Privacy policy

When you create an account and use the dashboard, Kori Docs is the controller of your registration and usage data.

When a client company sends you a document to sign, that company is the controller of your data; Kori Docs acts as processor, handling the data under its instructions and this policy. Requests about that data should be addressed to the company, and we support it in answering.

From dashboard users: name, email, password (hashed), language, company data (name, CNPJ), access and usage logs, and payment data handled by the billing provider.

From signers: name, ID number, email and/or phone provided by the sender or by you, the one-time code (stored only as a hash), IP, device identification, date and time of each action, the drawn signature and, when the company requests it, selfie, photo ID and device location.

From documents: the content of the PDFs, the text extracted for search and, when the company uses AI, the analysis results.

We do not process data of people under 18 as dashboard users. Documents involving minors are the client company’s responsibility.

Perform the contracted service and prove authorship and integrity of signatures (contract performance and regular exercise of rights).

Comply with legal obligations, such as keeping evidence and tax records.

Keep the platform secure, prevent fraud and audit access (legitimate interest).

Send operational communications (invitations, codes, reminders, expiry alerts). Marketing communications only with consent, which can be withdrawn at any time.

We share data only with those who need it to deliver the service: infrastructure and storage providers, email and WhatsApp delivery, billing, and, when the client company enables them, artificial intelligence providers and integrations it chooses (Google Drive, login providers).

Public lookups (company partners registry at the Federal Revenue, Central Bank indexes) use data that is already public or the CNPJ provided by the company.

The AI provider we use does not use submitted documents to train models, by contract. Documents are sent only at the moment of the requested analysis.

Data may be transferred outside Brazil when the provider is abroad, always with appropriate contractual safeguards. We do not sell personal data.

Documents and evidence are kept while the client company keeps its account or for the retention period it defines. After the account is closed, files are deleted within 90 days; the verification code, hashes and history remain, as needed to prove the document existed.

Identity photos may have their own, shorter period set by the company. Access logs are kept for at least 6 months (Brazilian Internet Act).

Files in private storage, outside the public area of the site; encrypted traffic (HTTPS); certificates and secrets encrypted at rest; hash-chained audit trail; two-step verification, passkeys and SSO; signing links with long random tokens; code attempt limits.

No system is infallible. In the event of a security incident with relevant risk, we will notify the ANPD and affected data subjects as required by law.

You may request confirmation of processing, access, correction, anonymization, portability, information about sharing, withdrawal of consent and deletion of data, within the limits of the law. Signature evidence may be kept even after a deletion request, for the period needed for the regular exercise of rights.

Requests can be made through the contact form (subject “Privacy”) or by email at contato@koridocs.com. We reply within 15 days.

We use only necessary cookies: session, cross-site request forgery protection (CSRF), chosen language and theme preference. We do not use advertising cookies. Third-party scripts, when enabled by the platform on public pages, are disclosed in this policy.

The data protection officer can be reached at contato@koridocs.com.

This policy may be updated. The date of the last revision appears at the top of the page and material changes are communicated on the dashboard or by email.