1.Who we are and what this policy covers
eSignPro (“we”, “us”) provides eSignPro, a service for sending documents for electronic signature. This policy explains how we handle personal information about the people who use our website and service. We play two different roles, and which one applies depends on who you are.
- Account holders and website visitors. For your account, your team’s accounts, billing, and our website, we decide how your information is used. We are the “business” under the California Consumer Privacy Act and the equivalent under other US state privacy laws.
- Signers and anyone named in a document. When one of our customers sends you a document, that customer decides what is collected and why; we process it on their behalf as their “service provider”, under our Data Processing Addendum. Section 4 explains what that means for you.
2.What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account and profile | Name, email address, password (stored only as a bcrypt hash), role, language, time zone, profile picture; your organization’s name, size, type, billing email and tax ID. | You, or the administrator who invited you, or your identity provider through SSO or SCIM. |
| Sign-in and security | Multi-factor settings (the authenticator secret encrypted, recovery codes hashed), passkey public keys, a hashed trusted-browser token, and a record of sign-ins with IP address and browser. | Generated when you sign in and set up security features. |
| Billing | Plan, invoices, and the payment method’s brand, last four digits, expiry, holder name and country. Full card numbers go straight to Stripe; we never receive or store them. | You, and Stripe. |
| Documents and contacts | The files, templates and form fields you upload or create, the contacts you save, and anything personal inside them. | You and your team. |
| Signer details | Name, email address, phone number (only if a one-time code is sent by text), consent to sign electronically, the signature itself (drawn or typed), field entries, the times a document was opened, signed or declined, and any reason given for declining. | The sender, and the signer while completing the document. |
| Audit and usage records | Each event on a document or account — who, what, when — with IP address and browser user agent; counts of documents, API calls and messages used against plan allowances; server logs. | Recorded automatically as the service is used. |
| Connected services | Access tokens for Google Drive or Dropbox (encrypted), only if you connect them, used to fetch the files you pick. | The service you connect. |
| Correspondence | What you tell us when you email us or ask for support. | You. |
We do not ask for sensitive information such as health or financial details, government identifiers or biometric templates. Documents our customers upload may contain such information; that is under the customer’s control. A drawn signature is stored as an image of the signature, not as a biometric profile.
It is not practical to sign a document with us anonymously: the point of the record is to show who signed. You can browse our website without giving us any personal information.
3.How we use it, and why
| Purpose | Why we do it |
|---|---|
| Provide the service: accounts, sending, signing, notifications, storage | To perform our contract with you; for signers, on our customer’s instructions. |
| Keep the audit trail and certificate that prove how a document was signed | Our customers and their signers need enforceable records, and they may be needed to establish or defend legal claims. |
| Keep accounts and the service secure: sign-in checks, one-time codes, rate limits, abuse prevention | To keep the service secure, and to meet our legal obligations to protect data. |
| Bill for subscriptions and meter plan allowances | To perform our contract with you, and to meet tax and accounting law. |
| Answer support requests and send service notices | To perform our contract with you and keep you informed about the service. |
| Understand and improve the service, using counts and measurements that do not identify anyone | To run and improve the service, without identifying anyone. |
| Comply with the law and respond to lawful requests | Because the law requires it. |
We send email about your account and documents because the service needs it. If we send marketing email, we will do so only where the law allows, and every message will let you opt out. We do not use personal information for advertising.
4.If you were sent a document to sign
The organization that sent you the document is responsible for your information in it. Before you can open the document we ask you to agree to sign electronically. We then record what you do — opening, signing or declining, with the time, your IP address and your browser — in an audit trail attached to the finished document, and we calculate a hash of the finished file so anyone holding it can check it has not changed.
That record exists to prove the signature is genuine, so it is kept for as long as the document is and cannot be edited. If you ask for your information to be erased, we remove what we can, such as saved signatures, contact entries and unsent drafts, but the record of a document you signed stays with that document as evidence the law allows us to keep.
For a paper copy, a question about the document, or to stop receiving documents, contact the sender. If you contact us instead, we will pass your request on to them and help them answer it.
7.Where your information is processed
We are a US company, and the service is hosted in the United States. Our providers process data in the places shown in the subprocessor list, and each is bound by contract to protect it as this policy does.
8.How long we keep it
| Information | How long |
|---|---|
| Account, profile and security data | While the account is open. After it closes, deleted within 90 days. |
| Documents, signer details and contacts | For as long as the customer keeps them, and at least for the retention period their plan includes. After the account closes, as the Terms and the DPA describe. |
| A document’s audit trail | For as long as the document it proves exists. Entries are chained by hash and are never edited. |
| Invoices and billing records | As long as tax and accounting law requires, generally five to seven years. |
| Server and system logs | 90 days, then deleted automatically. |
| Sessions and trusted browsers | A session lasts 12 hours, or 30 days if you choose to stay signed in. A trusted browser is remembered for 90 days, and forgotten when you change your password. |
Deleted information leaves our backups as they expire.
9.How we protect it
Traffic to the service is encrypted in transit. Credentials and secrets we hold are encrypted at rest with AES-256-GCM; passwords, API keys, one-time codes and signing links are stored only as hashes. Each organization’s data is kept separate, and every document’s audit trail is hash-chained so tampering can be detected. The security page and the DPA’s security annex go into detail. No system is perfectly secure; if a breach is likely to cause you serious harm, we will tell you and the regulators the law requires us to tell.
10.Your rights
Depending on the state you live in, you can ask us to:
- tell you what personal information we hold about you, and give you a copy in a portable format;
- correct it if it is wrong or out of date;
- delete it, subject to what we must keep (such as a signed document’s audit trail);
- stop selling or sharing it, or using it for targeted advertising or profiling — although we do none of these.
Email privacy@esignpro.net. We will confirm who you are before acting, and reply within 30 days. If the information is in a document someone sent you, we will usually refer you to them, as section 4 explains. We will not treat you differently for exercising these rights.
If you are unhappy with our answer you can complain to your state’s attorney general, or in California to the California Privacy Protection Agency.
11.California and other US states
In the last twelve months we have collected these categories of personal information, as defined by the California Consumer Privacy Act: identifiers (name, email, phone, IP address), customer records (billing details), commercial information (plan and invoices), internet activity (audit and usage records), and account log-in credentials. Section 2 gives the sources and section 3 the purposes. We keep each category for the periods in section 8.
We do not sell or share personal information for cross-context behavioral advertising, and have not done so in the last twelve months. We use sensitive personal information (your log-in credentials) only to provide the service and keep it secure. You can ask to know, delete or correct your information as section 10 describes, including through an authorized agent, and we will not discriminate against you for doing so.
12.Automated decisions and AI
We do not use a computer program to make decisions about people that could significantly affect their rights or interests. Automated checks such as rate limits and one-time-code lockouts protect accounts, and a person can review their effect: contact support@esignpro.net. We do not use your documents or personal information to train artificial intelligence models.
13.Children
The service is for businesses and is not directed at children. Account holders must be at least 18. If you believe a child has given us personal information, contact us and we will delete it.
14.Changes to this policy
We will update this policy when our practices change. The effective date and version at the top of the page show which version you are reading. If a change materially affects how we use information we already hold, we will tell account owners by email before it applies.
15.Contact us
Privacy questions and requests go to privacy@esignpro.net.