Privacy

Controller

The controller for processing on signhere.me is:

Privacy requests: info@signhere.me

What we store

The uploaded PDF, the signed PDF, timestamps, a hashed IP address and the signer's browser string. The IP address is only stored as a hash and cannot be reversed. For named signers we also store name, email address and, if the sender provided it, the mobile number so we can deliver the link (Art. 6(1)(b) GDPR).

How long we store it

Without an account: unsigned documents are deleted 7 days after upload, signed ones after 24 hours. Documents with an ID copy are always deleted after 7 days. With an account, signed documents are kept for 6 months so contracts stay provable; longer periods only by agreement (Enterprise). Senders can delete any document themselves at any time.

Your email address as the sender

The email address you enter when uploading is needed to deliver the signed PDF and the link to your status page (Art. 6(1)(b) GDPR). We also keep it in a contact list together with your language, the dates of your first and last upload and the number of uploads, so we can answer questions about your documents and detect abuse (Art. 6(1)(f) GDPR). This list persists beyond the retention period of the documents; deletion on request at any time.

News by email (newsletter)

Only if you tick the separate "news by email" box yourself when uploading do we also use your address for occasional information about signhere, such as new features or offers for businesses (Art. 6(1)(a) GDPR and the national rules on electronic marketing, such as section 7 UWG in Germany, section 174 TKG 2021 in Austria and Art. 3(1)(o) UWG in Switzerland). The box is not pre-ticked and is not needed to use signhere. We store the time of your consent, a hashed IP address and the browser identifier as proof. Every mail contains an unsubscribe link that works immediately. We do not use consents from before 2 November 2026, when the box was still pre-ticked.

Accounts

For an account we store name, email address, optionally a company name, language, plan, notification settings and, if you save one, your stored signature. You can sign in with a password, a sign-in link, a passkey or via Google or Apple; from Google and Apple we only receive name and email address. Passwords are stored hashed only, as is the second-factor secret (authenticator app or email code). Sessions store IP address and browser string so you can see and end them in your account. The legal basis is the contract for your account (Art. 6(1)(b) GDPR). You can delete your account with all its data yourself at any time.

Teams, customers and templates

Business accounts can create a team; members see the team's documents, customers and email templates. Data you enter about your customers (name, contact details, second person, notes) is processed solely on your behalf: you are the controller, we are the processor under Art. 28 GDPR. The data processing agreement is linked as "DPA" in the footer.

Invitations by email

Invitations, reminders and the finished PDF are sent by email through Resend. Signers only receive messages about the document concerned, never advertising. No text messages are sent at the moment.

Notifications and webhooks

Account holders can be informed by email about opened, signed or declined documents, receive a daily summary, or store a Slack or Microsoft Teams webhook address. We then send file name, event, the signer's name and the status link to that address; the respective provider's terms apply to its reception there.

Payments

There are no paid plans at the moment. Should we introduce them, Stripe will handle payments. Stripe then receives name, email address and payment details; we only store the Stripe customer id, the plan and its term. Stripe never sees documents.

ID copies

ID photos are cropped in the browser and only stored as part of the finished PDF. Individual ID photos are never stored separately. We strongly recommend adding the purpose watermark.

Ads

We show Google AdSense ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) on the landing page and the template and guide pages; anyone signed in to an account sees no ads. We ask for your consent through Google's consent message, which is certified under IAB Europe's Transparency and Consent Framework (TCF) (Art. 6(1)(a) GDPR and the applicable national rules on cookies). Without consent Google sets no cookies for personalised advertising; at most limited, non-personalised ads may appear. You can change or withdraw your choice at any time via the "Privacy and cookie settings" link. Data may be transferred to Google in the USA; Google is certified under the EU-US Data Privacy Framework. Signing and status pages carry neither ads nor ad scripts, because their address contains a secret link.

Traffic statistics

We count page views without cookies and without profiles: page, language, referring site, country, device type and a daily-rotating, irreversible hash to tell visitors apart. IP address and browser identifier are not stored. Vercel Web Analytics, also cookie-free, additionally records aggregate view counts. This data is deleted after 90 days.

Hosting and processors

signhere runs on Vercel Inc. (application and file storage) with a database at Neon. The servers are currently in the USA (Washington, D.C. region). The transfer there is covered by the EU-US Data Privacy Framework (Vercel is certified) and EU standard contractual clauses (Art. 45 and 46 GDPR); for people in Switzerland by the Swiss-U.S. Data Privacy Framework or standard contractual clauses (Art. 16 FADP). Further providers: Resend (email delivery, USA), Sentry (technical error reports without document content, stored in the EU), Cloudflare Turnstile (bot protection), Upstash (rate limits), Google (ads, see above) and Anthropic (see below). Data processing agreements are in place with all of them. The full list with purpose and location is in our DPA.

Your rights

You can delete your document at any time from your status page or your account. It is gone immediately. You also have the right of access, rectification, erasure, restriction, data portability and objection; write to the contact address above. You end the newsletter via the unsubscribe link. Complaints can be lodged with any data protection authority, for example the Estonian authority responsible for us (Andmekaitse Inspektsioon), the Austrian Data Protection Authority, the authority of your German state or, in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).

Reports of illegal content

If you report content through the report form (Art. 16 Digital Services Act), we store your details: link, reason, explanation and, if given, name and email address, plus a hashed IP address against misuse of the form. The legal basis is Art. 6(1)(c) GDPR together with the DSA. If a document is removed, we inform the person who uploaded it of the decision and its reasons, but not of the name or address of the person who reported it. Reports are deleted after three years.

Operations and abuse checks

To keep the service running and to check for abuse (such as phishing or fraud through signhere) the operator may inspect uploaded documents (Art. 6(1)(f) GDPR). For documents uploaded without an account, the operator has an AI service (Anthropic PBC, USA) summarise the PDF in one sentence; the summary is meant to contain no personal data and is deleted with the document. Anthropic does not train on the content and deletes it after a short period; the transfer is covered by EU standard contractual clauses. Documents from accounts are not passed to the AI service automatically, only individually when there is a concrete suspicion of abuse or a report. There are no automated decisions: whether a document is removed is always decided by a person.