Privacy Policy

Who we are

Pertavo is operated by HasTech IT Limited, House 15, Block C, Banasree Main Road, Dhaka 1219, Bangladesh. We are the controller of the personal information described in this policy, except where we say otherwise in The portal.

Two different services

This policy covers two things that behave very differently, and it is worth separating them before anything else.

• The website — the pages you are reading now. It collects almost nothing.
• The portal — the application your firm and its clients sign in to. It holds real client documents, and most of this policy is about it.

The website

This website sets no cookies. It runs no tag manager and no advertising or retargeting script, and it does not follow you to any other site. Its fonts are served from this same site rather than fetched from anyone else, so loading a page here does not tell a third party that you did. Two scripts come from elsewhere: the visitor count described next, and the spam check on the contact page, which loads on that page only.

We count visits, using Cloudflare Web Analytics. It tells us how many people opened a page, which pages, and which site or link they arrived from. It sets no cookie, stores nothing in your browser, and assigns you no identifier, so it cannot tell us that the same person came back, and it cannot be joined up with anything you do anywhere else. We use it to learn which of the things we write are worth reading, and that is the whole of it.

One thing is stored in your browser: a theme value recording whether you chose light or dark. It stays on your device, is never sent to us, and clearing your browser data removes it.

Our hosting provider records ordinary server logs, including IP addresses, as part of serving and protecting the site. We do not use those logs to build a profile of you.

If you use the contact form, what you type in it — your name, your email address, your message, and your firm if you give it — is emailed to us so that we can reply. We use it to answer you. We do not add you to a mailing list from it, and the form is not stored in a database on this site.

The form is protected by Cloudflare Turnstile, a spam check that runs in your browser and tells our server whether the submission looks automated. To do that Cloudflare receives your IP address and some technical detail about your browser. It is used to decide whether you are a person, not to advertise to you, and it sets no tracking cookie.

The portal

When a firm uses Pertavo, that firm decides what client information goes into it and why. In data-protection terms the firm is the controller of its clients' documents and we are its processor: we hold and protect the material, and we act on the firm's instructions rather than our own.

If you are a client of a firm and want a document removed or corrected, your firm is the right first stop — they can act immediately, and they know the matter. We will help them, and we will act ourselves if they cannot.

The portal holds:

• Your account — name, email address, the role you hold in a firm, and a phone number and profile picture if you add them. Passwords are stored only as a hash; we cannot read yours.
• Sign-in security — the time you last signed in, and, only if you turn two-factor authentication on, the secret your authenticator app is paired with and your unused backup codes.
• What you put in — documents and their file names, the folders you arrange them into, who each is assigned to, messages exchanged between your firm and its clients, and the notifications those generate.
• Invitations — the name and email address of a person a firm invites, and a single-use token that expires within a day.

Signature records

Signing is the one place we deliberately record more than the minimum, and you should know exactly what.

When you sign a document, we store your signature, the account that signed, the time it happened, and the IP address and browser your device reported at that moment. That record is what makes the signature evidence rather than a picture: it is how a signed document can later be shown to have been signed by a particular person at a particular time.

Because it is evidence, it is kept with the signed document and is not deleted on request while that document exists.

Why we hold it

• To provide the service your firm is paying for — the whole of the portal.
• To keep accounts secure — sign-in, two-factor, session expiry, invitation expiry.
• To make signatures verifiable — the record described above.
• To answer you when you contact us.
• To bill for the service, where a firm is on a paid plan.

We do not sell personal information, we do not share it for advertising, and we do not use the contents of your documents to train machine-learning models.

Who else touches it

We use a small number of service providers to run Pertavo. They may handle your information only to do the job we have given them:

• Cloud hosting and file storage — running the service and storing uploaded documents.
• Email delivery — sending invitations, notifications and password resets.
• Cloudflare — serving this website, and running the spam check on the contact form.
• Payment processing — where a firm is on a paid plan. We do not store card numbers.

Converting and rendering documents happens on our own infrastructure, so the contents of a file are not sent to a third-party conversion service to be displayed or signed.

We will also disclose information where the law requires it of us. If we are served with a demand for a firm's documents and we are permitted to tell that firm, we will.

How long we keep it

• Documents — until the firm deletes them. Deleting a document removes the stored file as well as the record of it.
• Accounts — for as long as the account exists. There is no self-service delete: removing an account is done by us on request, so ask and we will do it.
• Invitations — unused ones expire within a day and are cleared automatically after that.
• Signature records — for as long as the signed document exists, as described above.

How it is protected

Traffic is encrypted in transit. A document is never served from a public address: every request for a file is checked against who is asking and which firm they belong to. Requests are narrowed to your own firm before they reach the database, so another firm's material is not merely hidden from you but never fetched. Sessions expire within the hour and renew quietly. Two-factor authentication is available and we would encourage turning it on.

We do not hold a SOC 2 report, an ISO 27001 certificate, or a GDPR or CCPA attestation, and we would rather tell you that here than let you assume otherwise. What we do is described above and on our security page, in enough detail to be checked.

Your rights

You can ask us to:

• tell you what personal information we hold about you;
• give you a copy of it;
• correct it where it is wrong;
• delete it, subject to the signature records described above and to anything we must keep by law;
• stop sending you email that is not necessary to run the service.

Write to us and we will answer. If the information belongs to a firm's client file, we will usually need to work through the firm, and we will tell you that rather than go quiet.

California residents

If you live in California, the California Consumer Privacy Act gives you the rights above and the right not to be treated differently for using them. We do not sell or share personal information as those terms are defined in the Act, and we have not done so in the past twelve months.

Children

Pertavo is a tool for firms and their clients, and is not intended for anyone under 16. We do not knowingly collect information from children. If you believe a child's information has reached us, tell us and we will remove it.

Changes

If we change this policy we will change the date at the top of this page. Where a change materially affects what we do with information already collected, we will tell the firms using Pertavo directly rather than rely on you noticing the date.

Contacting us

Privacy questions and requests go to [email protected], or by post to HasTech IT Limited, House 15, Block C, Banasree Main Road, Dhaka 1219, Bangladesh.