Who is responsible
TermWitness is operated by an independent individual operator based in Pakistan, trading under the TermWitness brand. Contact the operator using our contact page for privacy questions.
We determine how account, website, support and service-administration information is used. For subscriber information that a business places in a workspace, that business determines the purpose of processing and we provide the recordkeeping service on its instructions. A subscriber asking about their merchant’s records should normally contact that merchant first.
Information we handle
- Accounts and teams: name, email, authentication records, workspace name, business contact details, roles and invitations.
- Workspace records: subscriber details supplied by your business, subscriptions, offer wording and versions, agreement and cancellation events, notice content, dates, source labels and provider references.
- Imports: uploaded spreadsheet contents, original source files, column mappings and import results.
- Service and support: requests you send us, account activity, request metadata and technical logs used to operate and secure the website.
- Billing, when enabled: plan, subscription status and payment references. Payment details entered at Paddle checkout are handled by Paddle; do not upload card information into workspace records.
Supply only information needed for subscription recordkeeping. The workspace is not designed for government IDs, full card numbers, bank credentials or sensitive health records.
Why we use it
We use information to create and secure accounts, provide workspace features and exports, manage authorized team access, respond to support requests, investigate errors or misuse, administer subscriptions when enabled and comply with legal obligations.
Where data-protection law requires a legal basis, account and service administration generally relies on performing our agreement with you, security and service operation on legitimate interests where appropriate, and legal recordkeeping on legal obligations. Optional consent-based processing requires consent where applicable. The business supplying subscriber data is responsible for its own legal basis.
We do not sell workspace subscriber records, use them for advertising profiles or use them to train AI models. The current product does not send subscriber notices on your behalf.
Service providers and disclosure
Our live application uses Vercel for hosting and Neon for the production database and managed authentication. These providers process information needed to deliver their services. Account-email providers process messages when those email features are configured. Local development uses a separate SQLite store and is not the production database.
We plan to use Paddle for paid subscriptions. When you use Paddle checkout, Paddle processes transaction and payment information under its own privacy notice. Adding this policy does not activate checkout.
Authorized workspace members can access information according to their role. We may also disclose information where required by law or reasonably necessary to investigate abuse, protect rights or respond to a security incident. We do not publish your private workspace records on public product pages.
Where processing takes place
The operator is based in Pakistan and infrastructure providers may process information in other countries. Do not assume that records remain exclusively in the UK, US or Pakistan. If your business requires a data processing agreement, particular hosting locations or an international-transfer arrangement, contact us to agree the applicable terms before uploading information that requires them. This policy alone is not an executed data processing agreement or transfer safeguard.
Retention and deletion
Workspace records, original import files and history are retained to provide the recordkeeping service until an authorized deletion request is completed or a different retention arrangement is agreed. The product does not currently enforce a universal automatic retention schedule. A statutory retention period mentioned in a guide is not automatically applied to your workspace.
We retain account, support, security and transaction information only for service operation, resolving disputes and applicable legal obligations. Deletion from active systems may be followed by expiry from provider backups according to the applicable backup process; deletion is not a promise of immediate removal from every backup or legally required record.
To close an account or delete a workspace, use our contact page. Export supported records first. We may verify your identity and workspace authority before acting, and explain any information we need to retain. Cancelling billing does not automatically delete workspace data.
How we protect information
The service uses authenticated access, workspace authorization and protected production connections. Retained original spreadsheet uploads are encrypted by the application. These measures do not mean every field has separate application-level encryption, that records are tamper-proof or that the service holds an independent security certification. No system can guarantee absolute security. Protect your credentials and retain your original records separately.
Your choices and privacy rights
Depending on applicable law, you may have rights to access, correct, delete or restrict use of information, obtain a copy, object to certain processing or withdraw consent for consent-based uses. Contact us to make a request. We will assess and respond within the period required by applicable law and may need proportionate information to verify the request.
For records uploaded by a merchant, contact that merchant. We can help the authorized business respond to its subscribers. You may also complain to the relevant data-protection authority where that right applies.
Children and policy changes
TermWitness accounts are intended for adults using the service for business. We do not knowingly offer accounts to children under 18. Contact us if you believe a child has provided account information.
We will update this page when our practices change and revise the date above. Where a material change requires additional notice or consent, we will provide it.