Privacy Policy

Account holders. Name, email address and authentication identifiers from the sign-in provider you choose (email/password or Google); the documents, versions and comments you upload or write; billing status, subscription and customer identifiers from our payment provider (we never see your full card number).

Recipients. The name and email address the sender enters; whether and when you opened, commented on, approved or declined a document; and, when you sign, your signature (typed name, drawn or uploaded image), the consent text you agreed to, the time, your IP address and browser user agent, and cryptographic hashes of the signature and document. This is the evidence that makes an electronic signature verifiable.

Technical data. Server logs (IP address, request path, timestamp, user agent) used for security and rate limiting. We use a strictly necessary session cookie to keep you signed in and a local preference for light/dark theme; these do not require your consent.

Analytics. With your consent we use Google Analytics 4 and PostHog to understand how the site is used and where visitors come from. These set cookies and browser storage. We ask before loading either one, you can decline, and declining leaves the Service fully usable. We do not use advertising cookies and we do not sell or share data for advertising. Document pages, signature ink and typed signatures are excluded from PostHog session recordings and heatmaps.

• to provide the Service: store documents, deliver signing links, record approvals and generate the finalised signed PDF;
• to send transactional emails: invitations, reminders, activity notices and completion notices (we do not send marketing email);
• to manage subscriptions and payments through our merchant of record;
• to secure the Service: prevent abuse, enforce rate limits and investigate misuse;
• to comply with legal obligations and enforce our Terms.

Where the GDPR or similar laws apply, our legal bases are performance of a contract (providing the Service), legitimate interests (security, evidence of signatures, service improvement) and legal obligation. Signature evidence is retained because it is necessary to establish the validity of the agreement you signed.

We share data only with the processors needed to run the Service:

• Paddle (Paddle.com Market Ltd): merchant of record for payments, invoices and tax. Paddle is an independent controller for your payment data; see Paddle's privacy policy.
• Self-hosted PostgreSQL: database for document metadata, audit logs and accounts.
• Self-hosted S3-compatible object storage: private storage of uploaded and finalised PDFs.
• Firebase Authentication (Google): sign-in.
• Resend: transactional email delivery.

Document content and recipient details are shared with the other parties to that document (the sender and its recipients) as part of the signing workflow. We do not sell personal data. We disclose data to authorities only where legally required.

• Uploaded and signed PDFs: kept while the account exists, on every plan. We do not delete them on a schedule; you can delete a document yourself at any time.
• Document metadata and audit log (who did what, when, from which IP): kept while the account exists, because it evidences the agreement.
• Account data: until you delete your account, after which documents, files and billing mappings are erased; audit logs are anonymised or deleted unless we must keep them to comply with law.
• Server logs: up to 30 days.

Files are stored as authenticated assets and served only through authorised, same-origin routes. Signing links use 256-bit random tokens; only hashes are stored for lookup and encrypted copies for the sender. Finalised PDFs include hashes of the original and final files. Access to production systems is restricted and credentials are stored server-side only.

Depending on where you live you may have rights to access, correct, export, restrict or delete your personal data, and to object to certain processing. Account holders can delete their account from Account settings. Recipients can contact us to ask what we hold; note that signature evidence attached to a completed agreement may be retained by the sender as the lawful record of that agreement.

To exercise any right, email support@putmysign.com. If you are in the EU/UK you may also complain to your local data protection authority.

Grievance Officer (India). Under India's Digital Personal Data Protection Act 2023, Akbar Ali, sole proprietor trading as Putmysign has designated a Grievance Officer to answer questions and complaints about how we handle personal data. Write to support@putmysign.com marking your message "Grievance Officer"; we aim to respond within 30 days. If you are not satisfied you may complain to the Data Protection Board of India.

Akbar Ali, sole proprietor trading as Putmysign operates from India, and our processors may store data in India, the United States, the United Kingdom and the European Union. This means personal data of people in the EU/UK is transferred outside those regions. India is not covered by a UK or EU adequacy decision, so where required we rely on standard contractual clauses or equivalent safeguards for those transfers.

The Service is not directed to children under 16 and we do not knowingly collect their data.

We will post any changes to this policy on this page and, for material changes, notify account holders by email. Questions: support@putmysign.com.