Privacy Policy

This Privacy Policy explains how eSigns ("we", "us", "our") collects, uses, shares, and protects personal data when you visit our website or use our electronic signature, contract lifecycle management (CLM), and workflow automation services (the "Services"). It applies to visitors, customers, users, and signers.

1. Our Role: Controller and Processor

• As a controller/data fiduciary, we decide how and why we use personal data for our own purposes: website visitors, account holders, billing contacts, marketing leads, and security monitoring.
• As a processor/service provider, we process personal data in Customer Content (documents, signer details, contract data) on behalf of our Customers and only on their instructions, under our [Data Processing Agreement].

If you are a signer and received a document through eSigns, the sender (our customer) is generally responsible for how your data in that document is used. Please contact them first about that data.

2. Personal Data We Collect

Data you provide

• Account details: Name, email, phone, job title, organization, password.
• Billing details: Billing address, tax ID (e.g., GSTIN), payment information handled by our payment providers. We do not store full card numbers.
• Support and communication data: Messages, feedback, survey responses.

Data processed through the services

• Signer details: Name, email, phone number, signature image or typed/drawn signature, initials.
• Documents and data fields: Contracts, attachments, form entries, comments, and metadata.
• Audit Trail data: Timestamps, IP address, device and browser type, approximate location, and event history.

Data collected automatically

• Usage data: Pages viewed, features used, clickstream, error logs.
• Cookies and similar technologies, as described in our Cookie Policy.

Data from other sources

• Integrations you connect (CRM, cloud storage, SSO), business contact databases, and referral partners.

3. How We Use Personal Data

We do not use Customer Content to train general-purpose AI models without your explicit consent.

We do not sell personal data and do not "share" personal data for cross-context behavioral advertising.

4. How We Share Personal Data

• Other parties to a document: Signers, senders, and collaborators see the information needed to complete the transaction, including names, emails, and audit trail details.
• Service providers (subprocessors): Cloud hosting ([AWS/Azure]), email and SMS delivery, payment processing, identity verification, e-stamping, analytics, customer support tools. A current list is available at [AWS/Azure].
• Licensed trust service providers: For Aadhaar eSign or Digital Signature Certificates, data is shared with licensed ESPs and certifying authorities.
• Legal and safety: Courts, regulators, or law enforcement when required by law, or to protect rights and security.
• Business transfers: In a merger, acquisition, or asset sale, subject to this Policy's protections.
• With your direction: Integrations and disclosures you request.

5. Cookies and Tracking

We use cookies and similar technologies for essential functions (login, signing sessions), analytics, and, where applicable, marketing. See our Cookie Policy for details and how to manage preferences.

6. International Data Transfers

We operate in India and the United States, and our providers may process data in other countries. Customer content is hosted in [confirmed hosting regions]. When we transfer personal data across borders, we apply safeguards required by applicable law, such as contractual protections and, where relevant, transfer mechanisms recognized under the DPDP Act and other laws.

7. Data Retention

• Customer Content: Kept while your account is active, and for [30] days after termination for export, unless a longer period is legally required or contractually agreed. Backups are purged on a rolling cycle of about [90] days.
• Signed documents and Audit Trails: Kept per the customer's configured retention settings.
• Account and billing records: Kept for [7/8] years for tax and accounting purposes.
• Logs: Retained for [180 days] or longer where legally required, including under CERT-In Directions [for India]. According to NIST / FedRAMP (Federal/Cloud), often require 90 days active and up to 1 year total retention.
• Marketing data: Until you unsubscribe or request deletion.

8. Security

We use safeguards such as encryption in transit and at rest, access controls, tamper-evident audit trails, logging, and regular testing, as described on our Security and Compliance page. No method is fully secure. If a personal data breach occurs, we will notify affected customers and authorities as required by applicable law.

9. Your Privacy Rights

India (DPDP Act, 2023): Depending on how the law applies to you, you may have rights to access information about your personal data, request correction, completion, updating, or erasure, withdraw consent where applicable, nominate another individual to exercise your rights in the event of death or incapacity, and seek grievance redressal.

United States (CCPA and other applicable state privacy laws): Depending on your state and whether the applicable law applies to us, you may have rights to know and access the personal information we collect, request deletion or correction, opt out of the sale or sharing of personal information where applicable, limit certain uses of sensitive personal information, and exercise these rights without unlawful discrimination. Where permitted by law, you may also use an authorized agent to submit a request.

Other regions: If GDPR or another applicable privacy law applies to you, you may have additional rights, including data portability, restriction of processing, and objection to certain processing activities, as well as the right to lodge a complaint with the relevant supervisory authority.

How to exercise your rights

To exercise your applicable privacy rights, email us at support@esigns.io. We may need to verify your identity before processing your request. If your personal data is contained in documents submitted or managed by one of our Customers, we may direct your request to the applicable Customer. We will respond within the timeframe required by applicable law.

Marketing opt-out

You may opt out of marketing communications by using the unsubscribe link in our emails or by contacting us.

10. Children's Data

The Services are intended for adults and are not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child's data has been provided to us, contact support@esigns.io, and we will take steps to delete it.

11. Third-Party Links and Services

Our Services may link to or integrate with third-party sites and tools. Their privacy practices are governed by their own policies.

12. Automated Processing and AI

Some features use automated processing or AI to extract, classify, or summarize content. Outputs are assistive and should be reviewed by a human. [We do not make decisions with legal or similarly significant effects on individuals solely through automated processing.]

13. Changes to This Policy

We may update this Policy from time to time. We will post the new version with an updated date and notify you of material changes by email or in-app notice.

14. Contact and Grievance Redressal

Data Protection / Privacy Contact

eSigns Team, eSigns
Email: support@esigns.io
Address: 200 Motor Pkwy, Hauppauge, NY 11788, United States

US Privacy Requests

Email: support@esigns.io | Contact number: +1 302 273 0009 (USA)