SignFlow — Privacy Policy

Last updated: 2026-10-23

DRAFT — not legal advice. Adapt with counsel. If you have EU/UK users, confirm your GDPR roles and the lawful bases below.

1. Scope

This policy explains how SignFlow ("we") handles personal data when you use the cloud edition. The self-hosted edition runs on your own infrastructure, so you control that data directly; this policy then covers only the license-verification call the self-hosted portal makes to us.

2. Roles

• For your account data (your email, billing status), we are a controller.
• For your recipients' data and documents that you send through SignFlow, you are the controller and we act as your processor. See the Data Processing Addendum.

3. What we collect

• Account data: your email address and authentication data (via Supabase).
• Billing data: subscription status and a Stripe customer ID. Card details are handled by Stripe; we do not see or store full card numbers.
• DocuSign connection: OAuth access/refresh tokens for your DocuSign account, encrypted at rest. We do not store your DocuSign password or RSA keys.
• Send metadata: subject lines, recipient counts, envelope IDs, and status, to show you history. Document contents are transmitted to DocuSign to create envelopes and are not retained by SignFlow after sending.
• Recipient data you provide for sends (names, emails), processed to create envelopes.
• Technical data: standard server logs (IP, timestamps) for security and troubleshooting.

4. Why we use it (lawful bases)

To provide and secure the service and perform our contract with you; to process payments; and, where applicable, for legitimate interests in operating and improving the service. Where required, we rely on your consent, which you can withdraw.

5. Sharing

We share data only with the sub-processors needed to run the service: DocuSign (sending envelopes), Stripe (payments), Supabase (database & auth), and our hosting provider. We do not sell personal data.

6. Retention

We keep account and billing data for the life of your account and as required for legal/accounting purposes. You can request deletion (below). DocuSign retains envelopes under your DocuSign account per your DocuSign settings.

7. Security

OAuth tokens are encrypted at rest (AES-256-GCM). Access to production data is restricted. No method is perfectly secure, but we take reasonable measures to protect your data.

8. Your rights

Depending on your location you may have rights to access, correct, delete, or export your data, and to object to or restrict processing. Contact us to exercise these rights.

9. International transfers

Data may be processed in countries other than yours. Where required, we use appropriate safeguards for international transfers.

10. Changes & contact

We may update this policy and will notify you of material changes. Questions: [privacy@yourdomain.com].