Legal
Privacy Notice
This notice explains what Signavos collects, why we collect it, and the controls you have. It reflects how the Service actually works.
⚠ This is a placeholder-safe draft for the product team — not legal advice. Have it reviewed by counsel before publishing it to production.
What we collect
Account identity. When you sign up or sign in, our identity provider (Clerk) provides us your name and email address. We do not handle passwords — sign-in uses secure links or your provider's session.
Documents and signatures. The PDFs you upload, the signature fields you place, and the signatures collected are stored on our behalf in private object storage (Cloudflare R2). Recipient names and email addresses are stored with your documents; the emails are encrypted at rest.
Payments. When you buy credit packs, payment card details are processed by our payment processor (Stripe) — card numbers never touch our servers. We receive the transaction status and amount.
Usage and technical data. We keep an audit trail of document lifecycle events (upload, send, view, sign, completion) with timestamps and basic request metadata, and standard server logs for security and debugging.
How we use it
To provide the Service (storing and delivering your documents, sending signing invitations by email via Resend, processing payments, and maintaining the audit trail); to secure the Service (rate limiting, abuse prevention, and incident response); and to communicate about your account or the Service (for example, confirmation of sending or completion).
Who we share it with
We share data only with the service providers that run the Service (hosting, object storage, email delivery, payment processing, analytics/error monitoring) and only as needed to provide it. We do not sell personal data. We may disclose data where required by law or to protect the rights and safety of users and the Service.
Retention
Documents and related data are kept until you delete them. When you delete a document, it is permanently purged from the application, storage, and database, while a minimal audit record is retained to preserve the integrity of the audit trail. Payment records are retained as required by applicable law.
Your rights
Depending on where you live (including under GDPR and CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can delete documents from the dashboard; for anything else, email us and we'll help.
Contact
Privacy questions: support@docu-sign.com. Legal requests: legal@docu-sign.com.