Draw n Sign

Legal

Privacy Policy

Last updated [10 August,2026]

This Privacy Policy explains how [COMPANY LEGAL NAME] ("we", "us", "our") collects, uses, stores, and shares personal data when you use Draw n Sign (the "Service"). It should be read together with our Terms of Service and Security page.

1. Who we are

The data controller is [COMPANY LEGAL NAME], registered in [GOVERNING LAW] under company number [COMPANY NUMBER], registered office [REGISTERED ADDRESS]. Contact: [CONTACT EMAIL]. [⚠ LAWYER REVIEW: confirm controller vs processor roles if you offer white-label or API products.]

2. Data we collect

2.1 Account & profile

Name, email address, authentication credentials (handled by our auth provider), plan/subscription status, and profile preferences you choose to provide.

2.2 Documents & signatures

PDFs and other files you upload; field placements; signature images/drawings/typed names; signer names and email addresses; completion status; and related metadata needed to deliver and verify the document.

2.3 Audit & verification data

Event type (for example created, sent, opened, signed, closed), actor email where available, timestamps, IP address, user-agent / device hints, content hashes, and Document IDs used for public verification.

2.4 Technical & usage data

Approximate device/browser information, logs needed to operate and secure the Service, and limited product analytics.

2.5 Billing data

If you subscribe to a paid plan, payment and invoice details are processed by our payment provider. We store subscription status and related account identifiers. [PAYMENT PROVIDER NAME] [⚠ LAWYER REVIEW].

We process personal data to:

  • Provide the Service (account, upload, send, sign, verify) — contract / legitimate interests.
  • Maintain a tamper-evident audit trail and long-term verification — legitimate interests / legal obligation where applicable.
  • Send transactional emails (invites, reminders, receipts) — contract.
  • Bill and collect fees — contract / legal obligation.
  • Detect abuse, fraud, and security incidents — legitimate interests.
  • Comply with law and respond to lawful requests — legal obligation.
  • Improve the Service with aggregated or limited analytics — legitimate interests / consent where required.

[Adjust legal bases for your primary jurisdiction — UK GDPR / EU GDPR / other.]

4. Signers who do not have an account

Recipients can sign via a secure link without creating an account. We process their name, email, signature, consent to sign electronically, IP/user-agent, and related audit events solely to complete and verify the signing process you initiated.

5. Sharing & processors

We do not sell personal data. We use service providers (processors) for hosting, authentication, email delivery, storage, and payments, under contracts that limit their use of data to providing services to us. Categories include: cloud hosting/database, auth, transactional email, object storage, and payment processing. [List named processors if required in your jurisdiction.]

We may disclose data if required by law, to protect rights and safety, or in connection with a merger, acquisition, or asset sale (with appropriate notice where required).

6. Public verification

Anyone with a Document ID can view verification metadata (status, timestamps, audit timeline, integrity indicators). Private PDF files are not publicly downloadable from the verify page. Do not treat a Document ID as a secret if you need the verification page to remain private.

7. Retention ⚠ LAWYER REVIEW

  • Draft (unsigned) documents: may be deleted by you at any time; we may delete inactive drafts after [DRAFT RETENTION PERIOD].
  • Signed documents, signed PDFs, and audit trails: retained on a long-term basis so verification remains possible, including after account closure. [RETENTION PERIOD OR "for the life of the verification record"]. [Adjust for GDPR erasure vs legitimate-interest retention — see Terms clause 5.]
  • Account data: kept while your account is active; after soft-deletion, credentials are disabled and personal profile fields may be minimised while signed records remain attributable as needed for verification.
  • Logs: retained for [LOG RETENTION PERIOD] unless needed longer for security or legal reasons.

8. International transfers

Data may be processed in [DATA REGIONS] and other countries where we or our processors operate. Where required, we use appropriate safeguards (for example standard contractual clauses). [⚠ LAWYER REVIEW]

9. Your rights

Depending on your location, you may have rights to access, rectify, erase, restrict, object, port data, or withdraw consent. To exercise rights, email [CONTACT EMAIL]. You may also complain to your local supervisory authority (for example the ICO in the UK).

Some rights may be limited where we must retain signed documents and audit trails for verification or legal compliance. [⚠ LAWYER REVIEW]

10. Children

The Service is not directed to individuals under 18. We do not knowingly collect personal data from children.

11. Changes

We may update this Policy. Material changes will be reflected by updating the "Last updated" line (and notice via the Service or email where appropriate).

12. Contact

Privacy questions: [inof@drawnsign.com]. Company: [Draw n Sign].