Accord de traitement des données

1. Scope and roles

This Data Processing Agreement (the "DPA") forms part of the Terms of Service between you, an account holder (the "Customer"), and the entity identified in the Legal Notice published on this site (the "Operator", "we"). It applies when you use paid features that store documents or send them to other people for signature, and those documents or requests contain personal data of people other than you.

For that personal data, you are the controller and we are your processor under Article 28 of the EU General Data Protection Regulation (GDPR). For your own account and billing data we are the controller, and the Privacy Policy applies instead of this DPA.

The free signer is outside this DPA. It processes documents entirely in the visitor's browser, so we never receive them.

2. Subject matter, nature, purpose and duration

We store the documents you place in your vault, send them to the recipients you choose, collect their signatures, and keep the records that show what happened. That is the only purpose for which we process the data.

Processing lasts for as long as you keep the document or request in your account, and ends with deletion as described in section 8.

3. Data subjects and categories of data

Data subjects are the recipients you invite to sign and any person whose data appears in a document you store or send.

Categories of data are names and email addresses of recipients, the messages you write to them, signature images, signing and viewing events with their timestamps, IP addresses and browser user agents, the electronic-signature consent recipients give, and SHA-256 fingerprints of document versions. The documents themselves may contain any data you choose to put in them. If they include special categories of data under Article 9 GDPR, you are responsible for having a legal basis to process it.

4. Our obligations

We process the data only on your documented instructions. Those instructions are the Terms, this DPA, and the actions you take in the product. If we believe an instruction breaks data-protection law, we will tell you.

Everyone at the Operator who can access the data is bound by confidentiality. We apply the security measures in section 7, help you answer requests from data subjects, and help you meet your obligations under Articles 32 to 36 GDPR, taking into account the information available to us.

If we become aware of a personal data breach affecting your data, we will notify you without undue delay and give you the information we have so you can meet your own notification duties.

5. Sub-processors

You authorise us to use the following sub-processors for this processing: Vercel (application hosting), Supabase (database, authentication and document storage), Resend (sending signature requests and completion emails), Google (sign-in, only when you require recipients to sign in with Google), and Anthropic (AI-assisted signature placement, only when you use that feature on a document).

We impose data-protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible to you for their performance. We will update this list before we add or replace a sub-processor. If you object to a change on reasonable data-protection grounds, you may stop using the affected feature or close your account.

6. International transfers

Some sub-processors process data outside the EU/EEA, notably in the United States. Where they do, the transfer is covered by an adequacy decision, such as the EU-US Data Privacy Framework, or by the European Commission's Standard Contractual Clauses, as described in the Privacy Policy.

7. Security measures

Data is encrypted in transit with TLS and encrypted at rest by our storage provider. Document storage is private: files are only reachable through short-lived signed links created on our servers.

Database access is restricted per account by row-level security, so one customer's records cannot be read with another customer's credentials. Recipient links carry random tokens that we store only as hashes, and they expire.

Signing events are written to an append-only log in which each entry is chained to the previous one by a hash, so a later change to a recorded event can be detected. Secret keys are held server-side and never sent to the browser.

8. Deletion

When you delete a document or close your account, we delete the document, its signature requests and its audit records, subject to short backup retention windows. Certificates of completion already emailed to the parties stay in their mailboxes, outside our control.

You can download your documents before deleting them. We do not keep copies after deletion except where the law requires it.

9. Information and audits

On written request we will provide the information reasonably needed to show that we meet this DPA. If that information is not enough, you may audit our compliance, with reasonable notice, at your own cost, and in a way that does not expose other customers' data.

10. Precedence and contact

If this DPA and the Terms conflict on a data-protection matter, this DPA prevails. Everything else, including liability and governing law, follows the Terms.

Questions about this DPA can be sent to the contact address published in the Legal Notice.