Privacy Policy

1. Who is responsible for your data

Our role depends on the data:

• We are the controller for account data — the details of the people who sign up, log in, pay, and use the application, plus our website and marketing data.
• We are a processor for Customer Data — the documents, signer details, customer records, and invoices that a Workspace uploads or creates. The Workspace is the controller and decides what to collect, who to send it to, and how long to keep it. Our commitments in that role are in the Data Processing Addendum.

If you signed a document through AnySign and want your data corrected or removed, contact the organisation that sent it to you. We will forward requests we receive directly and support that organisation in responding.

2. What we collect

• Account data — name, work email, password (stored only as an Argon2id hash, never in plain text), Workspace name and role, and preferences such as language.
• Billing data — plan, subscription state, billing contact, and invoice history. Card numbers are handled by our payment processor and never reach our systems.
• Customer Data — documents you upload, the customers and invoices you create, and the signer names, email addresses, and phone numbers you enter.
• Signature evidence — for each Signer: timestamps for viewing, consent, and completion; IP address; browser user agent; the authentication steps passed (access code, SMS one-time passcode); and the drawn or typed signature image. This is the record that makes a signature defensible, so it is collected by design and retained with the document.
• Technical and usage data — API request metadata, error and performance telemetry, and application logs, used to run and secure the Service.
• Support data — the content of messages you send us.

3. Why we use it, and our legal basis

We do not sell personal data, do not share it for cross-context behavioural advertising, and do not use it to train machine learning models.

4. Cookies

We use strictly necessary cookies: a session cookie that keeps you logged in, a signing session cookie that keeps a Signer's session on the signing page, and a CSRF protection token. They carry no advertising identifier and are not shared with third parties.

We also use Google Analytics on our marketing pages and inside the signed-in application, to count page views and measure how long the product is used. These are analytics cookies, not advertising cookies: we run no advertising tags, no remarketing, and no cross-site tracking, and we do not permit Google to use the data for its own advertising purposes.

No analytics cookie is set on the pages a recipient opens — a document share link, a document request, an invoice, a signing session or an invitation. Those pages load no analytics at all. Page addresses are stripped of document, envelope and invoice identifiers before they are sent, so no analytics record can be traced back to a specific document.

5. Who we share data with

We share personal data with service providers that help us run AnySign, each bound by a written contract limiting them to our instructions. The current list is published in Annex III of the Data Processing Addendum, together with the notice we give before adding one.

We also disclose data where required by law or valid legal process, to establish or defend legal claims, or to a successor entity in a merger or asset sale — in which case we will give notice before your data becomes subject to a different policy.

6. International transfers

We and our providers may process data outside your country, including in the United States. Where we transfer personal data out of the EEA, the UK, or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses with the UK International Data Transfer Addendum and the Swiss equivalent, together with technical measures such as encryption in transit and at rest. A copy of the relevant clauses is available on request.

7. How long we keep it

• Account data — for the life of the account, then deleted or anonymised within 90 days of closure, except where we must keep records longer.
• Customer Data, including documents and signature evidence — for as long as the Workspace keeps it. The Workspace controls deletion; we delete on its instruction.
• Billing records — as long as tax and accounting law requires, typically 7 years.
• Audit trail entries — retained for evidential integrity. They are append-only, so an erasure request anonymises the personal data inside an entry rather than deleting the entry, which would break the chain of evidence others rely on.
• Security and application logs — a rolling short-term window, typically 30 to 90 days.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal data; to object to or restrict processing; to withdraw consent; and, in California, to know, delete, correct, and opt out of sale or sharing — which we do not do. We do not discriminate against anyone for exercising these rights.

Account holders can exercise most of these directly in the application. Workspace owners can additionally trigger erasure of a data subject's details across signers, customers, and pending invitations from Settings, and the action is written to the audit trail.

To make a request, email [email protected]. We respond within 30 days, and will verify your identity first. If you are unhappy with the outcome you may complain to your local supervisory authority; ours is [LEAD SUPERVISORY AUTHORITY].

EU/UK representative under GDPR Art. 27: [EU REPRESENTATIVE — NAME AND ADDRESS, IF APPLICABLE].

9. How we protect it

• Encryption in transit (TLS) and at rest, including server-side encryption for stored documents and AES-256-GCM encryption of any storage credentials a Workspace supplies.
• Passwords stored as Argon2id hashes; session tokens stored hashed, never in plain text.
• Workspace isolation enforced at the data layer, with role-based access inside a Workspace.
• An append-only audit trail enforced by the database, so signing evidence cannot be edited after the fact.
• Rate limiting, brute-force lockout on authentication, and least-privilege administrative access with logging of every administrative action.
• Dependency vulnerability scanning and prompt patching.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant regulator as required by law. Report a vulnerability to [email protected].

10. Children

The Service is for business use and is not directed to children under 16. We do not knowingly collect their data; if we learn we have, we delete it.

11. Changes to this policy

We will post any update here with a new effective date, and for material changes we will notify account holders by email at least 30 days in advance.

12. Contact

[LEGAL ENTITY NAME], [REGISTERED ADDRESS]. Privacy: [email protected]. Data protection officer: [DPO NAME AND CONTACT, IF APPOINTED].