DhiForms (“we”) stores identity documents and forms for you, and for businesses that look after their staff or clients' documents. This policy explains what we hold, how it is protected, who processes it, and your rights.
Who is responsible
- For your personal workspace, we are the controller of your data. Contact: [company name, address, email].
- In a business workspace, the business is the controller of its staff or clients' documents and we process them on its behalf. The business confirms each person's agreement before adding them.
What we hold
- Your account: email, password (hashed by our authentication provider), two-factor setup, optional mobile number.
- Documents you upload, documents you fill or sign, and the details read from them once you confirm them.
- Profiles built from confirmed details (names in English and Dhivehi, dates of birth, document numbers, addresses).
- Saved signatures, and records of signed documents (a fingerprint, signer name, time and IP address).
- An activity log of who viewed, changed or signed what, and when — kept for security and to answer your questions.
How it is protected
- Every file and every set of personal details is encrypted with its own key; those keys are themselves encrypted by a master key held in a key-management service. A copy of our database or file storage alone reveals nothing readable.
- Two-factor sign-in is required for every account, and the database itself refuses access without it.
- Deleting a document destroys its key, so backups of the encrypted file can no longer be read.
Who processes data for us
- Supabase — database, authentication and encrypted file storage (Singapore region).
- Vercel — hosting of the application.
- Automatic reading of documents, when you choose it: [DeepSeek — processes and stores data in the People's Republic of China / or the provider chosen before launch]. Only the document you ask us to read is sent. You can always type details yourself instead.
- Finding blanks on scanned forms: the blank page image only — never your profile details.
- Email reminders: Resend. SMS reminders: EchesPOS SMS gateway (Maldives). Messages say which document is expiring, never its numbers.
How long we keep it
- Your documents and profiles: until you delete them or your account.
- The activity log: [7 years] — it records actions, not document contents.
- Signing records: as long as the signed document may need to be verified, by default [10 years].
Your rights
- See and download everything we hold about you: Settings → Your data → Download my data.
- Correct any detail: edit it in your vault or profile.
- Delete documents at any time, or your whole account: Settings → Your data → Delete my account.
- Staff or clients of a business workspace can ask that business — or us at [email] — to see or remove what is held about them.
Cookies
We use only the cookies needed to keep you signed in and to remember which workspace you are working in. No advertising or tracking cookies.
Law
We follow the Maldives Electronic Transactions Act (Law 2/2022) and are preparing for the Maldives Data Protection Act now before Parliament. For people in the EU or UK, we apply the GDPR's standards.