Privacy

When you open an account with us, we decide what to store about you and we are the controller of that data.

When you upload a document and address it to someone, you decide whose contract it is, who signs it and what it says. For that document and everyone named on it we are a processor acting on your instructions. If you are a signer and you want a document changed or removed, ask the person who sent it to you. We will not act on a document without the sender, because we cannot tell from the outside whose agreement it is.

• Your email address. That is the whole account. There is no password, no name field and no profile, because a sign-in link to a mailbox is the only credential we use.
• When the account was created and when it was last used.
• Your workspace, its members and their roles, if you invite anyone.
• A Stripe customer identifier and your current plan, once you subscribe. Card numbers never reach our servers. Stripe holds them.
• How many documents you have sent this month, so an allowance can be enforced.

• The PDF you upload, and the sealed PDF produced once everyone has signed.
• Its filename, page count, page sizes, byte size and SHA-256 hash.
• The title and the message you write to recipients.
• Each recipient’s name and email address, and their place in the signing order.
• Each signature or set of initials, as an image, together with whether it was drawn, typed or uploaded. Text, date and checkbox values are stored as you or your signer entered them.
• An audit trail: who opened the link and when, when the emailed code was confirmed, when each field was filled, and the IP address and browser user agent recorded at those moments.

The IP address and the user agent are the point of the product rather than incidental telemetry. They are the evidence that makes a signature worth something later, they are printed on the Certificate of Completion, and they are hash-chained so that neither we nor anyone else can quietly change them afterwards. Sending a document means putting them in the record.

Three cookies, all first-party, all strictly necessary. None of them profiles you and none is shared with anyone.

• signhere_signer keeps a signer authenticated after they confirm their emailed code. It lasts 2 hours.
• signhere_sender keeps a sender signed in for 30 days.
• signhere_drafts holds a draft you started before signing in, so dropping a PDF on the homepage does not require an account first. It lasts 7 days.

Any cookie beyond these three belongs to the measurement described below, and none of those is set unless you accept them.

We advertise, so we need to know which adverts bring people who find the product useful. Nothing in this section runs until you choose to accept it, and rejecting it changes nothing about how the product works for you.

• Product analytics, to count visits and see which pages lead to a first document.
• Google, Meta and LinkedIn advertising tags, so a subscription can be matched back to the advert that led to it. These set their own cookies and pass a page view and a small number of events to those companies.

We never send them your document, its contents, its filename, your recipients or anything from an audit trail. The event they receive says that a signup or a subscription happened, and nothing about what was signed.

Three companies, each doing one job. We add no vendor without adding it here.

• Cloudflare, Inc. Hosting, object storage for uploaded PDFs, and the database behind every account. Processing takes place in the United States and its global network.
• Resend (Plus Five Five, Inc.). Delivers sign-in links, signing invitations and one-time codes. Processing takes place in the United States.
• Stripe, Inc. Takes payment and holds the subscription. Card details never reach our servers. Processing takes place in the United States and Ireland.

Transfers outside the European Economic Area rest on the European Commission’s standard contractual clauses, which each of these companies has signed.

• A draft you start without an account is swept after 7 days.
• A sign-in link stops working after 15 minutes. A signing link lasts 14 days. An emailed code lasts 10 minutes. We store only a SHA-256 hash of a link, never the link itself, so a copy of our database yields no working links.
• A sent document, its audit trail, its seal and its certificate are kept for as long as the account exists. That is deliberate: the evidence is the product, and a signature you cannot prove anything about a year later is not worth much.

To have an account and everything in it erased, write to contact@signhe.re. We act within 30 days. Where you are a signer rather than the sender, we pass the request to the sender, because the document is theirs.

Under the General Data Protection Regulation you may ask for a copy of your data, ask for it to be corrected or erased, object to how it is used, or ask us to restrict it. Write to contact@signhe.re. You may also complain to the data protection authority where you live.

We do not sell personal data, we do not share it with data brokers, and we do not use your documents to train anything.

• Documents and signature images are encrypted at rest in object storage.
• Sign-in links, signing links and session cookies are all signed or hashed. None is stored in a form that could be replayed from a database dump.
• Every audit event carries the hash of the event before it, so a change to the record breaks the chain at a specific line number and the verify page reports which one.