Privacy Policy

Last Updated: September 13, 2026

This Privacy Policy explains how EndorsedSign ("we," "us," or "our") collects, uses, and protects your information when you use our electronic signature platform. If anything is unclear, email us at privacy@endorsedsign.com.

1. What information we collect

When you create an account you give us your name, email address, company name, and job title. Your password is stored as a one-way hash that we cannot reverse. A phone number is optional. Billing details are sent directly to our payment processor and we do not store full card numbers.

When you use the Service you give us the documents you upload for signing, the signature images and form field responses your recipients provide, and any messages you send to our support team.

When you use the Service we automatically record the pages you visit, the features you use, and how long you spend on them. We also record your IP address, browser type, operating system, and time zone, plus the cookies and session identifiers needed to keep you logged in.

The public marketing website (endorsedsign.com) is separate from the signed-in Service. Optional product analytics on that site run only after you choose Accept on the cookie banner. Until then we do not set analytics identity cookies or record marketing page or CTA events. See section 9 and the Cookie Policy at /cookies.

For every signing event we record the time and IP address of the signature, the email verification status of the signer, the authentication method used, and an approximate location derived from IP address. This data forms the tamper-evident audit trail attached to each signed document.

If you sign in via a third-party identity provider, we receive your name and email from that provider. If you connect third-party integrations, those services may share data with us as you configure.

2. How we use your information

We use your information to authenticate you, manage your account, route documents to the right recipients, collect signatures, store completed documents, send signing invitations and status notifications, and answer your support requests.

We use it to detect and block fraudulent activity, verify signer identity, and investigate violations of our Terms of Service.

We use it to understand which features are used, fix bugs, optimise performance, and build new features.

We use it to maintain tamper-evident audit trails, respond to lawful requests from courts or regulators, and comply with applicable data protection laws.

We send transactional messages such as receipts, signing requests, and account alerts. We may send product updates and announcements; you can opt out at any time. We send marketing communications only with your explicit consent.

3. Legal basis for processing (GDPR)

If you are in the EEA or UK, we rely on the following legal bases:

• Contract. Processing necessary to deliver the Service you signed up for.
• Legitimate interest. Improving the Service and preventing fraud.
• Legal obligation. Maintaining audit trails and responding to lawful requests.
• Consent. Marketing emails and optional analytics features.

4. Who we share your information with

When you send a document for signing, the designated recipients receive access to that document and its signing link. You control who receives what.

We use third-party companies to help us operate the Service, including hosting infrastructure, payment processing, email delivery, and customer support tooling. These providers process data only on our instructions and under appropriate data protection agreements.

We may disclose information if required by law, court order, or regulatory request, or where necessary to protect the safety of our users or the public.

If EndorsedSign is acquired or merges with another company, your data may transfer to the new entity. We will notify you before that happens.

We will not share your data for any other purpose without asking you first.

5. How long we keep your information

We keep your account information for as long as your account is active, plus 30 days after you close it.

Signed document retention depends on your plan and your own configuration. Free accounts retain documents for one year. Paid accounts support configurable retention up to seven years. Documents you delete are purged within 30 days.

Signature audit logs are kept for seven years to support the legal validity of signed documents.

We may retain aggregated, non-identifiable usage data indefinitely to understand long-term trends.

6. How we protect your information

All data in transit is protected by TLS 1.2 or higher. Data at rest is encrypted using AES-256. Passwords are stored as bcrypt hashes.

Employees access only the data they need for their role. Multi-factor authentication is available on all accounts. Access is reviewed regularly and revoked when no longer needed.

Our infrastructure is hosted in certified data centres with continuous monitoring. We maintain an incident response plan, conduct regular security assessments, take regular backups, and test restoration procedures.

7. Your rights

You have the following rights over your personal data. To exercise any of them, email privacy@endorsedsign.com and we will respond within 30 days.

• Access. Request a copy of the data we hold about you.
• Correction. Update inaccurate information through your account settings or by contacting us.
• Deletion. Request that we delete your account and personal data. Some data may be retained where legally required.
• Portability. Receive your data in a machine-readable format.
• Objection. Object to processing based on legitimate interest.
• Restriction. Ask us to pause processing in certain circumstances.
• Withdraw consent. Opt out of any processing you previously consented to, at any time.

8. International data transfers

If your data is transferred outside the EEA or UK, we ensure an appropriate safeguard is in place. In most cases we rely on the Standard Contractual Clauses approved by the European Commission. Enterprise customers may have additional data residency options; contact us for details.

9. Cookies

Essential cookies are required for the signed-in Service to work, for example to keep you logged in and to store your preferences. You cannot opt out of essential cookies without losing access to the Service.

On the public marketing website, optional product analytics is off until you choose Accept on the cookie banner. Accept sets a first-party consent cookie (endorsed_marketing_consent, 180 days) and, only then, an anonymous analytics identity cookie (endorsed_analytics_identity) plus a session key in sessionStorage. Those cookies store an anonymous id, first-touch campaign fields (UTM source, medium, campaign, term, content, landing path), and the referring hostname — not your name or email.

Reject stores the same consent cookie as denied and does not create an analytics identity. The banner is not shown on /privacy, /terms, or /cookies. You can change your choice by clearing the consent cookie or through your browser settings. There is not yet an in-account preference centre for this choice.

We do not use advertising cookies and we do not sell browsing data. A crash-reporting service may set its own cookie when error reporting is enabled for a deployment.

Cookie names and the Accept / Reject behaviour are also described on the Cookie Policy at /cookies.

Product analytics

Optional product analytics help us understand which parts of the product people use so we can improve them. They are not required to sign documents, open a signing link, or use your account.

When you allow analytics, we record high-level usage such as which screens you open and which product features you use. We do not use this to read the contents of your documents, signature images, or the values entered in signing fields. We do not sell this information for advertising.

You can decline. Signing and account features continue to work either way. You can change this choice later from the same prompt, or by emailing privacy@endorsedsign.com.

10. Children's privacy

The Service is intended for users aged 16 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, contact us and we will delete it promptly.

11. Changes to this policy

We will notify you by email and through the Service when we make material changes to this policy. The "Last Updated" date at the top of this page always reflects the most recent version.

12. Contact us

For privacy-related questions or to exercise your rights, email privacy@endorsedsign.com.

You also have the right to contact your local data protection authority.