Privacy Policy
Effective August 8, 2026
Who this covers
SigForms serves two groups: account holders, who upload documents and send them out, and signers, who fill in and sign those documents. For a signer's answers, the account holder who sent the document decides why the information is collected and what happens to it; we process it on their behalf.
What we collect
- Account details — name, email address, a bcrypt hash of your password (never the password itself), and the industry you select at signup.
- Documents and answers — the PDFs you upload, the field values signers enter, and signature images they draw.
- Signing records — signer name, timestamps for when a request was sent, opened and completed, IP address, and browser user agent. These make the signature certificate meaningful and are deliberately hard to alter.
We do not use advertising trackers, and we do not sell personal information.
How we use it
To operate the Service: storing and rendering your documents, delivering signature requests, producing completed PDFs and certificates, notifying account holders of submissions, securing accounts against abuse, and meeting legal obligations.
Who we share it with
Only the service providers needed to run SigForms, each acting on our instructions:
- Vercel — application hosting
- Supabase — database hosting
- Google Cloud Storage — document storage
- SendGrid — email delivery
- Anthropic — optional AI field detection; when you use "Discover fields", that document is sent for analysis and is not used to train models
We may also disclose information where the law requires it, or to a successor in a merger or acquisition.
Security
Documents are stored privately and reached only through authenticated application routes — never by a public link. Passwords are hashed with bcrypt. Password reset links are stored only as hashes, expire in one hour and work once. Traffic is encrypted in transit.
Retention
We keep documents, submissions and signing records for as long as the account holder keeps them, so that completed documents remain retrievable. Deleting a document removes its stored PDF and its submissions. Contact us to delete an account and everything in it.
Your choices
You may request access to, correction of, or deletion of your personal information. Signers should contact the organisation that sent them the document first, since that organisation controls the record; we will help them respond.
Health information
Where SigForms is used to collect protected health information, the account holder is the covered entity and we act as a business associate only under a signed Business Associate Agreement.
Contact
Privacy questions: privacy@sigforms.com.