Privacy

Last updated 12 October 2026.

If a business sent you a document

They are the controller and we are their processor. We hold, on their behalf: the document, your name and the address or number it was sent to, the time you opened it, the time you agreed to sign electronically, the time you signed, the network address you signed from, and your browser's description of itself.

All of that exists because an electronic signature is only worth something if it can be shown to have been made by the person it names, with their intent, on the document they saw. That is what the law asks for, and it is the whole product. What we do as their processor is set out on our data processing page.

To get a copy or ask for deletion, ask the business you signed with. If you cannot reach them, tell us and we will pass it on. We cannot delete their records on your say-so any more than a filing cabinet can.

If you visited signsealer.com

We are the controller. We hold your email address if you gave us one, when you gave it, whether you confirmed it, and whether you later asked us to stop.

If you said yes in the cookie banner, we also count visits with Google Analytics and measure our advertising with LinkedIn; each of them receives your address and the pages you read here, under their own privacy terms, and none of them is loaded before you answer or on a signing page. What each sets and for how long is on the cookies page, where you can also change your answer.

If your business is outside the United States and you asked us to tell you when SignSealer works there, we hold that address, the country, and the business name if you gave one. We use it for that one email and nothing else, and you can have it deleted with the form below like anything else we hold.

If you apply to test SignSealer in our beta, we hold what the application asks for: your name and email, your business and its trade, what you would get signed, what you use now and roughly how much, your LinkedIn profile if you gave it, how you heard about the beta, and the campaign tags on the link you arrived by. If you ticked the box for texts, we also hold your mobile number, the words beside the box and when you ticked it, and text you once, when you are approved. We use it to decide, to invite you, and to write to you about the beta, and for nothing else. If you join, the reports you send from your dashboard belong to your business and are read by its owners and admins and by the people here who read reports.

If a business texts you through SignSealer, what we send and what STOP does are on the text messages page.

Text messages and your phone number

A business's texts come from its own number, registered in its name and verified with the carriers (or, to a UK mobile, from its name), only after you or that business asked for them, and only about a document: the link to sign it, at most one reminder, a confirmation, or a one-time code. Our own toll-free number sends only our own: a code to sign in to your account, or, if you applied to our beta and asked for one, a text when you are approved. Message frequency varies with how many documents you are sent. Message and data rates may apply. Reply STOP to any text to stop, and HELP for help; a text to a UK mobile, which cannot be replied to, carries a link to stop instead.

We will not share or sell your mobile information with third parties for promotional or marketing purposes. Your phone number, and the fact that you consented to receive texts, will not be shared with or sold to third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are not shared with any third party. Your number reaches our messaging carrier in order to be delivered, and no further.

Ask for a copy, or ask us to delete it. We will email you to check it is you, and then do it.

Calling us, and our assistant

Our phone number, (866) 907-7446, is answered by an AI assistant. All calls are recorded and transcribed, from the moment the call is answered, including any part after the assistant puts you through to a person. The assistant says so before anything else, and we receive the number you call from. If you would rather not be recorded, hang up and email support@signsealer.com instead.

The assistant on our website, and on its own page in your dashboard, works the same way: what you type or say to it, and its replies, are recorded, and the chat says so.

We keep recordings and transcripts for one year, to answer you, to check how the assistant answered, and to improve our support; after a year they are deleted. ElevenLabs runs the assistant and holds them for us (see below). We do not use them for marketing and we do not sell them. Ask us to delete a recording and we will.

Who else sees it

These companies, and no others:

• Supabase — the database, in the United States.
• Railway — runs our servers: the signing pages, the app, and the background worker that sends mail and texts, in the United States. Everything those servers handle passes through it.
• Vercel — serves this website, and passes the signing pages and the app through to our servers over an encrypted connection, so it sees them as they pass.
• Sentry — receives reports of errors in our servers: what went wrong and where in our code. We strip headers, form contents and cookies before a report goes; an error's own message can occasionally include an email address.
• Resend — sends the emails. They see the address, the subject and the message, which contains a document's title and the signing link, not the document's text. The exception is the signed copy each signer is emailed when a document is complete: the signed PDF is attached to it, text, names and signatures included.
• Telnyx — sends the text messages, when a signer asked for the link by text or a customer signs in by code. They see the phone number and the message: a link, a reminder or a code, never a document's text. Replies of STOP and HELP come back through them. They also carry calls to our phone number, so they see the number a call came from and how long it lasted.
• Stripe — takes payment from businesses that pay online. Stripe sees the business's name and contact email and holds the card; we never see the card. Nothing about a signer or a document.
• Google and Apple — only if you choose to sign in to the app with them: they learn that you signed in, and we receive your name and email address from them.
• Cloudflare — Turnstile, on our contact and partner forms, a business's public forms and the app's emailed-link sign-in and sign-up, checks that a form is being sent by a person rather than a script. Cloudflare sees your browser and your IP address while you are on one of those pages, and tells us only whether the check passed. It never sees what you wrote.
• ElevenLabs — only if you use the assistant on our website or in your dashboard, or call our phone number, where the same assistant answers. What you type or say to it, your voice when you talk to it, the number you call from, and its replies are processed by ElevenLabs in the United States and kept for one year to improve our support, then deleted. All calls are recorded and transcribed, and the assistant says so before anything else. It answers from our public help pages. It can read a business's own account only for that business's owner or admin, after they read back a code we send to their own email address or verified mobile, or, in the dashboard, because they are signed in as one, and then only what they ask about: the membership, credit and charges, the team, and where their documents are up to (who has signed, not what anybody signed). Those answers then pass through ElevenLabs too. It never sees a document's text, a signer's answers or a card. If you ask it to pass you to a person, the name, email and message you give it come to us; once it knows who you are, it shows you the message it wrote up and, when you send it, files it under your account, with the name and email address on it.

One more, OpenRouter (routing to Anthropic, in the United States), for three things. If a business asks us to draft one of its forms, or switches on a review of a form's text before sending it, that text goes to it. A form is the document with the blanks still blank; a signer's name and what they signed are not in it. When somebody at a business asks our documentation a question on the support screen, the question as they typed it goes to it, with the pages of our documentation it is answered from; their name and their business's do not. And when you write to us, through the contact form or by email, your message, your name and your address go to it to check whether the message is a sales pitch, which we file away from our inbox rather than answer. A message it is not sure about reaches us as usual, and nothing from the check is kept but its answer. And we screen outbound invitations for spam and phishing: before a business's signing email or text is sent, what the business wrote in it (its name, its message, the document's title, the start of the document and any links) may go to it to be checked, never the name or address of the person it is going to; if switched on, Google's Web Risk is asked whether those links are known to be dangerous. Every signing email also lets you tell us you did not expect it, and then that business cannot email or text you through SignSealer again.

And Google Document AI, in the United States, only for a business that switches on reading scanned PDFs: when it uploads a PDF whose pages are pictures, the file goes to Google to have the words on its first pages read, so its signing boxes can be placed. That is the business's own document before anybody signs it; Google keeps nothing of it once it has answered.

A business can also connect its own Google Drive, and each document it completes is then put in a folder there: that is the business choosing where its own copies go, in its own Google account, as it might forward the completion email. Choosing a file from Google Drive to upload reads that one file, with the person's own permission for that visit, and keeps nothing of their Google account.

The full list, with what each one is handed, is in our subprocessor list. We do not sell anything to anybody, and we do not use what is here to train anything.

How long

Each business sets a retention period for its executed documents, with a floor of one year and a default of seven; when a document passes it, the text, the signers’ details and the answers are redacted, on a schedule we run every hour. A business can redact the people from a finished document sooner, at a signer’s request. A business that closes its account can take everything it holds in one file, and thirty days after closing, its documents are redacted the same way. When an owner closes an account we email them once to confirm it, and ask, if they did not say on the way out, why they left; whatever they tell us is kept with the account's record so we can learn from it. A screenshot attached to a beta report is deleted 180 days after the later of the day it was sent and the day that business’s free months in the beta end; the report itself stays with the account. Backups roll off on their own schedule, so a deletion reaches them a little later than it reaches the live record.

Two things do not change. The record that a signature happened — the time, the fingerprint of the text, the chain that shows nothing was altered — outlives the account it belongs to, because that is what makes the agreement rely-on-able by you as much as by them. And a certificate stays checkable: if you signed something, you can verify it years later without an account.

Your rights

Depending on where you live, you can ask for a copy of what we hold, ask us to correct it, ask us to delete it, and object to us using it. Use the same form for all of them; it asks for your address so we can check it is you, and nothing else.

We will tell you what we did and, if we kept something, what and why. An erasure that quietly kept something while reporting success is worse than one that says so.

Asking us something

privacy@signsealer.com, or the form.