US state privacy notice

This notice supplements our Privacy Policy for residents of US states with comprehensive consumer privacy laws, including the California Consumer Privacy Act as amended by the CPRA, and the laws of Colorado, Connecticut, Virginia, Utah, Texas, Oregon and the other states that have adopted similar laws. Some of these laws apply only to businesses above certain size thresholds; SignSpry offers the rights described here to every US resident whether or not a particular law applies to it.

1. Documents you receive or sign

When an organisation sends you a document to sign through SignSpry, that organisation decides what personal information the envelope contains and why. For that information SignSpry is the organisation's service provider (or processor) and processes it only on its instructions. Please send requests about those documents to the organisation that sent them; if you write to us, we will forward your request to them.

2. Personal information we collect

In the past 12 months we have collected the following categories of personal information about our customers' users and visitors to our website:

• Identifiers — name, email address, phone number, account ID, IP address. Source: you and your organisation. Purpose: providing and securing the Service.
• Customer records — billing name and address, tax ID, signatures and initials you create. Source: you. Purpose: billing, tax compliance, providing the Service.
• Commercial information — plan, purchases and payment references (card details are handled by our payment processor, not by us). Purpose: billing.
• Internet or other network activity — pages and features used, security and audit logs, and, with the cookie choices described below, website analytics and ad measurement. Purpose: security, improving the Service, measuring our advertising.
• Approximate location — country or region inferred from your IP address or browser time zone. We do not collect precise geolocation.
• Professional information — organisation name and job title, where you provide them.
• Sensitive personal information — only account login credentials (your password is stored as a salted hash). We use it only to provide and secure the Service and do not use sensitive personal information to infer characteristics about you.

We keep each category for as long as your account is open and then for the periods described in the Privacy Policy, except where the law requires longer retention (for example tax records).

3. Who receives it

We disclose personal information for business purposes to our service providers — cloud hosting and email delivery, payment processing, and an RFC 3161 timestamp authority — and to the participants of envelopes you send or sign, as the Service requires. We do not sell personal information for money.

4. Sale and sharing for advertising

Our website can use Google Ads measurement cookies to tell whether a visit that came from one of our ads led to a sign-up. Under some state laws this can count as "sharing" personal information for cross-context behavioural advertising, or as "targeted advertising" or a "sale". You can opt out at any time on Your privacy choices; when you are signed in, the choice applies to your account on every device. We do not knowingly sell or share the personal information of anyone under 16, and the Service is not directed at minors.

5. Global Privacy Control

If your browser sends a Global Privacy Control (GPC) signal, we treat it as a valid request to opt out of sale and sharing for that browser: advertising measurement is switched off and the opt-out is recorded. If you are signed in, it also applies to your account. We honour GPC without asking you to confirm it.

6. Your rights

Depending on your state, you have the right to:

• know what personal information we have collected about you and to obtain a copy of it in a portable format;
• correct inaccurate personal information;
• delete personal information we collected from you, subject to legal exceptions (for example, signed agreements and their audit trails held for other parties, and records we must keep by law);
• opt out of the sale or sharing of personal information and of targeted advertising;
• opt out of profiling in furtherance of decisions that produce legal or similarly significant effects — we do not carry out such profiling;
• not be discriminated against for exercising these rights. We do not offer financial incentives in exchange for personal information.

7. How to make a request

Make a request on our privacy request form or by email to support@signspry.com. Signed-in users can also download their data and delete their account themselves under Privacy & data. We verify a request by confirming that you control the email address on the account; we may ask for more information if a request concerns sensitive data. You may use an authorised agent, who must provide your signed permission, and we may ask you to confirm your identity directly. We respond within 45 days, and may extend that once by a further 45 days where reasonably necessary, telling you why.

8. Appeals

If we decline your request, you may appeal by replying to our decision with the word "Appeal" within 60 days. We will answer the appeal in writing within the period your state's law sets (generally 45 or 60 days) and explain our reasons. If the appeal is denied, you may contact your state's Attorney General.

9. Contact

Grievance Officer — Manu Shekhar
Email: manu@signspry.com (subject "US privacy request")
Telephone: +91 94980 23023

Operated by
Manu Shekhar

Acknowledgement within 10 business days; response within 45 days.