Legal

Requests from public authorities for personal data

Last updated: 29 October 2026

This is Kerchiff Inc.'s policy for requests from a court, police force, regulator, government department or other public authority, in any country, for personal data Kerchiff holds: data from Meta, from Stripe, the contact data our customers keep in Kerchiff, and the data of Kerchiff's own users.

  1. Every request is reviewed for legality before anything is disclosed. Kerchiff checks that the request is in writing, comes from an authority with jurisdiction over Kerchiff Inc. or the data, and rests on a legal power that requires disclosure (a warrant, production order, court order or statute). An informal or voluntary request is refused.
  2. Requests that are unlawful, too broad or unclear are challenged. Kerchiff asks the authority to narrow or clarify it, and refuses or contests one it considers unlawful, through the courts where needed, before disclosing.
  3. Only the minimum is disclosed. Kerchiff discloses only the data the request lawfully requires, for the people and the period it names, and nothing it was not asked for.
  4. Notice. Where the law allows, Kerchiff tells the affected Customer (and, where Kerchiff is the controller, the person) before disclosing, so they can object (Terms of Service 8.2).
  5. Every request is documented. For each one Kerchiff records: the date received; the authority and the person making it; the legal basis given; what was asked for; Kerchiff's assessment and the reasons; any challenge; what was disclosed, if anything, and when; and whether notice was given or why not. Records are kept for at least six years, apart from the data disclosed itself.
  6. Who handles them. The founder, as Kerchiff Inc.'s officer, decides each request, using legal advice where the legality is in doubt. Requests are received at [email protected].