Privacy policy

1. Who is responsible

Signclad Inc. is the controller for the data described in section 2 and the processor for the data described in section 3. Privacy questions go through the contact form.

2. Data we control: our customers and visitors

3. Data we process for you: documents and recipients

When you send a document, the files, field values, attachments, and recipient details are yours. Signclad is the processor and acts on your instructions. The data processing addendum governs this.

The evidence model requires recording, for each recipient: the email address the document was sent to, the IP address and user agent at each event, timestamps, the consent record, and the signature image or typed name. This is what makes the audit trail worth anything, and it cannot be turned off for a document that has been sent.

4. Cookies and tracking

This marketing site loads third-party measurement tags in production: Google Analytics, to count visits and see which pages people arrive on, and Google Ads and the Meta pixel, to measure advertising. Each sets cookies in your browser and each receives your IP address, browser user agent, and the page address. Arriving from an ad also records that ad's click identifier in a cookie, so a later sign-up can be attributed to it. Fonts and stylesheets are served from our own origin, not a third party.

The application at app.signclad.com loads no analytics tag and measures no page you visit. It sets a session cookie and a preference cookie, and, if you reached it from an ad, it records that ad's click identifier in a cookie the same way the marketing site does. Two moments are reported to the advertising networks, so that a sign-up or a subscription can be counted against the ad that led to it: creating an account, and paying for a plan. Those reports carry the click identifier, the amount paid where there is one, and a fixed address that is the same for everybody. They never carry the page you were on or anything you were working on, and nothing else you do in the application is reported. Signing pages carry no third-party script at all, so no analytics or advertising vendor is told that a document was sent to you.

We do not sell personal information and we do not share it for cross-context behavioural advertising.

5. Sub-processors and international transfers

The current sub-processor list names every third party that processes customer data and where, with 30 days notice before any addition. Data is processed in the United States. Signclad does not currently offer the service to, or monitor individuals in, the EEA or the UK, so no transfer mechanism is relied on for those regions.

6. Your rights

• Access, correction, deletion, restriction, objection, and portability.
• Withdrawal of consent where consent is the basis, without affecting processing before withdrawal.
• Complaint to your supervisory authority.
• If you are a recipient rather than a customer, the sender controls the document. We will route your request to them and tell you who they are.

Requests go through the contact form and are answered within 30 days.

7. Deletion, and the one exception

Deletion removes data from live systems and from backups on a defined schedule. The exception is the sealed evidence for completed documents: the artifacts and their hashes are retained for 7 years, because a chain with a hole in it proves nothing. This is described in the retention policy and in the terms.

8. Security

Server-side AES-256 at rest on object storage and backups, TLS 1.2 and above in transit, least-privilege access with MFA, the document-signing key held in AWS KMS where nobody can export it, and a 143-control programme described on the security page, behind completed SOC 2, ISO 27001, and HIPAA audits.

9. Children

Signclad is not intended for anyone under 18.

10. Changes

Material changes are announced 30 days in advance by email to account owners, with the effective date on this page.