SignExact Privacy Policy

1. Information We Collect

To provide legally binding electronic signature services, SignExact collects and processes:

• Account Credentials: Full legal name, work email address, organization name, and cryptographically salted password hashes.
• Signer Audit Telemetry: Signer email address, full legal name, IP address, user-agent string, and precise UTC timestamps recorded during document viewing, consent acceptance, and execution.
• Document Assets: Raw PDF agreements and compiled executed packages sealed with X.509 certificates.

2. How Audit Telemetry Is Used

Signer IP addresses, timestamps, and browser user-agent strings are collected exclusively to populate the tamper-evident Certificate of Completion and SHA-256 audit ledger as mandated by ESIGN (15 U.S.C. § 7001) and UETA attribution standards. We do not sell or monetize audit telemetry to third-party advertising networks.

3. Document Confidentiality & Encryption

All customer documents and signature data are transmitted using TLS 1.3 encryption and stored with filesystem AES-256 equivalent protections. Access controls enforce strict multi-tenant isolation, preventing any user outside your organization from viewing or accessing your documents.

4. Data Retention & Deletion

When a document is deleted by an authorized administrator via the dashboard or API (DELETE /api/documents/:id), all associated database rows, audit records, and physical PDF files stored on disk are immediately and permanently unlinked.

5. Contact Us Regarding Privacy

For privacy inquiries, GDPR data requests, or compliance questionnaires, contact us at privacy@signexact.com or via our Contact Page.