Privacy Policy

From account holders: your name, email, password (stored hashed by our authentication provider), company name, logo, team members and their roles, and billing details. Card numbers are handled by Stripe, and we never see or store them.

Documents: the files you upload, the fields you place, and the values you and your signers enter.

From signers: the name and email the sender entered, the signature or initials drawn or typed, consent to sign electronically, and, for the audit trail, the IP address, browser user agent and time of each action (viewed, consented, signed, declined), plus the approximate location (city, region and country) our hosting provider derives from that IP address when they sign.

Usage and logs: basic technical logs such as errors, request times and email delivery status, used to run and secure the service.

• to provide the service: store, send and finalize your documents;
• to produce the certificate of completion and audit trail that make signatures enforceable;
• to send the emails the service depends on;
• to bill paid plans and prevent fraud and abuse;
• to support you and fix problems.

We don't sell personal information. We don't use your documents for advertising. We don't use your documents or signer data to train AI models, and our AI provider doesn't either.

Documents go to the signers and recipients you choose. Beyond that, we use these service providers, and each handles data only on our instructions:

• Supabase — Database, file storage and sign-in
• Vercel — Application hosting
• Resend — Sending signing requests and notifications by email
• Anthropic — The AI model behind Alana, only when you use Alana
• Stripe — Payments and billing

If you connect an integration such as EstimateMaster, that app can reach your workspace within the permissions you grant. We may also disclose information when the law requires it.

Data is encrypted in transit and at rest. Every workspace is isolated at the database level. Signing links use unguessable per-signer tokens that we store only as hashes. Each completed document is fingerprinted with a SHA-256 hash so later changes can be detected.

We keep documents and their audit trails for as long as your workspace exists, because a signed agreement is only useful if its evidence survives. Signers can ask the sender for a copy of any document they signed.

You can delete your account in the SignMasterapp or in Settings on the web. We delete it 7 days after you ask, and you can cancel until then. If you're the only member of your workspace, we delete the workspace too, except the signed copy of each completed document and its certificate of completion, which we keep securely for 7 years after it was signed, because those records may be needed as evidence of the agreement, and then delete. Documents you sent for your company stay with your company if other members remain.

You can view and update your account details in Settings, and download your completed documents at any time. Depending on where you live (for example California, or the EU and UK), you may have the right to access, correct, delete or export your personal information, and to object to certain processing. We won't treat you differently for using those rights.

If you signed a document someone sent you, that sender controls the document. We will pass your request to them and help them respond.

To make a request, email privacy@usesignmaster.app.

SignMasteris for businesses and adults. We don't knowingly collect information from children under 13.

If we make material changes to this policy, we will tell account holders by email or in the app before they take effect. Questions? Email privacy@usesignmaster.app.