Privacy Policy

Data we collect. Name, email, organisation, document metadata (file name, size, SHA-256 hash), action logs, and IP address.

Purpose. To provide the signing service, verify account identity, prevent abuse, provide support, and meet legal obligations.

Document content. Uploaded documents are stored for signing and verification. We do not use them for any other purpose.

Public record. Each document has a public record page reachable only via its random token (/d/<token>). It shows metadata and hashes, not the file content. Anyone you share the token or QR with can view that record and check a file's hash.

Timestamps. Signatures include an RFC3161 timestamp produced by our own TSA. A public timestamp authority may be used as a fallback.

Verification uploads. Files uploaded to the verification page are processed and deleted after the check.

Disclosure. Data is not sold. It may be disclosed to infrastructure providers (hosting) bound by confidentiality, or to authorities where required by law.

Security. Data is encrypted in transit (TLS). User signing keys are encrypted (AES-256). Access to the CA is restricted.

Retention. Data is kept while the account is active. You may request deletion; some records may be retained to meet legal obligations.

Your rights. You have the right to access, correct, or object to the processing of your data. Contact us for requests.