Zásady ochrany osobních údajů

This Policy explains how SignSpry ("we", "us") collects, uses, and protects personal data when you use our website and services. It is published in accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 ("DPDP Act"). By using SignSpry you consent to the processing described here.

1. Data we collect

• Account data — name, email address, password (stored only as a salted scrypt hash), organisation details, and optional two-factor secrets.
• Documents & envelope data — files you upload or create, field values, recipient names and email addresses, comments, and attachments signers provide.
• Signing evidence — signer IP address, device/browser user-agent, timestamps, consent records, and payment references where a payment field is used. This is collected because it is what makes an electronic signature evidentially strong.
• Usage & technical data — server logs (IP, request path, time) kept for security and debugging.
• Billing data — plan, invoices, GSTIN. Card/UPI details are processed by our payment providers and never stored by us.

2. How we use it

We process personal data to provide the Service (creating, delivering, and sealing envelopes; generating on-server AI summaries; sending transactional email), to secure it (fraud and abuse prevention, rate limiting, audit trails), to bill you, to support you, and to meet legal obligations. We do not sell personal data, serve ads, or use your documents to train machine-learning models.

3. Legal basis & consent

We process data with your consent (given at signup and when signers tick the signing consent box) and for legitimate uses recognised by the DPDP Act, such as performing the contract you have with us and complying with law. Signers are shown a clear consent notice — in their chosen language — before signing.

4. Where your data lives

Production data is stored on Amazon Web Services in the Mumbai region (ap-south-1), India. Encrypted backups are stored in the same region. Data is encrypted in transit (TLS) and backups are encrypted at rest (AES-256).

5. Sharing

We share data only with: (a) envelope participants, as inherent to the Service (your recipients see the document and each other's signing status; the audit trail is shared with envelope parties); (b) processors we rely on to run the Service — cloud hosting (AWS), email delivery, and payment gateways — bound by contract to protect it; (c) integrations you connect, such as your Slack or Teams workspace or your webhook endpoints; and (d) authorities where required by law, after verifying the demand's validity.

6. Retention

Account data is kept while your account is active. Envelope documents are kept until you delete them or your organisation's retention policy purges them; when documents are purged we preserve envelope metadata and the audit trail so evidence of execution survives. Server logs are retained for up to 180 days. An organisation's admin can delete the organisation from Privacy & data in the app: there is a 30-day grace period during which the request can be cancelled and a full export taken, after which every person, envelope, document, audit trail and setting is permanently deleted — within the 90 days of closure this policy commits to. Billing records are retained as tax law requires; nothing else remains.

7. Your rights

Under the DPDP Act you may access, correct, and request erasure of your personal data, withdraw consent, nominate a representative, and raise grievances. Access and portability are self-service: an admin can download a complete export of the organisation's data — every envelope with its signed PDF and audit trail, as JSON, CSV and PDF — from Privacy & data at any time, and erasure is the deletion described in section 6. For anything else write to support@signspry.com; we verify identity before acting and respond within statutory timelines. Note that erasure cannot extend to completed signed documents held by other parties to your agreements, or to audit evidence we must preserve for their integrity.

8. Cookies

We use only essential cookies: a session cookie to keep you signed in and short-lived preferences such as a signer's chosen language. We do not use advertising or cross-site tracking cookies, so no cookie banner theatre is needed.

9. Children

The Service is not directed at children under 18, and account holders must be capable of contracting under the Indian Contract Act, 1872.

10. Security

We maintain technical and organisational safeguards: TLS everywhere, salted scrypt password hashing, optional TOTP two-factor authentication, login throttling and lockouts, strict security headers, principle-of-least-privilege access, hash-chained audit logs, and encrypted nightly off-site backups. If a personal data breach occurs we will notify the Data Protection Board of India and affected users as required by the DPDP Act.

11. Changes

We may update this Policy; material changes will be notified by email or in-app. The "Last updated" date always reflects the current version.

12. Contact

Grievance Officer — Manu Shekhar
Email: manu@signspry.com (subject "Soukromí")
Telephone: +91 94980 23023

Operated by
Manu Shekhar

Acknowledgement within 48 hours; resolution target 15 days.