Privacy Policy
1. Who we are
This policy explains how the operator of this SignFlow website (“we”, “us”) handles personal information when you use SignFlow — as an account holder, as a member of a workspace, or as someone who receives a document to sign or fills in a public web form.
For documents and contacts that account holders upload, the workspace that sends the document decides what is collected and why; we process that information on their behalf to provide the Service.
2. Information we collect
Account information: your name, email address, job title, time zone and workspace details. If you create a password, we store only a one-way Argon2id hash of it, never the password itself. If you sign in with Google, we receive your name, email address, profile picture and Google account identifier — we never see your Google password.
Content: documents, templates, fields, messages, contacts and form submissions that you upload or that are sent to you, along with completed documents and their certificates.
Signing records: for each document, the names and email addresses of recipients, signatures (drawn, typed or uploaded), field values, consent, and timestamped events such as views, signatures, declines, reminders and downloads, together with the IP address and browser information used to create the audit trail.
Security and technical information: sign-in history (successful and failed), active sessions with approximate device and browser details, IP addresses, and rate-limiting counters used to protect accounts.
Emails we send: a record of the transactional emails we send (such as verification codes, signing invitations and reminders), including recipient, subject and delivery status.
3. How we use information
We use information to operate the Service: to create and secure your account, deliver documents and notifications to recipients, apply signatures, generate audit trails and completion certificates, show you reports about your own documents, and respond to support requests.
We also use security information to detect and prevent abuse, such as repeated failed sign-in attempts. We do not sell personal information, we do not use your documents for advertising, and we do not build advertising profiles.
4. Cookies
SignFlow uses cookies that are necessary for signing in and keeping your session secure, such as a session cookie and short-lived cookies used during Google sign-in. We don’t use advertising or cross-site tracking cookies.
5. Recipients and signers
When you receive a document through SignFlow, your name, email address, signature, field entries and signing events are shared with the sender and with the other parties to that document, and are included in the document’s audit trail and completion certificate.
If you have questions about why you received a document, please contact the sender first — they control that document.
6. Service providers
We use a small number of infrastructure providers to run SignFlow on our behalf: application hosting, a managed PostgreSQL database, private file storage for documents, and an email delivery provider. If you choose to sign in with Google, Google processes that sign-in under its own privacy policy.
These providers may only use the information to provide their services to us. We may also disclose information when required by law, or to protect the rights and safety of our users and the Service.
7. Retention
We keep account information while your account is active. Documents, signed copies, completion certificates and audit records may be retained, including after they are removed from a workspace, for as long as needed to provide the service, preserve the integrity of signing records, resolve disputes and meet legal obligations.
Verification codes and password-reset links are stored only as hashes and expire quickly (15 and 30 minutes). Security logs are kept for a limited period to protect accounts. When you delete your account, we anonymize your profile and sign-in details; information that forms part of a document record may be retained as described above.
8. Security
We protect information with encrypted HTTPS connections, hashed passwords and one-time tokens, private document storage served only to authorized users, role-based access within workspaces, and the ability to sign out of every device. Signing links are unique, expiring and revocable.
No system is perfectly secure, and we don’t claim certifications or compliance programs we haven’t completed. If we become aware of a security incident affecting your information, we will notify you as required by law.
9. Your choices and rights
You can update your profile, download your documents, review your sign-in history, sign out of other devices, and request deletion of your account from Settings.
Depending on where you live, you may have additional rights, such as to access, correct, export or delete your personal information, or to object to certain processing. To exercise them, contact us at the contact address published by the operator of this SignFlow service. Recipients should contact the sender of a document for requests about that document.
10. International transfers
Our providers may process information in countries other than the one you live in. Where required, we rely on appropriate safeguards for those transfers.
11. Children
SignFlow is not intended for children under 16, and we don’t knowingly collect their personal information through accounts.
12. Changes and contact
We may update this policy as the Service changes. If a change is material, we will notify you in the product or by email before it takes effect. Questions about this policy can be sent to the contact address published by the operator of this SignFlow service. See also our Terms of Service.