Privacy Policy

This policy applies to miniterms.com: the public site, the free document generators, and the signed-in Miniterms dashboard. Earlier versions of this policy described a waitlist-only site; the product has since launched, and this version covers both the site and the product.

• Account data. You sign in through Dekimu ID; we receive your account email address, display name, and user ID.
• Document data. The business details you enter to generate documents in the dashboard, and the drafts you save.
• Signature data. If you send a document for countersignature, we collect the signer’s name, email address, IP address, and the time of signature.
• Waitlist data. The email address you submitted, if you joined the pre-launch waitlist.

The free public generators are stateless: the details you enter are processed to render your document and are not stored. We don’t run analytics, don’t drop tracking cookies, and don’t fingerprint your device. Server logs hold standard request metadata (IP, user-agent, timestamp) for up to 30 days for abuse prevention only.

• Provide the product: generate your documents, keep your saved drafts, and issue the cryptographic receipts described in section 10
• Keep you signed in (the cookie described in section 11)
• Send you transactional email: confirmations, annual document-review reminders, and countersignature requests and confirmations
• Onboarding emails during the ten days after your first visit to the dashboard once your account has access (setup steps and how to publish), on the basis of our legitimate interest in helping you get started with the service. You can turn them off at any time in dashboard settings.
• Detect spam and rate-limit abusive use
• Waitlist only: a one-time signup confirmation and a single launch email when the product became available

We won’t add you to a marketing list, sell your email, or use your data for anything other than the above.

The infrastructure that makes Miniterms work. As a B2B service, we offer a Data Processing Agreement (DPA) to customers who need one for GDPR compliance. Download our DPA ↗. Payments are processed by Stripe via Dekimu ID; Miniterms itself never receives your payment card data.

Under the GDPR (Regulation (EU) 2016/679) and Spanish Organic Law 3/2018 (LOPDGDD), you may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing, and portability over your personal data. Equivalent rights apply under the UK GDPR and the CCPA where those laws apply to you. To exercise any of these, email legal@dekimu.com from the address you signed up with. We respond within 30 days.

• Saved documents, drafts, your business profile and your subprocessor register are kept while your subscription is active, and for 12 months after it lapses, so that you can resubscribe without losing anything. You can delete any of them yourself at any time. If you have not resubscribed by the end of those 12 months, we delete them. We email you when your account becomes dormant and again 60, 30 and 7 days before the deletion date, and the date is shown in your dashboard.
• Data subject requests you receive through Miniterms contain other people’s personal data, and we hold them for you, on your instructions. We keep them on the same schedule as your documents: while your subscription is active, and for 12 months after it lapses, then we delete them. Your export includes the full log, and we recommend taking it before that date — your own duty to keep a record of how you answered a request can last longer than your subscription, and only you can decide how long that is. While your account is dormant your public intake form stops accepting new submissions; anyone who tries is shown a neutral message asking them to contact you directly, and we are never told, and never store, what they wanted to ask.
• Signature records (the signed document and the signer’s name, email address and IP address) are kept while your account exists, for up to 6 years from signature — the period for which Article 30 of the Spanish Código de Comercio requires you, as a business, to keep commercial documents. We hold them for you, on your instructions; they are included in your export and are deleted when your account is deleted. Anchored receipts are covered in section 10.
• Waitlist emails are kept until you unsubscribe, and in any case no later than 20 December 2026.
• Server logs are kept for a maximum of 30 days.
• After we delete an account, we keep a small record of the relationship itself — that the account existed, when it lapsed, when it was deleted, our processing log, and the dates and status of the requests that passed through, without anyone’s name or the content of any request. It is kept blocked, which means it is not used or displayed for any purpose and is available only to a court, the public prosecutor or a competent authority, for three years. Then it is destroyed too.

If we change anything material, we’ll bump the version above and post a one-line summary at the top of this page. Substantive changes will also be emailed to account holders and to anyone on the waitlist at the time.

The data controller is the company identified below (LSSI-CE art. 10). Privacy questions, deletion requests, anything legal — legal@dekimu.com.

Dekimu Labs, S.L. · CIF B55431357 — identificación completa en el Aviso Legal.

This policy is governed by the laws of Spain. You may lodge a complaint with the Agencia Española de Protección de Datos (AEPD) or the supervisory authority of your habitual residence.

If you use features that issue anchored receipts (APR, ACR, or any other Anchored Receipts protocol-family member), we process salted cryptographic commitments derived from identifiers and event metadata. Commitments are designed to be resistant to direct re-identification but remain personal data under GDPR Article 4. We process them on the legal basis of legitimate interest (Article 6(1)(f)) in providing tamper-evident audit trails, with no fixed end date, as described below. Anchored daily roots are non-retroactive by design: an erasure request received after a receipt has been anchored is honoured by ceasing to serve the receipt body, but the historical signature record cannot be withdrawn from the anchored root. This is disclosed before any receipt is minted.

Miniterms sets a single strictly-necessary authentication cookie (miniterms_access) after you sign in. This cookie is used solely to maintain your authenticated session and is deleted when you sign out or it expires. We do not set analytics, advertising, or tracking cookies of any kind, and we do not use any third-party trackers. We run no analytics scripts, trackers, pixels or beacons in your browser — nothing in your browser reports on you; the only usage figures we keep are server-side daily counts of events (for example, documents generated per day) that contain no identifier and cannot be linked to you, and our hosting provider keeps standard request logs (IP address, timestamp, requested URL) for security and operation of the service; we also hold your IP address for up to 60 seconds to rate-limit requests and do not keep it. If a page fails to render, your browser sends us the error message (technical text, capped in length), an error reference and the page path so we can fix it; no identifier, cookie or account detail is added. We process crash reports on the basis of our legitimate interest in operating and securing the service (Art. 6(1)(f) GDPR, Recital 49); as no identifier is included, the impact on you is minimal.

A theme preference may be stored in your browser’s localStorage to remember your light/dark mode choice. This value never leaves your device and is not personal data.