Privacy Policy

This policy explains what SealMySignature collects about you, why, who it is shared with, how long it is kept, and what you can do about it. It is written for everybody the product meets: people visiting the website, the organizations and people who open a workspace and send documents, the people those documents are sent to, and anybody in the referral program.

SealMySignature is operated by White Lotus Strategies, LLC, 1942 Broadway Ste 314C, Boulder, CO 80302. Questions about this policy go to [email protected].

1. Two Roles

Privacy law separates the party that decides why information is collected (the controller) from a party that handles it on that party's instructions (the processor). SealMySignature is both, depending on whose information it is.

• Your account and your workspace. For the information about the people who use the product (the account, the workspace, what was sent and when, payments, the referral program) we are the controller, and this policy is our notice to you.
• The people you send documents to. For the information about recipients and signers, the organization that sent the document is the controller and we are its processor. We handle that information on the organization's instructions and under the agreement in the Terms of Service. The Privacy Notice for Signers is the notice to those people, and it names the organization responsible.

2. What We Collect

If you visit the website. The request logs of the servers that serve it, which record the address a request came from, the page asked for, the time, and the browser's description of itself. We also count visits to our public pages as daily totals: the page, the domain of the site that linked to it, and any campaign tags in the link. This counter sets no cookie and stores no IP address or other identifier. Beyond that, nothing runs until you say so: if you accept it in the cookie banner, our public marketing pages load Meta's pixel, which sets a Meta cookie and reports to Meta the page you viewed, the address and browser it came from, and whether you arrived from one of our ads, so that we can measure which of our ads work. The pixel runs only on our public pages, never inside the product, on a signing page, on a document or on this policy, and never at all until you accept. Section 4 says how to decline and how to change your mind. There are no other trackers and no third-party analytics on any page of SealMySignature.

If you create an account or buy a plan, and you accepted the pixel. We send Meta a record of that event: a one-way hash of your email address and of your account id, the address and browser the request came from, the two cookies Meta's pixel set in your browser, and, for a purchase, the plan and the price paid. This lets Meta tell us which ads led to accounts and payments. We never send document content, file names, the names or addresses of the people you send documents to, or anything else from inside the product, and we send nothing at all if you declined, if you have not chosen, or if your browser sends a Global Privacy Control signal.

If you ask for access. The email address you enter on the landing page, the time, the address it came from, and any referral code that came with it. When you are let in, a note our operator may have added about the request.

If you have an account. Your name, your email address, a one-way hash of your password (never the password itself) and, if you turn on two-step sign-in, the secret for it, stored encrypted. The time you last signed in. The workspaces you belong to and your role in each. The version of the Terms of Service and of this policy that you accepted, when, and the address you accepted from.

Your workspace. Its name, the legal name and address you enter for it (which are printed on the records the product makes), its logo and colours, its email settings, its retention setting, and whether it is on legal hold.

What you send. The documents you upload, the templates you build, the fields you place, the names and addresses of the people you send to, the messages you write to them, and the signed documents, certificates and audit trails the product produces. Documents are stored encrypted under a key that belongs to your workspace.

The audit trail. Every action on a document is recorded: who did it, when, from which address and browser, and what it was. That record is append only and hash chained, which is what makes it evidence. It carries ids and technical values. The names and addresses it refers to are held separately.

Your saved signature. If you keep a signature or initials for reuse, the image and, for a typed signature, the text and the font.

Cloud drives. If you connect a drive, the tokens the provider issues, stored encrypted and used only for what you ask (importing a file you pick, saving a signed document to a folder you pick), the account name and address the provider reports, and a record of each copy saved: where, when and by whom. We access only what you pick, and we never delete, move or share anything in your drive.

The referral program. If you take part, your referral code, a daily count of how often your link was opened (no addresses and no visitor details), the name of each workspace you referred and what it earned you, and the PayPal address you save for payouts, stored encrypted and shown back to you masked.

Payments. For a paid plan, the plan and billing period, the state of the subscription, and the record of each charge and refund: the amount, the date, and the reference Stripe gives it. You enter your card and billing address with Stripe directly. We never see or store a full card number.

Support. What you write to us, and what we write back.

3. Why We Use It

• To provide the product: to keep your account, to render and send your documents, to record and prove what was signed, to copy a document to a drive you chose, and to answer the Verify a Document page. This is the performance of our agreement with you.
• To keep the product safe: to detect and stop attempts to guess links and codes, to enforce the limits of each plan, and to investigate misuse. This is our legitimate interest in running a service that can be trusted with signed agreements.
• To bill you, and to pay referral commission, which is the performance of our agreement and, for tax and accounting records, a legal obligation.
• To measure our ads, if you accept it: to learn which of our ads led to a visit, an account or a payment, so that we spend on the ones that work. This rests on your consent, which you can withdraw at any time (section 4), and on nothing else.
• To count which of our campaigns bring sign-ups: the campaign tags of the link you first arrived through, kept with your sign-up and sent to Stripe with a purchase, so that we can see which campaigns lead to accounts and payments. This is our legitimate interest in knowing what our marketing does. It uses no identifier, and nothing about it is sent to Meta.
• To tell you about your account: a document that completed, a payment that failed, a change to the terms. These are service messages, not marketing, and they cannot be turned off while you have an account. We do not send marketing email.
• To answer a lawful request from a court or an authority, where we are required to.

We do not sell personal information, and we do not use your content to train any model. The one thing we share for advertising is what section 2 describes: with your consent, Meta receives what its pixel collects on our public pages and the account and purchase events, so that we can measure our own ads. Meta uses what it receives under its own terms as well, which is why we ask before anything is sent.

4. Cookies

SealMySignature sets the cookies listed here. All of them are needed for the product to work except the campaign cookie, which counts which of our campaigns a sign-up came from, and none of them is shared with an advertiser. Meta's pixel, if you accept it, sets two more, described after the list.

• A session cookie, which keeps you signed in for up to 30 days.
• A cookie that remembers which of your workspaces you are working in.
• For a person signing a document, a cookie that keeps their place for the two hours a signing session lasts.
• While you connect a cloud drive, a short-lived cookie that ties the provider's answer to the request you started.
• If you arrive through a referral link, a cookie that carries the referral code for 30 days, so that a workspace you set up later is credited to the person who referred you. It is set only by that link and cleared once a workspace is created.
• If you arrive through a link that carries campaign tags (the utm_source, utm_medium, utm_campaign, utm_content and utm_term labels we put on our ads and emails), a cookie (st_utm) that keeps those tags, the page you landed on and the time, for 30 days. Only the first tagged link counts. If you create a workspace in that time, the tags are saved with your sign-up so that we can count which campaign it came from, and the cookie is cleared. It holds no identifier, and only our own servers read it, never Meta or any other advertiser.
• A cookie that remembers your answer to the cookie banner (st_ads), for 12 months. It is set only when you choose, and it holds the word accepted or the word declined and nothing else.
• A preference for light or dark display, kept in your browser.

Every one of these except the campaign cookie is needed for something you asked for. The campaign cookie measures our own campaigns on our own servers and identifies no one, so we set it without asking.

Separately, and only if you accept it in the cookie banner on our public pages, Meta's pixel sets two cookies of its own (_fbp and _fbc), which identify your browser to Meta for up to 90 days so that a visit, an account or a payment can be matched to one of our ads. The pixel does not load, and those cookies are not set, until you accept. You can decline in the banner, change your choice at any time from Cookie Settings in the footer of every public page, use the Do Not Sell or Share My Personal Information link there, or send a Global Privacy Control signal from your browser, which we treat as a decline on every page and on our servers. After a decline we load nothing from Meta and send nothing to Meta about you. Your choice is kept in this browser only, so a different browser or device asks again. The Your Privacy Choices page shows your current choice and lets you change it.

5. Who We Share It With

We share personal information only with the providers we need to run the product, each under a contract that limits what they can do with it. As of the date of this policy they are:

• Supabase, for the database and for encrypted document storage, in the United States.
• Railway, which runs the application, in the United States.
• Cloudflare, which provides the network in front of the site and its protection against attacks.
• Resend, which delivers the emails the product sends: the recipient's address, the subject and the links in the message.
• Sectigo and DigiCert, whose timestamp services receive a hash of each signature and nothing else, and freetsa.org, a public timestamp service we use only as a last resort when neither of them answers, which receives the same.
• Google, Dropbox and other cloud drive providers, only for a drive you chose to connect, and only with what you chose to import or save.
• PayPal, for referral payouts: the payee's address, the amount and a reference.
• Stripe, which processes payments for paid plans: the workspace name and billing email we send it, and the card and billing address you enter with it directly.
• Meta Platforms, for ad measurement and only with your consent: what its pixel collects on our public pages, and the hashed email, hashed account id, address, browser and plan of an account created or a plan bought, as section 2 describes. Meta is not a processor acting only on our instructions: it uses what it receives under its own terms as well.

We also share information where the law requires it, to enforce our agreement with you, and, if the business is sold or merged, with the party that takes it over, who is bound by this policy.

The organization that sent a document sees what its recipients did with it, which is the point of the product. A person who refers a workspace sees its name and what it earned them, and nothing else about it.

6. Google User Data

If you connect Google Drive, SealMySignature asks only for access to the files you pick in Google's file picker (the drive.file scope), and uses that access only to import the file you picked, to make a folder when you ask for one, and to save signed documents to the folder you picked or made. It cannot see anything else in your Drive. Our use of information received from Google APIs follows the Google API Services User Data Policy, published at developers.google.com/terms/api-services-user-data-policy, including its Limited Use requirements: we do not transfer that information to anybody except as needed to provide the feature, we do not use it for advertising, and no person reads it except with your permission, for security, or where the law requires.

7. How Long We Keep It

• Your workspace and its documents are kept for as long as its retention setting says. A document you delete is removed 30 days after you delete it. When a workspace closes, everything in it is deleted 30 days later.
• Your account exists for as long as you belong to a workspace, and is deleted 30 days after the last one closes or removes you.
• Records we have to keep: the record of what was paid and what was refunded, the record of referral commission and payouts, and the record that the Terms of Service were accepted, for as long as tax and accounting law and the possibility of a dispute require, usually seven years.
• The audit trail of a document lives and dies with the document.
• Your cookie banner choice lives in its cookie for 12 months. Our record that a purchase event was sent to Meta holds an id and a date and no personal information. What Meta keeps is governed by Meta's own policy.
• Request logs are kept for a short period for security and then discarded.
• Backups of the database are kept for a rolling period and overwritten in the ordinary course. A deletion reaches them when they roll over.

8. How We Protect It

Documents are stored encrypted with a key that belongs to your workspace, and that key is itself encrypted. Passwords are stored as one-way hashes. Cloud drive tokens, two-step secrets and payout addresses are stored encrypted. Every connection to the product is encrypted in transit. Signing links and the other links the product sends are stored as hashes, so a copy of the database is not a pile of usable links. The audit trail is append only: the database refuses any change to it, and every entry carries the hash of the one before, so a removed or altered entry would show. Access by our operator to a workspace is itself recorded.

No system is perfectly secure. If we learn of a breach that affects your information, we tell you without undue delay and tell you what we know.

9. Your Rights and Choices

Depending on where you live, you may have the right to ask for a copy of the information we hold about you, to correct it, to have it deleted, to receive it in a portable form, to object to or restrict certain uses, and to complain to a supervisory authority. We do not treat anybody differently for exercising a right.

• If you have an account, most of what we hold is visible and editable in the product. For anything else, write to [email protected] from the address on your account. We answer within one month.
• If you were sent a document to sign, your request goes to the organization that sent it, because it is the controller. Open the Your Data link at the bottom of any email you received about the document, or start from the Your Data page. The organization has one month to answer.
• A signed document is an executed agreement. An erasure removes your personal details from everything that is not that record, but the document itself, and the evidence that it was signed, may be kept by the organization for as long as the law and its legitimate interests allow.

If you are in the European Economic Area, the United Kingdom or Switzerland, the information above is transferred to and held in the United States. We rely on the standard contractual clauses our providers offer for that transfer, and we sign a data processing agreement with any customer who asks for one.

If you are a California resident, the categories above are the categories we collect. We do not sell personal information. With your consent we share personal information with Meta for ad measurement, as sections 2, 4 and 5 describe, and California law counts that as sharing. To opt out, decline in the cookie banner, use the Do Not Sell or Share My Personal Information link in the footer of every public page, or send a Global Privacy Control signal, which we honour as an opt-out. We share no other personal information, and the rights above are yours to exercise by writing to us.

10. Children

SealMySignature is for organizations and adults. We do not knowingly collect information from anybody under 18, and an account opened by somebody under 18 is closed when we learn of it.

11. Changes

This policy is versioned. The version and the effective date are at the top, and the version current when you created a workspace or accepted an invitation is recorded. A new version takes effect on the date at the top. For a change that matters we also tell the owner of every workspace, by email or in the product.

12. Contact

White Lotus Strategies, LLC, 1942 Broadway Ste 314C, Boulder, CO 80302. Email: [email protected].