# Privacy notice

- **Source:** https://andrii.co/en/privacy/
- **Title:** Privacy notice — Andrii Co.
- **Language:** en · also published as Markdown at /{lang}/privacy/index.md for: en, uk, fr, es, de, it, pl, ru, bg, zh, ar, ko, vi, hr, pt, hi

> How Andrii Co. handles your personal data, cookies, and your rights under the GDPR and U.S. state privacy laws.

**Last updated:** 2 July 2026

## Who we are

Andrii Co. is a Washington for-profit corporation employing one or more Notaries Public licensed in the State of Washington, USA. We provide mobile notarization and apostille services across the Greater Seattle area, with an office in Bothell, WA.

The person responsible within the meaning of the GDPR and other national data protection laws of the member states as well as other data protection regulations is:

- Andrii Co.
- 816 Evergreen Point Rd Unit 288
- Medina, WA 98039-4780
- UBI number: 604505773
- D-U-N-S® Number: 117198250
- Email: [privacy@andrii.co](mailto:privacy@andrii.co)

## Customer portal

If you create an account in our **customer portal** (hosted at `andrii.net`, separate from this marketing site), we process the personal data you enter there to schedule and deliver your services:

- **Account details** — your name, email address, and phone number.

- **Passkey credentials** — we use passkeys (WebAuthn) instead of passwords. Your device keeps the private key, and biometrics such as Face ID, Touch ID, or Windows Hello never leave your device; we store only the matching public key and a device label.

- **Appointment details** — the service you book, the date and time, and any meeting address you enter (including a customer address for mobile signings).

- **Order, document, and shipment details** — the documents you add to an order (type and apostille destination), any draft you upload, the resulting notarized or apostilled files, and the recipient name, address, phone, and email for any shipment.

We are the controller of this portal data. It is stored on our application backend at `andrii.net`, and a sign-in token is kept in your browser's `localStorage` (not a cookie) to keep you signed in. We use this data only to provide, schedule, perform, ship, and account for the services you request, and we do not sell it or share it with advertising networks.

**Retention.** We keep your account and order records for as long as your account is active and for as long as professional, tax, and legal recordkeeping requires. Entries in the notarial journal are kept for 10 years under [RCW 42.45.180](https://app.leg.wa.gov/RCW/default.aspx?cite=42.45.180), and audio-video recordings of any remote online notarization are retained for the period required by Washington's notary rules (chapter 308-30 WAC).

## Data we collect

- **Request logs.** Our hosting provider records the IP address, user agent, and timestamp for every page request. Kept for 14 days, used only for security, abuse prevention, and debugging.
- **Error reports.** When something breaks in your browser — a script fails, a file will not load — the page sends us a short technical description: the error message, the file and line, and the address of the page you were on. Web addresses are cut off before any `?` or `#`, so the identifiers and one-time links they can contain are never sent, and anything resembling an email address or a security token is masked out of the message. **Your IP address is not stored** and nothing identifies you or your session; identical reports are merged into a single counter. Kept for at most 30 days on our own server, and used only to find and fix faults. Legal basis: our legitimate interest in a working service — Art. 6(1)(f) GDPR.

- **Cookie choice.** A single JSON record in your browser's `localStorage`. Never transmitted to us. See the cookie table below.

- **Analytics (only if you opt in).** Google Analytics 4 measures aggregate visits and pages viewed. When you reject, GA receives only a cookieless modeling ping with no identifier.

- **Information you send us.** Names, document text, contact details, and any attachments — only what you choose to email to [notary@andrii.co](mailto:notary@andrii.co).

- **Payment data.** When you use the "Buy" Stripe button, card details go straight to Stripe — we never see them.

## Purposes and legal bases

Where the GDPR or a similar law applies, we process personal data only on a legal basis. In short:

| Processing | Legal basis |
| --- | --- |
| Account, booking, and order data — scheduling, performing, shipping, and invoicing the services you request. | Performance of a contract — Art. 6(1)(b) GDPR. |
| Keeping the notarial journal and the audio-video recordings of remote online notarizations. | Legal obligation — Art. 6(1)(c) GDPR; [RCW 42.45.180](https://app.leg.wa.gov/RCW/default.aspx?cite=42.45.180) and chapter 308-30 WAC. |
| Security logs, sign-in IP and device history, and fraud prevention. | Our legitimate interest in keeping the service secure — Art. 6(1)(f) GDPR. |
| Analytics cookies, and any marketing we may introduce later. | Consent — Art. 6(1)(a) GDPR; off by default and withdrawable at any time. |

## Cookies and similar technologies

Cookies are small text files placed on your device to store data that can be recalled by a web server in the domain that placed the cookie. We use cookies — and equivalent browser storage (`localStorage`) — for storing and honoring your preferences and settings and, with your permission, for analyzing how this site performs. We do not use cookies for advertising, social-media targeting, or sign-in. Our separate customer portal does have a sign-in, but it keeps its sign-in token in your browser rather than in a cookie — see the “Customer portal” section below.

This site uses only the storage listed below. Optional categories are off by default; choose them via the cookie banner on first visit, or at any time via the "Cookie settings" link in the footer of any page. Where required, we obtain your consent before placing or using optional cookies that are not (i) strictly necessary to provide the website, or (ii) for the purpose of facilitating a communication.

| Name | Provider | Purpose | Retention |
| --- | --- | --- | --- |
| `consent_v1` | Andrii Co. (this site) | Stores your cookie choice as a single JSON record in `localStorage`. | 13 months in your browser only. |
| `pap_lang` | Andrii Co. (this site) | Remembers your last selected language so we don't ask again. | Until you clear your browser data. |
| `_ga`, `_ga_RS49EHPYXJ` | Google Analytics 4 (Google LLC) | Distinguishes users and persists session state for aggregate traffic measurement. | 2 years — set only after you opt in. |
| `andrii_portal_token` | Andrii Co. (customer portal) | Keeps you signed in to the customer portal — a sign-in token in `localStorage` (not a cookie), set only when you sign in. | Until you sign out or the token expires (14 days). |
| `andrii_apple_resume:booking` | Andrii Co. (this site) | Briefly saves your in-progress booking form so it can be restored after a sign-in round-trip or a reload. Never contains your cookie choice or a sign-in token. | 15 minutes in your browser only. |

If your browser sends a Global Privacy Control (GPC) signal, we honor it as a rejection of optional cookies — we record an automatic "reject all" without asking you again.

You also have browser-level tools to control cookies and similar technologies. Most browsers let you limit which sites can set cookies, clear cookies that have already been set, or block them entirely; you can use those controls to withdraw your consent at any time. Doing so may break parts of this site that depend on the storage marked "Always on" above (language switching, payment processing).

## Third parties

- **Google Analytics 4** (Google LLC). We use Consent Mode v2: when you reject analytics, GA receives only a cookieless modeling ping without your identifier. [Google privacy policy](https://policies.google.com/privacy).

- **Stripe** (Stripe, Inc.). If you pay online via a Stripe-hosted checkout, Stripe receives your payment details directly — we never see your card. [Stripe privacy notice](https://stripe.com/privacy).

- **CDN providers** — `unpkg.com` for Phosphor Icons, `fonts.googleapis.com` and `fonts.gstatic.com` for typefaces. These providers see your IP address as a side effect of serving their files.

- **Firebase Hosting** (Google LLC). Serves this site and produces the request logs described above.

- **Google Maps Platform** (Google LLC). Address lookup and routing for bookings — when you type a meeting or delivery address, our server sends it to Google to suggest and locate addresses.

- **Google Cloud** (Google LLC). Hosts our application backend at `andrii.net` and stores its encrypted backups.

- **Google Workspace / Gmail** (Google LLC). Delivers our transactional email — verification codes, booking confirmations, receipts.

- **Infobip** (Infobip Ltd.). Sends our SMS, including verification codes, to the phone number you provide.

- **Apple** (Apple Inc.). Sign in with Apple, if you choose it, and push notifications for our iOS app.

- **MaxMind GeoLite2.** Approximate location of a visitor's IP address, resolved locally on our own server — no data is sent to MaxMind.

- **Nova Poshta** (including its Ukrainian domestic service). Receives the recipient name, phone, and address of shipments you request.

- **CDEK.** The same, for deliveries to the CIS region.

- **FedEx, DHL Express, UPS, USPS, and Canada Post.** The same, for mail and courier shipments to other destinations.

- **RON platforms** (Proof / BlueNotary). Will be named here when remote online notarization launches — the session then runs on the platform under its own terms.

- **SANS Internet Storm Center / DShield** (SANS Institute, USA). Our server exposes a decoy ("honeypot") service that no customer ever reaches: it authenticates nobody, holds no data, and exists only to observe attacks on us. The sign-in attempts made against it are submitted to the Internet Storm Center, a public attack-telemetry dataset used by security researchers — the time, the source IP address, and the username and password the attacker offered, which are often credentials stolen from someone else and replayed. ISC publishes what it receives and states that submitted data cannot be deleted, so a submission is permanent, public, and beyond our power to recall. No customer data is involved: nothing from your account, your documents, or anything you send us is ever submitted. Legal basis: our legitimate interest in network and information security (Art. 6(1)(f) GDPR). [ISC privacy policy](https://isc.sans.edu/privacy.html).

- **AbuseIPDB** (AbuseIPDB LLC, a Pennsylvania limited liability company, USA). A public IP-reputation database that network operators query before deciding whether to block an address. When an address attacks us, we may file a report against it: the address, the time, and a short description of what was attempted, written from a fixed vocabulary. Anyone who looks that address up can read the report, AbuseIPDB's terms let it republish reports, and reports do not expire — only their weight decays over time. Our reports deliberately carry no credentials, no typed input, and nothing else supplied by the reported party. AbuseIPDB operates a takedown-request procedure for a report you believe was made in error. Legal basis: our legitimate interest in network and information security (Art. 6(1)(f) GDPR). [AbuseIPDB privacy policy](https://www.abuseipdb.com/privacy).

We do not sell your personal data and do not share it with advertising networks.

## If someone ships documents to you

A customer may ask us to deliver notarized or apostilled documents to you. In that case we received your name, delivery address, phone number, and possibly email address from that customer — not from you. We use these details only to deliver that shipment: they are passed to the carrier handling it (for example FedEx, DHL Express, UPS, USPS, Canada Post, Nova Poshta, or CDEK) and are kept as part of the order record.

You have the same rights over these details as our customers — access, correction, deletion, objection — described under "Your rights" below. To exercise them, email [privacy@andrii.co](mailto:privacy@andrii.co).

## Your rights

Depending on where you live, you may have the right to:

- Access the personal data we hold about you;

- Correct or delete it;

- Object to processing based on our legitimate interests, and ask us to restrict processing while your request is checked;

- Withdraw consent at any time — use the "Cookie settings" link in the footer of any page;

- Receive a copy of your data in a portable format;

- Complain to a regulator — for example, the Washington State Attorney General, the U.S. Federal Trade Commission, or your local EU/UK data protection authority.

If you have a portal account, the two most common requests are self-service: "Download my data" on the Account page gives you a copy of your data, and "Delete my account" deletes your account.

To exercise any right, email [privacy@andrii.co](mailto:privacy@andrii.co). We aim to respond within 14 days.

## International transfers

We are based in Washington State, USA. If you contact us from outside the United States, your personal data is transferred to the US. We rely on your consent and on contractual safeguards with sub-processors (e.g., Google's Standard Contractual Clauses for Analytics and Firebase Hosting).

## Retention

- **Cookie record:** 13 months in your browser only.

- **Request logs:** 14 days.

- **Sign-in IP and device history:** 180 days.

- **API request logs:** kept in size-rotated files on our own server — when the fixed space fills, the oldest entries are overwritten.

- **Notarial journal entries:** 10 years, as required by the [Revised Code of Washington 42.45.180](https://app.leg.wa.gov/RCW/default.aspx?cite=42.45.180).

- **Email correspondence:** deleted within 18 months after the matter is closed, unless we are required to keep it longer.

## Children

This site is not directed at children under 13, and we do not knowingly collect their data.

## Changes to this notice

We update this notice when our practices change. The "Last updated" date above always reflects the current version.

## Other pages on this site (Markdown)

- [All international document services. One stop location in Washington state.](https://andrii.co/en/index.md)
- [Mobile notary and expedited apostille for Greater Seattle](https://andrii.co/en/notary/index.md)
- [Book a notary or apostille appointment](https://andrii.co/en/notary/booking/index.md)
- [Form I-9 verification, done in person and on time](https://andrii.co/en/notary/i9/index.md)
- [Washington State apostille](https://andrii.co/en/apostille/index.md)
- [Service of process, served right and proven on paper.](https://andrii.co/en/service-of-process/index.md)
- [We chase the record so you don't have to.](https://andrii.co/en/vital-records/index.md)
- [A real address that answers your mail and tells you about it.](https://andrii.co/en/registered-agent/index.md)
- [A local face in Washington](https://andrii.co/en/commercial-representation/index.md)
- [Terms of Service](https://andrii.co/en/terms/index.md)

---

Andrii Co. · notary@andrii.co · (206) 319-3543 · 11826 NE 167th St, Bothell, WA 98011

HTML version of this page: https://andrii.co/en/privacy/ · AI index: https://andrii.co/llms.txt · Full site text: https://andrii.co/llms-full.txt