Last updated: February 21, 2026
Account information: When you register, we collect your email address and optional display name. We use magic link authentication — we do not store passwords.
Signing data: When you sign a document, we record your name, email, IP address, user agent, timestamp, and electronic signature (typed, drawn, or uploaded image).
Documents: We store documents you create or are invited to sign, including content, signer information, and completed signed PDFs.
Usage data: We collect server logs including IP addresses, page views, and request timestamps for security and analytics purposes.
Payment information: Billing is processed by Stripe. We store your Stripe customer ID and subscription status but never your credit card details.
If you link your account to MIR (My Internet Reputation), we share your internal user ID and participation events (e.g., document signed, account created) with MIR. We do not share your email address or document contents with MIR. You can view your MIR data at myinternetreputation.org. Linking is optional and can be managed from your Account page.
We will never sell, rent, trade, or share your personally identifiable information (PII) with any third party. Your name, email address, documents, signatures, and any other personal data are yours alone.
The only exception is a lawful, legally binding request from law enforcement or a court of competent jurisdiction. In such cases, we will disclose only the minimum information required by law and will make reasonable efforts to notify you unless legally prohibited from doing so.
To operate the Service, we use the following processors strictly to perform their designated function. None of these providers receive your PII for their own purposes:
Your data is stored on secure servers with encrypted connections (TLS). Documents and PDFs are stored in DigitalOcean Spaces with access controls. Sessions are managed via Redis with HTTP-only, secure cookies. All document signatures use SHA-256 content hashing and HMAC-SHA256 cryptographic verification.
We retain your account data and documents for as long as your account is active. If you delete your account, all your data — including documents, signed PDFs, and personal information — is permanently and irreversibly deleted from our systems within 30 days. Email logs are retained for 90 days for deliverability monitoring, then purged.
Regardless of where you are located, you have the following rights regarding your personal data:
We will respond to all rights requests within 30 days. To exercise any of these rights, use the self-service options on your Account page or contact us.
For users in the European Economic Area (EEA), UK, and Switzerland, we process your data under the following legal bases:
Your data may be processed on servers located in the United States. By using the Service, you consent to this transfer. We ensure appropriate safeguards are in place for any international transfers of personal data.
In the event of a data breach that affects your personal information, we will notify affected users via email within 72 hours of becoming aware of the breach, as required by GDPR. We will also notify the relevant supervisory authority where required.
We use a single session cookie to maintain your login state. This cookie is strictly necessary for the Service to function and does not require consent under GDPR. We do not use tracking cookies, advertising cookies, or third-party analytics. No cookie banner is needed because we only use essential cookies.
The Service is not intended for users under 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect information from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.
For privacy inquiries, data protection concerns, or to exercise your rights, contact our Data Protection Officer at our contact page.
If you are in the EEA or UK and believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local data protection supervisory authority.
We may update this policy at any time. We will notify registered users of material changes via email at least 30 days before they take effect. Continued use of the Service after the effective date constitutes acceptance.
For any privacy-related questions, contact us.