Last updated: February 27, 2026
This Privacy Policy describes how GoSignHere ("we", "us", or "our") collects, uses, and protects your personal information when you use our electronic signature platform ("the Service").
When you create an account, we collect your name, email address, and password (stored as a bcrypt hash — we never store plaintext passwords). If you create a team account, we also collect your organization name.
When you upload documents for signing, we store the document files on our servers as binary data. Documents are used only to provide the signing service.
When signers interact with documents, we collect:
This data is necessary to create a legally valid audit trail and certificate of completion.
We collect activity logs for account actions (document uploads, package creation, user management) to provide the activity log feature and for security monitoring. These logs include the action type, timestamp, and the user who performed the action.
If you submit feedback through the in-app feedback form, we collect the topic, message body, and any screenshots you choose to attach. Your name and email address are included so we can respond.
Payment processing is handled entirely by Stripe. We do not store credit card numbers or bank account details on our servers. Stripe's privacy policy governs the handling of your payment information.
We use your information to:
We do not sell your personal information. We do not use your documents or signing data for advertising or marketing purposes.
| Data Type | Retention Period |
|---|---|
| Documents (completed/voided/expired packages) | 30 days after the event, then permanently deleted |
| Certificates of completion | Retained for the life of the account |
| Signing events (audit trail) | Retained for the life of the account |
| Digital signature records | Retained for the life of the account |
| Activity logs | 90 days, then automatically deleted |
| Account information | Retained while the account is active |
| Login attempt records | 7 days, then automatically deleted |
| Download tokens (signer access links) | 7 days from creation, then expired |
| Top-up purchase records | 12 months from purchase |
When data reaches the end of its retention period, it is permanently deleted from our servers using irreversible database operations. We do not retain copies after deletion.
We use the following third-party services to operate the platform:
| Service | Purpose | Data Shared |
|---|---|---|
| Stripe | Payment processing | Billing information (name, email, payment method) |
| Postal (self-hosted) | Transactional email delivery | Recipient email addresses, email content |
Postal is self-hosted on our own infrastructure — email data does not leave our servers except for SMTP delivery to the recipient's mail provider. We do not use third-party analytics, advertising, or tracking services.
We implement the following security measures to protect your data:
Signers who receive signing links do not need to create an account. We collect only the information necessary for the signing transaction: their name, email address (provided by the sender), signature, field values, IP address, and user agent. This data is associated with the specific package and is subject to the same retention policies.
Signers can decline to sign any document. Declining is recorded in the audit trail.
After a package is completed, signers receive a time-limited download link (valid for 7 days) to retrieve their signed documents. These links are single-use tokens that expire automatically.
You have the right to:
Under the California Consumer Privacy Act, you have the right to know what personal information we collect, request deletion of your data, and opt out of the sale of personal information. We do not sell personal information.
If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation, including the right to data portability, the right to restrict processing, and the right to lodge a complaint with a supervisory authority. Our legal basis for processing your data is contract performance (providing the Service you signed up for) and legitimate interests (security, abuse prevention).
The marketing site (gosignhere.com) does not use cookies or tracking technologies. The application (app.gosignhere.com) uses a session cookie for authentication purposes only. We do not use advertising cookies, analytics cookies, or third-party tracking cookies.
The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.
If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at hello@gosignhere.com.