Privacy
Controller: Luis Miguel Sousa Alves, Eystrasse 76, 3422 Kirchberg BE, [E-Mail]
What data
Email address and name of senders and team members; name, email (optionally mobile number) of signers; uploaded documents, field values, signatures, photos and attachments; an audit log with timestamps, IP addresses and browser details as evidence of the signature.
Purpose
Only to create, send, sign and prove the documents. No advertising, no tracking, no cookies except the technically necessary sign-in cookie.
Storage and security
Cloudflare (database and file storage in the EU). Documents, attachments and the IP addresses and browser details in the audit log are additionally encrypted with a key per document (AES-256-GCM).
Retention and deletion
Free plan: completed, declined, expired and withdrawn documents are deleted after 30 days. Pro: until the sender deletes them. Deleting destroys the document’s key: the document, attachments, IP addresses and browser details can no longer be read. Timestamps and types of the audit events are kept as evidence. The provider’s database backups are kept for at most 30 days. Copies in the participants’ emails remain.
Sharing
With the people involved in the document, members of the same workspace (team), and processors for hosting and email/SMS delivery. An uploaded logo is publicly accessible because it appears on signing pages and in emails.
Public signing links
People signing through a public link enter their name and email themselves. This creates a separate document in the workspace that published the link.
Access, correction and deletion under the Swiss FADP or the GDPR: write to [E-Mail].
Draft: to be reviewed by a lawyer before launch.