Privacy Policy
Contents
1. Information We Collect
We collect information in the following categories:
Account information: When you register, we collect your name, email address, and password (stored as a secure hash). If you sign in via Google or Microsoft, we receive your profile name, email, and profile picture.
Document content: Documents you upload to the Service are stored to enable signing workflows. This may include personal information about you and third-party signers within the document content.
Signing activity: When a document is signed, we record the signer's name, email address, IP address, timestamp, and signing actions as part of the audit trail. This information is necessary to establish the validity of the signature.
IP addresses: We log IP addresses associated with signing events, login attempts, and account creation for security and fraud prevention purposes.
Payment information: We do not store payment card numbers. Payment processing is handled entirely by Stripe, Inc. We receive only a payment status and Stripe customer ID. See Stripe's privacy policy at stripe.com/privacy.
Usage data: We collect information about how you use the Service, such as pages visited, features used, and actions taken within the application, for the purpose of improving the Service.
Communications: If you contact us by email, we retain those communications to respond to your inquiry and improve our support.
2. How We Use Information
We use the information we collect to:
- Provide, operate, and improve the Service
- Process document signing workflows and generate audit trails
- Send transactional emails (signing requests, completion notices, password resets)
- Send service announcements and account-related notifications
- Process payments and prevent fraud
- Comply with legal obligations
- Provide customer support
- Send weekly digest emails if you have opted in
We do not use your documents or their contents to train machine learning models or for any purpose other than operating the Service.
3. Data Storage
All data, including documents and account information, is stored on servers located in Canada. We implement appropriate technical and organizational security measures, including:
- Encrypted transmission using TLS/HTTPS
- Access controls limiting who can view your data
- Regular security reviews
- Secure password hashing (bcrypt)
4. Data Retention
Documents are retained according to your account's retention settings. You may configure automatic deletion of completed or voided documents after a specified period.
Upon account closure, we will retain your data for a minimum of 30 days to allow for recovery if the closure was unintentional. After this period, your account data, documents, and associated information will be permanently deleted, except where we are required to retain it by law (for example, for financial record-keeping purposes).
Audit trail data associated with completed documents may be retained longer where required to support the legal validity of executed signatures.
5. Sharing of Information
We do not sell your personal information. We do not share your data with third parties for advertising or marketing purposes.
We share data only in the following limited circumstances:
- Stripe: For payment processing. Stripe receives your payment information and may receive your email address and billing details as required.
- Google / Microsoft: If you choose to sign in with Google or Microsoft, those services process your authentication information in accordance with their respective privacy policies.
- Signers and CC recipients: When you send a document for signature, the signers' names, email addresses, and signed documents are shared as part of the signing workflow you initiate.
- Legal requirements: We may disclose information if required by law, court order, or to protect the rights and safety of Segal Technology or others.
- Business transfers: If Segal Technology is acquired, merged, or its assets are transferred, user data may be part of the transferred assets. We will notify affected users before data is transferred and becomes subject to a different privacy policy.
6. Cookies and Tracking
We use session cookies only -- small files stored in your browser that maintain your login session while you use the Service. These cookies are essential for the Service to function.
We do not use:
- Advertising cookies or cross-site tracking cookies
- Third-party analytics cookies
- Persistent tracking cookies
You can configure your browser to reject cookies, but this will prevent you from being able to sign in to the Service.
7. Your Rights under PIPEDA and Alberta PIPA
As a Canadian user, under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA), you have the right to:
- Access: Request a copy of the personal information we hold about you
- Correction: Request that we correct inaccurate or incomplete information
- Deletion: Request deletion of your personal information, subject to our retention obligations
- Withdrawal of consent: Withdraw consent to certain uses of your personal information (note: some uses are necessary for providing the Service)
- Complaint: File a complaint with the Office of the Privacy Commissioner of Canada (federally) or the Office of the Information and Privacy Commissioner of Alberta (provincially) if you believe your rights have been violated
To exercise these rights, contact us at [email protected]. We will respond within 30 days.
8. GDPR Rights for EU Users
If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):
- Right to access: Obtain a copy of your personal data
- Right to rectification: Have inaccurate data corrected
- Right to erasure ("right to be forgotten"): Request deletion of your data
- Right to restrict processing: Limit how we use your data in certain circumstances
- Right to data portability: Receive your data in a structured, machine-readable format
- Right to object: Object to processing based on legitimate interests
The legal basis for processing your personal data is: (a) performance of a contract (providing the Service); (b) legitimate interests (security, fraud prevention); (c) consent (optional communications such as weekly digests); and (d) legal obligation where applicable.
To exercise your GDPR rights, contact us at [email protected].
9. Data Breach Notification
In the event of a data breach that poses a real risk of significant harm to affected individuals, we will:
- Notify affected users as soon as reasonably practicable
- Report to the Office of the Privacy Commissioner of Canada as required by PIPEDA, and to the Office of the Information and Privacy Commissioner of Alberta as required by Alberta PIPA
- Provide information about what happened, what data was affected, and steps we are taking
10. Children's Privacy
Segal Sign is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us at [email protected] and we will take steps to delete the information.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting a notice on the Service. Changes take effect 14 days after notification, or immediately for changes required by law. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
12. Contact for Privacy Matters
Our privacy contact handles all inquiries about this Privacy Policy and your personal information rights.
We aim to respond to all privacy inquiries within 30 days.