Privacy Policy

Who is responsible

The controller of personal data processed through the website and the application is the administrator of the signee.io service. You can reach the administrator about anything in this policy at [email protected].

For agreements that a workspace uploads, drafts or sends, the workspace is the controller of the personal data in those agreements and Signee processes that data on its behalf as a processor. If you received a document to sign and have a question about it, the sender is usually the right first contact.

Data we collect

Data you give us

• Account data: name, email address, password (stored only as a hash), workspace name and role.
• Billing data: plan, billing period, billing address and tax details needed for invoices. Card numbers are entered on the payment operator page and never reach our servers.
• Content: agreements, templates, clauses, comments, approval decisions and the prompts you write for AI drafting.
• Messages you send to [email protected].

Data collected when you use the service

• Technical data: IP address, browser type, device type, pages visited and time of the visit, kept in server logs.
• Usage data: actions in the application such as documents created and sent, used to count plan limits and to improve the product.
• Signing evidence: for every signer, the email address, IP address, browser, consent to electronic records and the time of each step, stored in the audit trail.

Why we use it

• To provide the service you signed up for, including drafting, approvals, signing, storage and alerts (performance of a contract).
• To bill subscriptions and keep accounting records (legal obligation).
• To send service emails such as verification codes, signing invitations, reminders and renewal alerts (performance of a contract).
• To keep the service secure, prevent abuse and fix errors (legitimate interest).
• To understand which features are used and improve them, using aggregated data (legitimate interest).
• To keep the audit trail that proves how an agreement was signed (legitimate interest of the workspace and the signers, and legal obligations where they apply).

We do not sell personal data and we do not use it for advertising profiles.

Agreements and signer data

Agreements often contain names, job titles, addresses and other details of the parties. We process them only to deliver the features the workspace uses: showing the document to the right people, collecting signatures, extracting dates and obligations and sending alerts. Our staff do not open agreements unless the workspace asks for help with a specific document or we need to investigate abuse or a security incident.

Signers do not need an account. To sign, they receive a link at their email address, accept the consent to electronic records and sign. The audit trail with their signing evidence is attached to the signed PDF and kept with the agreement, because it is what makes the signature verifiable later.

AI features

When you draft, review or extract terms with AI, the text needed for that task is sent to a provider of AI language models that processes it on our instructions under a data processing contract. The provider may not use it to train its models. We do not use your agreements to train AI models either.

Drafts produced with AI are suggestions based on templates and your instructions. They are not legal advice, and you decide what goes into the final agreement.

Who receives data

We use a small number of service providers that process data on our behalf and only for the purposes above. By category, they are:

• a hosting and data center provider that runs our servers and stores encrypted backups,
• a payment operator that processes card payments and subscriptions,
• a transactional email provider that delivers verification codes, signing invitations and alerts,
• a provider of AI language models used for drafting, review and term extraction,
• an accounting provider that keeps invoices as required by law.

If a workspace connects a CRM or a team chat tool, data flows to that service under the workspace's own agreement with it. We may also disclose data when the law requires it, for example to a court or public authority with a valid request.

Transfers outside the EEA

Some providers may process data outside the European Economic Area. In those cases we rely on an adequacy decision of the European Commission or on standard contractual clauses, together with additional safeguards where needed. You can ask for details at [email protected].

Cookies

The website and application use only cookies that are necessary for them to work: a session cookie that keeps you logged in, a security token that protects forms against cross site request forgery, and a cookie that remembers simple preferences. We do not use advertising cookies or third party tracking pixels, which is why there is no cookie banner. Any statistics we keep about visits come from server logs, without cookies.

How long we keep data

• Account and workspace data: while the account exists, then deleted within 30 days of closing it, except data we must keep by law.
• Agreements and audit trails: for as long as the workspace keeps them. Workspaces on the Company plan can set retention rules per agreement type. Deleted agreements are removed from backups as the backups rotate.
• Invoices and billing records: for the period required by tax and accounting law.
• Server logs: for a limited period, typically up to 90 days, unless needed to investigate an incident.
• Anonymous demo drafts on the home page: deleted after a short period if no account is created.

Your rights

If the GDPR or a similar law applies to you, you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format and withdraw consent where processing is based on consent. You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work.

Residents of California and other US states with privacy laws can ask what personal information we hold, ask us to delete or correct it and opt out of any sale or sharing. We do not sell or share personal information for cross context advertising.

To use any of these rights, write to [email protected] from the email address linked to your account. If your data sits in an agreement controlled by a workspace, we pass your request to that workspace and help it respond.

Security

We protect data with encryption in transit and at rest, role based access, a tamper evident audit trail and limited, logged administrator access. The security page describes these measures in more detail. If we become aware of a breach that affects your personal data, we will inform you and the competent authority as the law requires.

The service is meant for businesses and is not directed at children under 16.

Changes and contact

We update this policy when the service or the law changes. Material changes are announced by email or in the application before they take effect. Questions about privacy go to the administrator of the signee.io service at [email protected]. The rules for using the service are in the terms of service.