Privacy Policy

1. What We Collect

1.0 Legal Basis for Processing Your Data

Privacy laws say we need a good reason before we use your data. Here's the short version: we only use your data to run the service you asked for, keep things secure, and follow the law. The table below shows our specific reason for each type of data.

You can take back your "yes" anytime for newsletters and clause sharing. Just change your settings. Taking it back doesn't undo anything that already happened.

1.1 Your Contracts (Here and Gone)

When you upload a contract:

• We read it — Our AI extracts text and analyzes document structure
• We analyze it in real-time — Processing begins within seconds of upload
• We delete it within 60 seconds — Once we finish your analysis, we erase your document. We never save it to permanent storage. It only exists in temporary memory while we work on it.

Technical detail: Your document only lives in temporary memory (RAM) while we work on it. We never save it to a hard drive, database, or backup. Once the analysis is done and we send you the results, we clear the memory.

Lost your contract? We cannot retrieve it. This is by design.

1.2 Your Account Info

If you make an account, we keep:

• Your email (so we can contact you)
• Your name (only if you give it to us—it's optional)
• Your password (encrypted—even we can't read it)
• Whether you're subscribed to Pro

1.3 Your Preferences

You can tell us about yourself to get better results:

• Who you are — Are you a senior? A creator? This helps us explain risks in ways that matter to you
• Where you live — Your state, so we can point out laws that protect you

We save these with your scans to make future analyses even better. We never share them.

1.4 Newsletter Sign-up

If you join our "Weekly WTF" newsletter, we collect:

• Your email (to send the newsletter)
• Where you signed up (so we know what's working)
• Whether you want to contribute anonymous data (totally optional)

Don't want it anymore? Every email has an unsubscribe link. One click and you're out.

1.5 How You Use the App

We track anonymous stuff like:

• How many scans you do
• What types of contracts ("car loan", "gym") — NOT what's in them
• How fast the app runs
• Which features you use

This helps us make SignSafe better. We can't tie this back to you personally.

1.6 About Your Device

Basic stuff:

• What kind of phone/computer you're using
• Which version of the app you have
• Your general location (country or region—NOT your address)

2. What We Do With Your Info

Here's a clear breakdown of every type of data we touch, why we need it, and when we get rid of it.

2.1 Backups and Redundancy

Documents: We never back up your uploaded contracts because we never save them to permanent storage. There's nothing to back up.

Account data: We include your account info in encrypted backups. We keep backups on the same schedule as live data. When you delete your account, we remove your data from active systems right away and from backups within 30 days.

3. What We DON'T Collect

4. Who We Share Data With

4.1 AI Processing Partners

When you upload a contract, we send the text to AI services that help us analyze it. These partners are bound by strict contracts:

• They read the text and send back analysis results
• They delete the data right after processing — no permanent storage
• Our contracts ban them from using your data to train AI models
• All data is encrypted while it travels using TLS 1.3

Service Providers (Companies That Help Us Run SignSafe)

We use other companies to help run parts of SignSafe. Each one:

• Only does what we tell them to do with your data
• Has signed contracts that require them to keep your data private
• Cannot use your data for their own purposes
• Must delete or return your data when we ask

Full service provider list: For a complete list of named vendors and their specific data processing roles, email privacy@sign-safe.app with subject "Subprocessor List Request".

4.1.1 Where Your Data Goes

Your data may travel to:

• United States — where our main servers and AI partners are
• European Union — backup servers for EU users

How We Protect Cross-Border Transfers

If you're in the EU/EEA or UK and your data goes to the United States, we use these protections:

Want copies of these contracts? Email legal@sign-safe.app with subject "Transfer Safeguards Request."

4.1.2 How Our AI Makes Decisions (GDPR Art. 22)

SignSafe uses AI to analyze contracts. Here's exactly what it does and doesn't do:

What Our AI Does

• Reads contract text — Extracts and processes the words in your document
• Identifies clauses — Spots common contract sections (like arbitration, liability limits, and cancellation terms)
• Flags risks — Points out language that may be bad for you
• Explains things — Turns legal language into plain English

What Our AI Does NOT Do

• Does NOT make legal decisions — What we tell you is for information only, not legal advice
• Does NOT approve or deny anything — We don't decide if you get a job, a loan, housing, insurance, or anything else that affects your life
• Does NOT create profiles — We don't build profiles about you or make predictions about you as a person
• Does NOT share findings — Your analysis results are never sent to anyone else

Your Rights Regarding AI Processing

Response time: Human review requests are processed within 5 business days.

4.2 No Sale of Personal Data

We do not sell, rent, or trade your personal data.

California law defines "selling" data broadly — it includes sharing data for money or anything else of value. We don't do any of that. We use your data only to give you the service you asked for.

4.3 Legal Disclosure

We may share your info when the law says we must — like if we get a court order or a valid government request. But since we don't keep your contract documents after processing, we can't hand over documents that no longer exist.

5. How We Keep Your Data Safe

We use the same security tech that banks use:

• Encrypted in transit — When data travels between your device and us, it's locked with TLS 1.3 (the newest, strongest encryption)
• Encrypted at rest — Anything we do store (like your account) is protected with AES-256 encryption
• Limited access — Only a few people at SignSafe can access data, and only when they really need to
• Regular checkups — We test our security often to find and fix any weak spots

5.1 Data Breach Response

If someone gets unauthorized access to your data, here's what we do and how fast we do it.

How Fast We Act

What We Will Tell You

If your data is affected, we'll tell you:

• What happened: What went wrong and when
• What data was involved: Which types of info may have been affected
• What we're doing about it: Steps we've taken or will take to fix things
• What you can do: Actions you can take to protect yourself
• How to reach us: Contact info so you can ask questions

Steps You Can Take

If we tell you about a breach, here's what you should do:

• Change your SignSafe password immediately
• Change passwords on any other accounts where you used the same password
• Monitor your accounts for unusual activity
• Consider placing a fraud alert with credit bureaus if financial info was involved

Why the Risk Is Limited

We don't store your contract documents — they're deleted within 60 seconds. So even in a breach, your contracts can't be stolen. They don't exist on our systems after we process them. The most that could be exposed is account info like your email.

5.2 Audits & Insurance

We regularly test our own security. We also carry insurance in case something goes wrong. If your company uses SignSafe and wants to see our security docs, just email enterprise@sign-safe.app.

5.5 Cookies and Tracking Technologies

Cookies are small files saved on your device. We use them to run SignSafe. Here's exactly what we use and how you control it.

Cookie Categories

We do not use: Advertising cookies, cross-site tracking cookies, or third-party marketing cookies.

Consent Mechanism

Web (sign-safe.app)

• First visit: A consent banner appears with two options: "Accept All" or "Essential Only"
• Essential Only: Analytics cookies are not set until you change your preference
• Accept All: Analytics cookies are enabled
• Change later: Click "Cookie Settings" in the footer, or visit the Privacy Portal

Mobile App

• First launch: A consent prompt appears during onboarding
• Change later: Go to Settings > Privacy > Analytics Preferences
• Phone settings: We also follow iOS "Ask App Not to Track" and Android "Opt out of Ads Personalization" settings

Managing Your Preferences

Note: Blocking strictly necessary cookies will prevent login and core functionality from working.

5.6 The Weekly WTF Newsletter

Every week, we send out "The Weekly WTF"—a newsletter about the craziest contract clauses we've seen. Here's how it works without exposing anyone:

When You Sign Up

We keep:

• Your email (to send the newsletter, obviously)
• Whether you confirmed your email
• A special code so you can unsubscribe with one click
• Where you signed up (just for our records)

Want out? Every email has an unsubscribe link. Click it and you're done. No tricks.

Contributing Clause Data (Optional)

You can help us find bad clauses by sharing anonymous data from your scans. If you turn this on, we might use:

• Types of risky clauses (like "arbitration clause")
• Industry type (like "gym" or "streaming service")—NOT company names
• How risky each clause is
• Quotes with all personal info removed

What We NEVER Put in the Newsletter

• Your name, email, or account info
• Real company names
• Exact dollar amounts or dates
• Your location (beyond country)
• Anything that could identify you or your contracts

You're Always in Control

• Off by default — You have to turn on clause sharing. It's not automatic.
• Stop anytime — Change your mind? Just turn it off in settings.
• Newsletter is separate — You can get the newsletter without sharing data, or share data without getting the newsletter.
• No penalties — Opting out doesn't affect your SignSafe access.

What's in the Newsletter

Every week you'll see:

• WTF of the Week — The worst clause we found
• Industry trends — Which industries have the worst contracts
• Stats — Data about risky clause types
• Explanations — Why certain clauses are bad for you

It's educational and (we hope) entertaining. Nobody's private info ever gets exposed.

6. Your Privacy Rights

6.1 See Your Data

Want to know what we have on you? Visit our Privacy Portal and download everything in one click. You'll get a file with all your account info.

6.2 Delete Everything

Want to leave? Delete your account through the Privacy Portal or in the app settings:

• You have 30 days to change your mind
• After 30 days, everything is permanently gone
• No tricks, no "are you sure?" gauntlets

6.3 Turn Off Tracking

Don't want us collecting anonymous usage stats? Turn it off in the Privacy Portal or app settings. Easy.

6.4 California Residents (CCPA 2026)

What You Can Do

If you live in California, you have these rights:

What Info Do We Actually Collect?

California law says we have to list every type of data we gather. Here's the full picture:

What Counts as "Sensitive" Info?

California law has a list of extra-protected data. Here's what we DON'T collect:

• ❌ Brain data — We're not in your head
• ❌ Kids' data — You must be 18+ to use SignSafe
• ❌ Social Security numbers — Nope
• ❌ Bank account info — We don't store that
• ❌ Your exact location — Just country/region
• ❌ Race or ethnicity — We don't ask
• ⚠️ Health info — Might be in your contracts, but we delete it immediately

About Our AI

Want to know more about our AI? You can:

• Ask us how it works (email us!)
• Get a human to review any analysis (just ask)
• Opt out of AI analysis (we'll find another way to help)

No Sneaky Tricks

California banned "dark patterns"—that's when companies use sneaky design to trick you. We promise:

• ✅ Opting out is just as easy as opting in
• ✅ No giant "YES" buttons next to tiny "no" links
• ✅ Closing a popup doesn't mean you agreed to anything
• ✅ No guilt trips or "Are you SURE you don't want privacy?"
• ✅ No fake countdown timers
• ✅ Everything is written in plain English

Your Browser Can Talk to Us

If your browser sends privacy signals, we listen:

• Global Privacy Control (GPC) — If your browser sends this, we automatically opt you out
• Do Not Track (DNT) — We respect this too
• Confirmation — When you opt out, we'll confirm within 15 business days

How Fast Do We Respond?

• We'll say we got it: Within 10 business days
• We'll finish the job: Within 45 days (sometimes 90 for complicated stuff)
• We'll make sure it's you: We verify identity before giving out data

Someone Else Doing It For You?

Want to send someone else to handle your privacy request? They can, but they need:

• Your written permission
• To prove who they are
• To email privacy@sign-safe.app with the paperwork

We Don't Pay You For Your Data

Some companies offer discounts if you give up privacy. We don't do that. Your data isn't for sale—period.

"Shine the Light" Law

California also has another law letting you ask if we share data with marketers. We don't. End of story.

How to Use Your California Rights

• Easy way: Privacy Portal — instant, no waiting
• Email: privacy@sign-safe.app
• Speed: Usually under a week. Max 45 days by law.

6.5 European Residents (GDPR)

If you're in Europe (EU or EEA), you have these rights:

• See your data — Get a copy of everything we have on you
• Fix mistakes — Tell us to correct wrong info
• Be forgotten — Ask us to delete everything
• Limit what we do — Tell us to stop using your data in certain ways
• Take your data with you — Download it in a format other services can read
• Say no — Object to how we use your data
• Change your mind — Take back any permission you gave us
• File a complaint — Report us to your country's privacy agency

We respond within 30 days. Email privacy@sign-safe.app.

Our EU Contact

European users can contact our EU representative:

• Email: eu-representative@sign-safe.app
• Address: Email privacy@sign-safe.app to request

Our Data Protection Officer

Got data protection questions?

• Email: dpo@sign-safe.app
• Response: Within 5 business days

Want to Complain?

You can report us to your country's privacy authority. Find yours at the EDPB Members Directory. Common ones:

• Ireland: dataprotection.ie
• Germany: Your regional Datenschutzbehörde
• France: cnil.fr
• Netherlands: autoriteitpersoonsgegevens.nl

6.6 UK Residents

The UK has its own privacy law (UK GDPR). You have the same rights as EU residents listed above. Email privacy@sign-safe.app.

6.7-6.20 Other U.S. States With Privacy Laws

Many states now have their own privacy laws. If you live in one of these states, you have extra rights:

• Virginia, Colorado, Connecticut, Utah — Privacy laws since 2023
• Texas, Oregon, Montana — Privacy laws since 2024
• Delaware, Iowa, New Jersey, New Hampshire, Tennessee — Privacy laws since 2025
• Indiana — Privacy law starting 2026

In all these states, you can:

• ✅ See what data we have
• ✅ Fix wrong info
• ✅ Delete your data
• ✅ Download your data
• ✅ Opt out of targeted ads (we don't do targeted ads, but still!)
• ✅ Opt out of data sales (we don't sell data anyway)

We also follow Global Privacy Control (GPC) signals. If your browser sends one, we automatically do what it says.

To use your rights: Email privacy@sign-safe.app with "Privacy Rights Request" and tell us your state. We usually respond within a week — 45 days max by law.

7. Age Requirements

7.1 Minimum Age by Region

SignSafe is built for adults who need to review contracts. How old you need to be depends on where you live:

7.2 How We Check Your Age

• When you sign up: You must confirm you're old enough
• Payment: Having a credit card is another sign you're an adult
• If we have concerns: If we think an account holder might be underage, we pause the account until we can confirm

7.3 Children's Privacy (COPPA — United States)

We follow the Children's Online Privacy Protection Act (COPPA). We never knowingly collect info from children under 13 in the United States.

Think a child under 13 made an account?

• Email privacy@sign-safe.app immediately
• Include the account email or username if known
• We'll delete all their data within 24 hours once we confirm

7.4 EU Parental Consent (Ages 13–15)

In the EU/EEA, users ages 13–15 need a parent's permission to use SignSafe.

• If we find out someone in this age group signed up without a parent's OK, we pause the account.
• We then email the address on file to ask a parent to verify.

7.5 Special Types of Data

Some contracts have extra-sensitive information. Here's what you should know:

7.5.1 Medical Contracts (HIPAA)

Good news: We delete everything right away, so any health info is gone right after analysis.

7.5.2 Financial Contracts

Got contracts with financial info?

• We analyze it but don't store it
• We don't share financial info with anyone
• If you can, remove account numbers and SSNs before uploading

7.5.3 Biometric Data (Illinois BIPA)

We don't touch biometric data:

• ❌ No facial recognition
• ❌ No fingerprints
• ❌ No voice analysis
• ❌ No eye scans

We just read text. That's it. Illinois residents: you're covered.

7.5.4 Lawyer-Client Privilege

8. Links to External Sites

SignSafe may have links to other websites. When you click a link that takes you away from SignSafe, our privacy policy no longer covers you. Check the other site's privacy policy before sharing your info.

9. Changes to This Policy

We may update this policy when our practices change or the law requires it. When we do:

• The updated policy will be posted at this URL
• The "Last Updated" date at the top will be revised
• For material changes, we will notify you by email
• We may display a notice within the app

Big changes that affect your rights: If we start collecting more data or limit your rights, we'll warn you 30 days before the change kicks in. Don't like the change? You can delete your account before it takes effect.

10. Our Commitments

These are real promises backed by this contract — not just nice words:

Cancellation & Refunds

We don't trap you:

• Cancel anytime — No fees, no penalties, one click
• 14-day refund — Changed your mind? Full refund, no questions asked
• After 14 days — You still get back the unused portion
• We warn you before renewal — Email reminder 7 days before we charge you

If Something Goes Wrong

Most companies limit what they owe you to $0. We think that's wrong.

• Our limit: What you paid us in the last 12 months, OR $100 — whichever is more
• No limit: If we mess up your security, act really badly, or break privacy laws
• Fair: You're only on the hook for your own mistakes, not ours

This policy has been reviewed using SignSafe's own analysis tools.

If We Disagree

• Sue us where you live — Or in Delaware. Your choice.
• Small claims court — Always an option
• Class actions — Totally allowed
• Talk first — Let's try to work it out for 30 days before going to court

11. Contact Information

Have questions about this policy or want to use your privacy rights? Here's how to reach us:

• Privacy questions: privacy@sign-safe.app
• Data protection officer: dpo@sign-safe.app
• Legal/compliance: legal@sign-safe.app
• How fast we respond: We'll confirm we got your message within 5 business days. Full response within 30 days (45 days if it's complicated)

Version History

Complete history of changes to this policy:

• v5.0 (Feb 4, 2026): GDPR Art. 22 Better AI explanations, added legal basis table, clearer data timelines, cross-border protections, age rules, service provider details, cookie controls, and breach notification steps
• v4.0 (Jan 21, 2026): CCPA 2026 California's new privacy law compliance
• v3.0 (Jan 13, 2026): Enterprise features, more state laws, HIPAA/BIPA awareness
• v2.2 (Jan 12, 2026): Added TL;DR summary, refund rights, liability cap
• v2.1 (Jan 12, 2026): Newsletter privacy details
• v2.0 (Jan 9, 2026): Major GDPR/CCPA update
• v1.0 (Dec 2025): First version