Privacy policy
What we store
- Account holders: email address, role, and your organization's plan and Stripe customer and subscription identifiers. We do not store card numbers.
- Documents you upload (the PDF file is kept on our server's disk), their titles, and the signers, fields, and values you add. A drawn signature is stored as a small image.
- For each signer: name, email address, the times they viewed, agreed to the electronic signature disclosure, signed, or declined, any note they leave when declining, and the IP address and browser user agent used. This is the audit trail shown on the certificate page.
- Sign-in links, signing links, and download links are random secrets. We store only a hash of each, never the link itself.
- While a rate limit is being applied, visitor IP addresses are held in the application's memory. Our application logs record the request method and path without signing or download tokens.
Email we send
We email sign-in links, signing requests, up to two automatic reminders per signer (and reminders that the sender triggers), completion notices to the sender, and a link for each signer to download the signed copy. A signing request names the sender's email address and the document title. Reminders replace earlier signing links.
Cookies
Signed-in account holders get one session cookie, which keeps you signed in and protects forms from forgery. It is marked HttpOnly and SameSite=Lax, is Secure on HTTPS, and expires after 14 days without activity. People who only sign a document do not need an account and are not given this cookie. We use no advertising or analytics cookies. Stripe's own pages may set their own cookies.
Who processes data for us
- Resend delivers our email, so it receives recipient addresses, names, and message content.
- Stripe processes payments and subscriptions and receives billing details you enter on its pages. We pass it your email address and our internal account identifier.
- Our hosting provider runs the servers that store the database and uploaded files.
We do not sell personal data and do not share it for advertising.
Retention, export, and deletion
Documents, signer records, and audit records are kept while your account exists. Expired sign-in link records are deleted when new sign-in links are requested, and sessions end after 14 days without activity. Signing links expire 30 days after they are issued, and download links expire 30 days after the document is sealed.
From the Account page you can download a JSON export of your account, documents, signers, and activity (uploaded PDFs are not included). Deleting your account there permanently removes its documents, signers, fields, activity records, and stored PDFs, deletes the sign-in records for your email address, and cancels any subscription. Stripe keeps its own payment records under its policies, and deleted data can remain in backups until those backups are replaced.
Signers
If you received a document to sign, the organization that sent it controls the document and its copy. Contact them about their copy. Contact us about the audit-trail data described above.