Privacy
Privacy Policy
Last updated 14 October 2026
Signensure is built to hold your documents securely and to collect as little else about you as it can. This policy explains what we hold, why, and the rights you have over it.
Who is responsible for your data
The data controller for your account and for this website is TOCLOCO Inc, 1007 N Orange St, 4th Floor, Suite #1382, Wilmington, DE 19801, USA. For anything in this policy, including a request to exercise your rights, write to privacy@signensure.com.
Documents you send for signature
When you upload a document and send it for signature, the document and the personal data it contains, including your signers' names, email addresses and signatures, belong to you. For that data we act as your processor: we handle it only to provide the signing service on your instructions, as set out in our data processing agreement, which is available on request. You are the controller, and a signer's requests about their own data should usually go to you.
Our representative in the United Kingdom
For the purposes of Article 27 of the UK GDPR, our representative in the United Kingdom is TOCLOCO Ltd, company number 09950859, of 71-75 Shelton Street, London WC2H 9JQ, United Kingdom. If you are in the UK you may address any question about this policy to them; either route reaches the same people, and writing to privacy@signensure.com is usually quicker.
What we collect
Your account
When you create an account we hold your name, email address, company name, and the settings you choose. If you buy a paid plan, our payment processor Stripe handles your card details; we receive a record of the subscription and payment, not the card number.
Documents and signing activity
We hold the documents you upload, the fields you place, the recipients you add, and the record of what happened: when a document was viewed, signed, declined or reminded, together with the time, and the IP address and authentication of each signer. This record is what makes a signature stand up, so it is kept with the completed document.
Identity verification
If you ask for a signer's identity to be verified, that check is carried out by our verification provider, Veriff. They process the identity document and biometric check and return a result to us; we hold the outcome and the evidence reference, not a copy of the raw biometric data beyond what the service requires.
When you read the site or contact us
The website is served from Amazon CloudFront and S3, which keep technical request logs (IP address, time, page, user agent) to keep the service running and secure. If you email us, we hold your message and address for as long as it takes to deal with it and keep a record.
How we use it
We use your data to provide the service: to deliver documents to signers, to seal and timestamp completed documents, to preserve them in the archive, to send the related emails, to take payment, to support you, and to keep the service secure. We do not sell personal data, and we do not use your documents for advertising or to train models.
Who else processes it
| Provider | What they do |
|---|---|
| Amazon Web Services | Hosting, document storage, and email delivery |
| Stripe | Payment processing for paid plans |
| SSL.com | The organisation certificate and trusted timestamp used to seal completed documents |
| Veriff | Signer identity verification, when you request it |
Each acts as our processor under Article 28, under contract, and only for the purpose above. We do not share personal data with anyone for their own purposes.
How long we keep it
Completed, sealed documents and their certificates are kept in the archive for as long as your account needs them, and the write-once archive means they cannot be altered. Your account data is kept while your account is open and for a reasonable period afterwards. Website request logs are kept for up to 90 days. If you close your account you can export your completed documents first, and we delete or anonymise what we are not required to keep.
Security
Documents are encrypted in transit and at rest, isolated to your account, and backed by a tamper-evident, hash-chained audit trail. Sealed documents are additionally bound with a cryptographic seal and held in a write-once store.
International transfers
We are a US company, so personal data reaching us is processed in the United States. Where data is transferred out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum to them, together with the safeguards our providers have in place. You can ask us for a copy of the relevant terms.
Your rights
If the GDPR or the UK GDPR applies to you, you have the right to ask us for a copy of your data, to correct it, to have it deleted, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent, you can withdraw it at any time. For data inside documents our customers have sent, we will pass your request to the relevant customer, who is the controller.
Write to privacy@signensure.com and we will respond within one month, at no charge. If you are unhappy with how we have handled your data, please tell us first so we can put it right; you also have the right to complain to your data protection authority, which in the UK is the Information Commissioner's Office.
Children
Signensure is a business service and is not directed at children. We do not knowingly collect data about anyone under 16.
Changes
If we change this policy in a way that affects you, we will say so on this page and update the date at the top, and tell you by email or in the app where the change is material.