Privacy policy

Effective September 23, 2026. Last updated September 23, 2026.

This policy explains what happens to your information when you review or sign a document with Paradoc Sign. Paradoc Sign is operated by Paradoc AI, Inc., a Delaware corporation ("Paradoc", "we", "us").

Who is responsible for your information

A document reaches you because a person or business (the "sender") sent it to you through Paradoc. The sender decides what the document contains, who signs it, and what information it asks for.

For the document and the information you enter in it, the sender is the controller and we are its processor. We handle that information on the sender's behalf and on its instructions.

We are the controller for the information we use to run and protect Paradoc Sign itself: security logs, fraud prevention, and the integrity of the audit trail.

If you have a question about the document itself, contact the sender. If you did not expect the document, ask the sender where they got your details.

Information we collect

When the sender adds you as a signer, they give us:

• Your name and email address
• The documents you are asked to review and sign

When you use Paradoc Sign, we collect:

• The information you enter into the document's fields
• The signature and initials you adopt, stored as images
• Your consent to sign electronically
• Your IP address, browser type, and device information
• The times you open, view, sign, or decline a document, and the reason you give for declining
• The one-time codes we send to verify your identity, which expire after 10 minutes

A document can contain sensitive information, such as health or financial details. The sender decides what the document asks for.

Your signature is saved as a picture. We do not record how you write it, such as pen speed or pressure, and we do not use it to identify you.

How we use your information

We use your information to:

• Deliver the document to you and confirm your identity
• Record your signature and complete the document
• Keep a tamper-evident audit trail that shows who signed, when, and from where
• Send you the completed document and signing notices
• Detect and prevent fraud and abuse

We do not sell your information. We do not share it for advertising, and we do not use it for advertising.

We do not make decisions about you by automated means that have legal or similarly significant effects.

Legal basis

When we act for the sender, the sender chooses the legal basis. For our own processing:

• Running and securing Paradoc Sign, and preventing fraud: our legitimate interest in a safe service.
• Keeping the audit trail intact: our legitimate interest, and the sender's, in a signature that can be proven. Where a law requires it, a legal obligation.
• Sending verification codes and signing notices: needed to provide the signing you asked for.

You do not have to give us your information. Without it, you cannot sign through Paradoc Sign.

The audit trail

Each signing action is recorded in an audit trail. Each entry is linked to the one before it, so any later change to the record can be detected. The audit trail can include your name, email address, IP address, browser details, and the time of each action. The sender and every signer of the document receive a completion certificate drawn from it. It exists so that the signed document can be relied on.

Who we share information with

• The sender receives the completed document, the information you entered, and the audit trail.
• Other signers of the same document receive the completed document and its completion certificate. The certificate shows each signer's name, email address, signing time, and IP address.
• Service providers host our systems and store data (Cloudflare, Fly.io, PlanetScale, Upstash) and process payments (Stripe). We send email ourselves, through Cloudflare. Providers act on our instructions only.
• Authorities, when the law requires it.

If the sender asks for a payment, Stripe handles your card details under its own privacy policy. We do not store full card numbers.

Cookies

Paradoc Sign sets one cookie for each document you open. It keeps your signing session open. It lasts up to 24 hours and is removed when you finish or decline. It is strictly necessary, so we do not ask for consent. We do not use advertising or analytics cookies. If you pay, the payment processor may set its own cookies.

How long we keep information

We keep signed documents, their audit trails, and completion certificates for as long as the sender's account keeps them, or longer when the law requires it. When the sender asks us to delete them, or closes their account, we delete them unless the law requires us to keep them.

Verification codes are stored only in scrambled form. They stop working after 10 minutes. Signing sessions end after 24 hours at most.

Your rights

Depending on where you live, you can ask to access, correct, delete, restrict, or receive a portable copy of your information. You can also object to how we use it. Where we rely on your consent, you can withdraw it at any time. This does not affect what happened before. You can complain to the data protection authority where you live. In the UK, that is the Information Commissioner's Office.

For information in a document, ask the sender first. The sender controls that document. For anything else, email privacy@paradoc.dev. We confirm your identity by checking that you control the email address the document was sent to. We reply within one month, or within 45 days where US state law allows it.

A signed document and its audit trail may need to stay unchanged so that the agreement remains valid. In that case we may not be able to delete or change them.

California and other US states

In the last 12 months we collected these categories of personal information: identifiers (name, email address, IP address), internet activity (browser and device details, signing events), and the information you enter in documents. We got it from you and from the sender. We use it for the purposes in this policy.

We do not sell or share your personal information for cross-context behavioral advertising. We do not use sensitive personal information to infer things about you.

You can ask to know, delete, or correct your personal information. We will not treat you differently for using these rights. An authorized agent can ask for you with your written permission. If we refuse your request, you can appeal by replying to our decision. Email privacy@paradoc.dev.

Children

Paradoc Sign is not meant for anyone under 18. We do not knowingly collect information from children.

Security

We send all information over encrypted connections. Each signing link is unique to you. Senders can also require an email code or an access code before you can open a document.

If a breach affects your information, we will tell the sender and, where the law requires it, you and the authorities.

If you think someone else has your signing link, contact the sender.

International transfers

We store and process your information in the United States. For transfers from the EU, the UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum. You can ask us for a copy of these safeguards.

Changes to this policy

When we change this policy, we post the new version on this page with the date it takes effect.

Contact

Paradoc AI, Inc. Email privacy@paradoc.dev with any question about this policy.