Last updated 1 August 2026.
This Privacy Policy explains how Vaitly Limited (trading as Bleinks) ("we", "us", "our") processes personal data when you use bleinks.com, app.bleinks.com, and related services (the "Service").
Vaitly Limited is a private limited company registered in England and Wales under company number 16814185. Registered office: Mill House Penrhos Farm, Nantgarw, Cardiff, Wales, CF15 7UN. Bleinks is a trading name of Vaitly Limited.
For UK GDPR purposes, Vaitly Limited is the data controller for account, billing, support, and product-operations data. Where you upload documents and invite signers, you (or your organisation) are typically the controller of the content of those documents and of signer contact details you provide; we act as your processor for that document-signing data, except where we must process signing metadata to operate the Service securely and produce an audit certificate.
Information Officer
Our Information Officer is Nasir Shiraz. Privacy and data protection enquiries: info@vaitly.com.
ICO registration number ZC211167.
What we collect
- Account data: email address, display name, authentication identifiers, and password material held by our authentication provider (Firebase — we do not store cleartext passwords), plus Stripe customer / subscription identifiers when you pay.
- Document data: PDFs you upload, field placements, and values recipients submit (signature PNGs, typed text, dates, checkboxes).
- Signing metadata: IP address, user-agent, and timestamps when a signer views or signs. This supports the audit certificate that evidences the signing event.
- Usage and security logs: aggregate product metrics, rate-limit and abuse signals, and operational logs. We do not put document contents into marketing analytics.
- Support communications: emails or messages you send to us.
Why we process it (lawful bases)
- Contract (UK GDPR Art. 6(1)(b)): to create your account, deliver e-signature features, send signing emails, and provide customer support.
- Legal obligation (Art. 6(1)(c)): where we must retain records for tax, accounting, or to respond to lawful requests.
- Legitimate interests (Art. 6(1)(f)): securing the Service, preventing fraud/abuse, improving reliability, and defending legal claims — balanced against your rights.
- Consent (Art. 6(1)(a)): only where we expressly ask (for example optional marketing). You may withdraw consent at any time.
Who we share data with
We use carefully selected processors under written terms. We do not sell personal data and we do not share it with third parties for their own marketing.
- Google Firebase — authentication.
- Stripe — payment processing (when billing is active).
- Transactional email providers (e.g. Brevo / IONOS SMTP) — signing and account emails.
- Hetzner — application hosting and primary storage in the EU/UK region we operate.
- Wasabi — encrypted off-site backups with object lock where configured.
International transfers
Primary application infrastructure is operated in Europe. Some processors (notably Google and Stripe) may process data in the United States or other countries. Where required, we rely on appropriate safeguards such as the UK International Data Transfer Agreement / Addendum or EU Standard Contractual Clauses.
Retention
Completed documents default to retention for 90 days after completion (configurable for business customers where offered). You may delete documents earlier from the product. Account closure deletes or anonymises personal data we no longer need, except where retention is required for legal, security, or dispute purposes (for example limited audit summaries or billing records).
Your rights
Under the UK GDPR you may have the right to:
- access your data (export from Settings);
- rectify inaccurate data;
- erase data (delete account), subject to legal retention;
- restrict or object to certain processing;
- data portability where applicable;
- complain to the Information Commissioner's Office.
To exercise rights, email info@vaitly.com or contact the Information Officer named above. We may need to verify your identity.
Children
The Service is aimed at businesses and adults. It is not directed at children under 18. We do not knowingly create accounts for children.
Automated decision-making
We do not use automated decision-making that produces legal or similarly significant effects about you without human involvement.
Security
We use TLS in transit, encryption at rest for stored objects, access controls, malware scanning on uploads, and append-only audit logging for legally relevant events. No method of transmission or storage is perfectly secure; see our Security page for more detail.
Cookies and similar technologies
See our Cookie Policy.
Changes
We may update this policy from time to time. Material changes will be posted on this page with an updated date. Continued use of the Service after changes take effect constitutes acceptance of the updated policy where permitted by law.
Contact
Vaitly Limited (t/a Bleinks)
Company number 16814185
Mill House Penrhos Farm, Nantgarw, Cardiff, Wales, CF15 7UN
Information Officer: Nasir Shiraz
Privacy: info@vaitly.com
Support: hello@bleinks.com