personal data

✅ Right to Erasure Delete your account and personal data (subject to legal retention obligations)

✅ Right to Portability Receive your data in a machine-readable format

✅ Right to Object Object to processing of your personal data

✅ Right to Restriction Request restriction of processing of your personal data

To exercise any of these rights, contact us at htkim@faihoplo.com. We will respond within 30 days.

    ⚠️ Note: Contracts stored with AWS S3 Object Lock cannot be deleted even upon request, as this is a fundamental guarantee of the QRYPTA service. Your account data can be deleted, but Object Lock protected contracts remain for their retention period.
  

9. Security Measures

Faihoplo Inc. implements the following security measures to protect your data:

Post-Quantum Cryptography: ML-DSA-65 (FIPS 204), ML-KEM-768 (FIPS 203), AES-256-CBC
Password Hashing: bcrypt with salt rounds
JWT Authentication: Secure session tokens with expiry
HTTPS: All data transmitted over encrypted connections
AWS S3 Server-Side Encryption: AES-256 at rest
Email OTP: Time-limited one-time passwords for verification
Three-Factor Key Recovery: Email + password + date of birth
IP & Device Logging: All access events recorded

10. Cookies & Local Storage

QRYPTA uses browser localStorage (not cookies) to store:

Authentication JWT token (session only)
User email and display name (session only)
Current plan information

No tracking cookies, advertising cookies, or third-party analytics are used. Local storage data is cleared upon logout.

11. Children's Privacy

QRYPTA is not intended for use by persons under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately and we will delete such information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The effective date at the top of this page indicates when the policy was last updated. Continued use of QRYPTA after changes constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related questions, requests, or complaints:

Company: Faihoplo Inc.
Privacy Officer: CEO, Faihoplo Inc.
Email: htkim@faihoplo.com
Website: faihoplo.com

For GDPR related complaints in the EU, you have the right to lodge a complaint with your local data protection authority.

By using QRYPTA, you acknowledge that you have read and understood this Privacy Policy.
Faihoplo Inc. — Faith + Hope + Love + Happiness