Privacy

When you open an account with us, we decide what to store about you and we are the controller of that data.

When you upload a document and address it to someone, you decide whose contract it is, who signs it and what it says. For that document and everyone named on it we are a processor acting on your instructions. If you are a signer and you want a document changed or removed, ask the person who sent it to you. We will not act on a document without the sender, because we cannot tell from the outside whose agreement it is.

• Your email address. That is the whole account. There is no password, no name field and no profile, because a sign-in link to a mailbox is the only credential we use.
• When the account was created and when it was last used.
• Your workspace, its members and their roles, if you invite anyone.
• A Stripe customer identifier and your current plan, once you subscribe. Card numbers never reach our servers. Stripe holds them.
• How many documents you have sent this month, so an allowance can be enforced.
• Whether we have sent you the one feedback email. About a day after you create an account, we send a single email asking what you wanted to sign and whether anything got in your way. We send it once, and a reply is up to you.

• The PDF you upload, and the sealed PDF produced once everyone has signed.
• Its filename, page count, page sizes, byte size and SHA-256 hash.
• The title and the message you write to recipients.
• Each recipient’s name and email address, and their place in the signing order.
• Each signature or set of initials, as an image, together with whether it was drawn, typed or uploaded. Text, date and checkbox values are stored as you or your signer entered them.
• An audit trail: who opened the link and when, when the emailed code was confirmed, when each field was filled, and the IP address and browser user agent recorded at those moments.

The IP address and the user agent are the point of the product rather than incidental telemetry. They are the evidence that makes a signature worth something later, they are printed on the Certificate of Completion, and they are hash-chained so that neither we nor anyone else can quietly change them afterwards. Sending a document means putting them in the record.

Three cookies, all first-party, all strictly necessary. None of them profiles you and none is shared with anyone.

• signhere_signer keeps a signer authenticated after they confirm their emailed code. It lasts 2 hours.
• signhere_sender keeps a sender signed in for 30 days.
• signhere_drafts holds a draft you started before signing in, so dropping a PDF on the homepage does not require an account first. It lasts 7 days.

Any cookie beyond these three belongs to the measurement described below, and none of those is set unless you accept them.

We advertise, so we need to know which adverts bring people who find the product useful, and where people get stuck on the way to their first document.

Our own measurement runs for everyone and sets no cookie. For each request and each step in the product (a page viewed, a button clicked, a PDF picked, a message shown) we keep the page, the time, the country and city our network reports, the kind of device and browser, the site or advert that sent you, and a visitor number. The visitor number is a keyed hash of your address and browser that changes every day, so it cannot follow you from one day to the next, and your address itself is not stored. We keep no document, filename, recipient, typed text or email address in it, and signing links are removed before anything is written. It stays on our own infrastructure and is shared with no one. Requests are deleted after 90 days and steps after 400 days.

Everything below runs only if you accept it, and rejecting it changes nothing about how the product works for you.

• Google Ads conversion tracking, Google Analytics, so a signup or a subscription can be matched back to the advert that led to it. These set their own cookies and pass a page view, three events (a signup, a checkout that started, and a subscription that was paid) and two editor steps: a PDF picked and an upload that failed.

We never send them your document, its contents, its filename, your recipients or anything from an audit trail. The event they receive says that a step happened, with the file type and size at most, and nothing about what was signed.

Three companies, each doing one job. We add no vendor without adding it here.

• Cloudflare, Inc. Hosting, object storage for uploaded PDFs, and the database behind every account. Processing takes place in the United States and its global network.
• Resend (Plus Five Five, Inc.). Delivers sign-in links, signing invitations and one-time codes. Processing takes place in the United States.
• Stripe, Inc. Takes payment and holds the subscription. Card details never reach our servers. Processing takes place in the United States and Ireland.

Transfers outside the European Economic Area rest on the European Commission’s standard contractual clauses, which each of these companies has signed.

• A draft you start without an account is swept after 7 days.
• A sign-in link stops working after 15 minutes. A signing link lasts 14 days. An emailed code lasts 10 minutes. We store only a SHA-256 hash of a link, never the link itself, so a copy of our database yields no working links.
• A sent document, its audit trail, its seal and its certificate are kept for as long as the account exists. That is deliberate: the evidence is the product, and a signature you cannot prove anything about a year later is not worth much.
• A template is kept until you delete it. It holds the PDF you saved it from, the field layout and the role names. It holds no signer: a role is a label such as “Tenant”, never a person, so a template carries no name and no address of anybody you have sent to.

To have an account and everything in it erased, write to contact@signhe.re. We act within 30 days. Where you are a signer rather than the sender, we pass the request to the sender, because the document is theirs.

Under the General Data Protection Regulation you may ask for a copy of your data, ask for it to be corrected or erased, object to how it is used, or ask us to restrict it. Write to contact@signhe.re. You may also complain to the data protection authority where you live.

We do not sell personal data, we do not share it with data brokers, and we do not use your documents to train anything.

• Documents and signature images are encrypted at rest in object storage.
• Sign-in links, signing links and session cookies are all signed or hashed. None is stored in a form that could be replayed from a database dump.
• Every audit event carries the hash of the event before it, so a change to the record breaks the chain at a specific line number and the verify page reports which one.