Privacy Policy

We collect data you provide directly, data generated by your use of the service, and a limited amount of data from third parties you connect.

• Account data — name, email address, and authentication identifiers
• Workspace content — agreements, terms, comments, and attachments you create
• Signing metadata — timestamps, IP address, user agent, and verification events recorded in the audit trail
• Usage data — feature interactions, device and browser information, and diagnostic logs
• Integration data — the identifiers and content an integration you enable requires

We use personal data to operate and secure the service, and for nothing that would surprise you. AI-assisted features read workspace content only within the permissions of the person or agent using them, and their actions are recorded in the audit trail like any other participant. We do not train models on your workspace content.

• Provide, maintain, and improve the service and its features
• Record signatures and maintain the integrity of audit trails
• Send transactional messages — invitations, signature requests, receipts
• Detect, investigate, and prevent abuse and security incidents
• Comply with legal obligations

We do not sell personal data. We share it only with the parties below, and only to the extent needed to run the service.

• Workspace participants — the people and agents in the agreements you join
• Subprocessors — vetted vendors for hosting, email delivery, and support tooling
• Integrations you enable — under that integration's own terms
• Authorities — when legally required, with notice to you where permitted

Workspace content is retained while your workspace is active. Executed agreements and their audit trails remain exportable for ninety days after workspace deletion, after which they are permanently removed from our systems.

Diagnostic logs are retained for a shorter operational window and then deleted or anonymized.

We use strictly necessary cookies for authentication and session integrity, and a privacy-respecting analytics tool that does not track you across other sites. There is no third-party advertising on the service.

All data is encrypted in transit and at rest. Access within AllSign follows least-privilege, is logged, and is reviewed regularly. Audit trails are append-only — nobody, including us, can quietly edit a record.

Depending on your jurisdiction — including under the GDPR and CCPA — you may have the right to:

• Access a copy of the personal data we hold about you
• Correct inaccurate data or complete incomplete data
• Delete your data, subject to the retention rules above
• Export your data in a portable format
• Object to or restrict certain processing

The service is hosted in regional data centers. Where data crosses borders, transfers rely on recognized safeguards such as standard contractual clauses. Self-hosted deployments keep all data within infrastructure you control.

The service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy from time to time. Material changes will be announced in the service or by email at least thirty days before they take effect, and every version is kept available — like any other record worth keeping.

Questions, requests, or concerns about your data? Write to privacy@allsign.app and a person will answer.

This policy is governed by the laws of the jurisdiction in which AllSign operates. Disputes arising from this policy are subject to the exclusive jurisdiction of the courts in that jurisdiction.