Privacy Policy

Who we are

signet is run by 5013351 Ontario Inc. dba Signet Docs, Toronto, Ontario, Canada (“we”, “us”). This policy explains what personal information signet collects, why, who else handles it, and how long we keep it. Using signet is also covered by our Terms of Service.

What we collect

When you sign in. You sign in with Google or with an email address and password. With Google, we keep your name, your email address and your Google account id, and never see your Google password. With a password, we keep your email address and a one-way scrambled form of the password, never the password itself. For each password sign-in attempt we record the email address, IP address and time, to stop password guessing.

What you put in your workspace. Documents and their versions, templates, proposals, contracts, invoices, deals, and your clients’ details (name, email, company, billing address, phone, and notes you add), plus your brand and settings.

About the people you send things to. For signers and for people who receive a proposal or an invoice:

• the name and email address you enter;
• when they open, view, sign or answer, with their IP address and browser;
• on proposal pages, how far the page was read;
• what they fill in and sign.

These records are the audit trail. When a document is fully signed, each signer’s name, email, IP address, browser and signing time are printed on a certificate page added to the document.

When you sign up. The IP address and time of each sign-up attempt, to stop automated sign-ups. Cloudflare Turnstile checks your browser on the sign-up page, and on the sign-in page after failed attempts, and we send it your IP address.

When a program uses your API key. The IP address and time of each request, to enforce rate limits.

For billing. When you choose a paid plan, Stripe receives the workspace owner’s name and email and the billing address you enter. Card details go to Stripe; signet never sees or stores card numbers. We keep Stripe’s ids for your account, your plan and its status.

Usage counts. How many emails, AI actions and uploads a workspace has used, to apply the daily allowances.

Why we use it

• To run signet for you: sign you in, store your work, send what you ask us to send, show you who opened and signed it, and take payments.
• To stop abuse: the sign-up check, the sign-up and sending limits, and a daily report to signet’s operator listing new workspaces (name, owner’s email and trial end date), networks (IP address) with repeated sign-up attempts that made no workspace, workspaces that reached a sending limit, and workspaces that sent more than 200 documents for signature in the month.
• To email you about your account, such as trial reminders and billing notices.

We do not sell personal information and do not use it for advertising.

Who handles it for us

• Google Cloud hosts signet (Cloud Run), its database (Cloud SQL) and your files (Cloud Storage), in the United States (us-central1).
• Google signs you in, when you choose Google sign-in.
• Stripe bills paid plans, and takes your clients’ card payments through the Stripe account you connect.
• Resend sends signet’s emails, so it receives each email’s recipients and content.
• Anthropic runs Claude for the AI features. Only when you use one, it receives the text that feature needs: a template, the deal and client details, the proposal, or the wording to change. Anthropic handles this text under its commercial terms and privacy policy.
• Cloudflare runs Turnstile, the check on the sign-up page and, after failed attempts, the sign-in page.

If you connect another app to signet, such as Claude through signet’s connector or a program using an API key, it can read your workspace within the access you give it, under its own privacy terms.

How long we keep it

Your workspace’s content stays for as long as the workspace exists. The end of a trial or a change of plan deletes nothing.

A clean-up runs every night and permanently deletes, with their files:

• documents and templates you deleted more than 24 hours earlier;
• archived documents that were never signed, 90 days after they were archived;
• sign-up attempt records (IP address and time) older than 30 days;
• password sign-in attempt records (email address, IP address and time) older than 30 days;
• API request records (IP address and time) older than 30 days.

Signed documents and their audit trail are never removed by the clean-up, even when archived.

Google Cloud keeps signet’s server logs, which include IP addresses, for 30 days.

Getting a copy or having it deleted

To get a copy of your personal information, correct it, or have it deleted, email support@signetdocs.app. We will reply within 30 days, and we delete by hand within 30 days. If you signed or received a document from a business that uses signet, contact that business first: it decides what is kept in its workspace, and we will help it answer you.

Cookies and browser storage

• A sign-in cookie keeps you signed in. It expires after 30 days without use.
• While you sign in with Google, a few more cookies protect the sign-in and remember where to return you.
• The sign-up cookie links your sign-up check to your Google sign-in. It lasts 10 minutes.
• While you connect your Stripe account, a cookie lasting 10 minutes checks that the reply from Stripe is yours.
• Your browser’s own storage remembers a few display choices, such as list or grid view. It stays on your device.

signet sets no advertising or analytics cookies and loads no analytics scripts. Signing, proposal and invoice pages set no cookies.

Children

signet is a business tool and is not meant for anyone under 18.

Changes to this policy

We may update this policy. We will post the new version here and change the date at the top. If a change matters, we will email workspace owners before it takes effect.

Contact

Questions about privacy: support@signetdocs.app.