SignEnvoy Privacy Policy

Last updated: October 19, 2026

This policy explains what personal information SignEnvoy collects, why, who we share it with, how long we keep it, and the choices and rights you have. It is written to match our Terms of Service and our Data Processing Addendum (the “DPA”).

1. Who we are, and which data this policy covers

SignEnvoy is operated by SignEnvoy, Inc., a Delaware corporation, 1044 E Brandon Blvd, Brandon, FL 33511 (“SignEnvoy”, “we”, “us”). Our Privacy Administrator is responsible for this policy and can be reached at privacy@signenvoy.com.

We handle personal information in two different roles:

1. As a controller. We decide how and why we use information about our own customers and visitors: the people who create SignEnvoy accounts and workspaces, members of those workspaces, people who contact us, and visitors to our websites. This policy covers that information.
2. As a processor. When a customer uses SignEnvoy to send documents for signature, the documents, the people named in them and the signers’ details belong to that customer. We process them only on the customer’s instructions, under the DPA. If you received a document to sign, the sender is responsible for your information: please contact them. Section 4 describes what we hold about signers and how we handle it.

This policy covers signenvoy.com, docs.signenvoy.com, the SignEnvoy dashboard and API, the signing pages, and the senv command-line tool.

2. Information we collect about customers and visitors

Your account

• When you sign up: your email address, a password, your first and last name, and your organization’s name. Your password goes to our authentication provider, which stores only a scrambled (hashed) form of it. We never store or see it in readable form.
• In your workspace: your role, when you joined, and, if you change your email address, the previous address and when it changed. When you invite a colleague, we store their email address and role until they accept or the invitation expires after 7 days.
• Your settings: which envelope notifications you receive and whether you get them one by one or as a daily digest.
• Acceptance of our terms: when an owner or admin starts a paid plan, we record who accepted the Terms and the DPA, which versions, and when.

Billing

Payments are handled by Stripe. Card details and billing addresses go directly to Stripe and never reach our systems. We store the Stripe customer and subscription references for your workspace, your plan status, and any credits or balances. We give Stripe the email address of the person who starts the paid plan, the workspace reference, and the versions of the Terms and DPA they accepted.

API keys and the command-line tool

For each API key we store its name, a secure fingerprint of the key (not the key itself), its last four characters, who created it, and when it was last used. When you sign in with the senv command-line tool, we store the name it requests for its key, which by default includes your computer’s name, and the tool’s version. The tool sends its version, operating system and architecture with each request. It collects no analytics.

Support, reports and email to us

• Help requests: the topic, your message, your email address and, if you give it, your workspace.
• Email to support@, security@, sales@ or privacy@: whatever you choose to send us. These mailboxes are hosted by Google Workspace.
• “Didn’t expect this?” reports from the signing page: the kind of report, your message, the signing link it concerns, your email address if you give it, and your IP address. The report is emailed to our security team, and a short excerpt, and your email address if you gave one, is kept with the sending workspace’s record so we can act on abuse.

Security and abuse prevention

• IP addresses are used to limit repeated requests. When someone requests one-time signing codes, the requesting IP address is kept for up to 2 hours. Requests to reset a password, change an email address or recover an account are kept with the address and IP they came from, as security records.
• Server logs record the IP address and the address of each request, and are kept by our hosting provider for a short period.
• Operator access: our staff’s own sign-ins to our support tools are recorded with their IP address.

How the dashboard is used (product analytics)

Inside the dashboard, we use PostHog to learn which pages are used and where people get stuck.

• What is recorded: the pages a signed-in user visits and a short list of actions, such as sending an envelope, creating a template or an API key, or starting a paid plan. Each event carries your user ID and workspace ID, never your email address, an envelope’s title, a file name, or anything typed into a form.
• What is removed: page text is masked, search terms are removed from page addresses, and any email address in an error message is partly masked. There is no session recording, no heatmap and no automatic click capture.
• How it travels: events go through SignEnvoy’s own address, which removes your IP address and cookies, so PostHog sees our server’s address, not yours. PostHog keeps its identifier in your browser’s local storage. If you allow cookies (section 5), it also keeps it in a first-party cookie shared by our own sites, so the dashboard recognizes the visits to signenvoy.com and our docs that came before.
• Your choices: browser events stop if your browser sends a Do Not Track signal. A workspace owner or admin can turn product analytics off for the whole workspace under Settings, Workspace, Product analytics, which stops both the browser events and the events our servers record.

Error reports and application logs also go to PostHog so we can keep the service running. Before they leave our servers, email and IP addresses in them are partly masked (for example j***@a***.com and 203.0.113.0), keys and signing links are removed, and stored values are stripped. They are needed to operate the service, so the analytics setting does not turn them off.

Our websites

• signenvoy.com and docs.signenvoy.com count page views and clicks on the links that lead to the app, using PostHog through SignEnvoy’s own address. Each page view carries the page address (including any campaign tags in it), the referring page, the page title and your browser’s standard description of itself.
• Until you choose, and if you decline, the counting sets no cookie and stores nothing in your browser, and each page view stands alone.
• If you allow cookies, PostHog keeps an anonymous identifier in a first-party cookie on signenvoy.com, shared by our own sites. Your visits to signenvoy.com, the docs and, once you have an account, the dashboard are then recognized as one visitor. When you sign up or sign in, those earlier visits are linked to your account. A link from one of our sites to another may carry that identifier in its address; the receiving page removes it at once and uses it only if you have allowed cookies there.
• The counting stops if you decline cookies, or if your browser sends a Do Not Track or Global Privacy Control signal. Declining also removes an identifier set earlier.
• Campaign tags. If you follow a link to our signup page that carries tags in its address (for example, which ad or article you came from), the app keeps them in an attribution cookie and stores them with your signup. Section 5 describes that cookie and your choice about it.

Product measurements we keep ourselves

To see whether onboarding and signing work, we keep a few measurements in our own database:

These measurements never contain IP addresses or browser strings: a browser is reduced to its device type and the rest is discarded.

3. How we use information, and our legal bases

Email we send you. We send email your account needs: sign-up and security messages, team invitations, billing and payment messages, notices about deleting data, and service notices about changes to prices, our terms, our sub-processors, or incidents. Envelope notifications (opened, signed, completed, declined and so on) can be turned off or switched to a daily digest under Settings, Email preferences. We do not send marketing email, and we do not sell or rent your information.

We do not use personal information to train machine-learning models, and we do not make decisions about you by automated means that have legal or similarly significant effects.

4. Information about signers and documents

When a customer sends a document through SignEnvoy, we process on the customer’s behalf the document itself, the names and email addresses of the people it is sent to, what they fill in and sign, and an audit trail of what happened: when the signing link was sent and opened, how the signer was verified, when they signed, and the IP address and browser they used. The completed document carries a Certificate of Completion that shows this record, including who delivered the signing link.

• The signing pages set no cookies, store nothing in your browser, and carry no analytics of any kind.
• Emails to signers (the signing request, reminders the sender asks for, one-time codes and a copy notice when signing is done) go out under the sender’s name.
• How long it is kept is decided by the customer, within the limits in the DPA: the customer can delete an envelope at any time once it is not in progress; test envelopes are deleted 30 days after they are created; and live envelopes are deleted 90 days after the customer’s subscription ends, unless the customer deletes the workspace sooner.
• Your rights as a signer are exercised through the sender. If you contact us, we will pass your request to the sender promptly, as the DPA requires.

Full details of this processing are in the DPA, including its Annex I (what is processed) and Annex III (how it is protected).

5. Cookies and similar technologies

We use cookies and similar technologies to run the service, to keep it secure, to remember your settings, and to understand how people find and use SignEnvoy.

A cookie is a small file that a website asks your browser to keep and send back on later visits. It may hold an anonymous identifier. Similar technologies, such as browser local storage, pixels, tags and scripts, can serve the same purposes. Your browser can refuse all cookies or warn you before one is set, but parts of the dashboard will not work without the cookies that run it.

The kinds of cookies and storage we use:

• Session cookies keep you signed in to the dashboard and renew your sign-in. The dashboard does not work without them.
• Security cookies protect forms against forged requests and support a safe sign-in. The dashboard does not work without them.
• Preference cookies remember settings and choices you make, including your cookie choice.
• Analytics storage. Product analytics in the dashboard keep an identifier in your browser’s local storage, as described in section 2. It is not set if analytics is off for your workspace or your browser sends Do Not Track. If you allow cookies, the same identifier is also kept in a first-party analytics cookie shared by signenvoy.com, the docs and the dashboard, so your visits to them are recognized as one visitor.
• Attribution cookie. With your consent where the law requires it, when you reach our signup page from a link that carries campaign tags, the app keeps those tags in a first-party cookie for up to 30 days. If you create an account, we save them with your account to learn which channels bring us customers. We do not store your IP address for this purpose.

Your choice. The first time you visit signenvoy.com, we ask whether we may set cookies beyond the ones that run the service. We remember your answer in a first-party cookie named se_consent for 12 months. You can change or withdraw it at any time from “Cookie settings” in the footer of signenvoy.com or the docs, or by opening cookie settings here. Declining means we set no attribution cookie and no analytics cookie, and withdrawing a choice you made earlier removes them. We treat a browser’s Global Privacy Control signal as a refusal.

The signing pages set no cookies and store nothing in your browser. Our analytics cookie is first-party: it is used only on SignEnvoy’s own sites and is never shared with other companies’ websites. Today we set no advertising cookies and use no advertising pixels. If we begin to use cookies for advertising, we will update this policy first and ask for your choice again where the law requires it.

6. Who we share information with

• Service providers (sub-processors) that host and run SignEnvoy for us: Amazon Web Services (application hosting, database, sign-in, document storage and custody of our document-sealing key), Cloudflare (network and websites), Resend (email delivery), PostHog (analytics, error reports and logs), Google Workspace (our email), and Stripe (payments). The current list, with what each provider handles and where, is at signenvoy.com/sub-processors. Each is bound by a contract to use the information only to provide its service to us. Sealed documents also carry a trusted timestamp from a public timestamp authority, which receives only a cryptographic fingerprint of the seal and no personal information, so it is not a sub-processor.
• Your workspace. Owners and admins of a workspace can see its members’ names, email addresses and roles, and the workspace’s activity record.
• Legal requirements. We disclose information when the law requires it, and follow the process in section 10 of the Terms.
• Business transfers. If SignEnvoy is merged, acquired or sells its business, information may transfer to the successor, which will remain bound by this policy for information collected under it.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

7. International transfers

SignEnvoy and its providers store and process information in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, we transfer your information under the European Commission’s Standard Contractual Clauses and the UK Addendum, as set out in the DPA for customer data, and with equivalent safeguards from our providers.

8. How long we keep information

Backups. Deleting information removes it from the live service as the table above says. Our backups of the database and stored documents are kept for 35 days and then deleted automatically, so deleted information leaves them as they expire, about 35 days after it was deleted. Backups are encrypted and stay in the United States (Ohio, with a copy in Oregon). We use them only to restore the service after a failure or loss of data, never to bring back information that was deleted at your request or on the schedule above.

9. Your rights

Depending on where you live, you may have the right to:

• ask what personal information we hold about you and get a copy;
• correct inaccurate information;
• delete your information;
• object to, or ask us to restrict, how we use it, including our use for product analytics;
• receive your information in a portable format;
• withdraw consent, where we rely on it; and
• complain to a data protection authority where you live or work.

How to use them. Most account information can be viewed and changed in the dashboard, and an owner can export or delete a whole workspace under Settings. For anything else, email privacy@signenvoy.com. We will confirm your identity, usually from the email address on your account, and reply within one month (45 days for California requests). We will not treat you differently for using your rights. You may use an authorized agent; we will ask them for proof that you authorized them.

If you signed a document, your information is controlled by the sender; see section 4.

California

This section applies to California residents under the California Consumer Privacy Act.

• Categories we collect: identifiers (name, email address, IP address, account and key references); commercial information (plan and billing history); internet activity (use of the dashboard and websites, as described in section 2); professional information (your organization’s name and your role); and account login details (your email address and password, which only our authentication provider holds, in hashed form). We collect them from you, from your browser, and from your workspace’s owners and admins when they invite you.
• Purposes are those in section 3. Retention is in section 8.
• Disclosures: we disclose these categories to the service providers in section 6 for the business purposes described there.
• No sale or sharing: in the past 12 months we have not sold personal information or shared it for cross-context behavioral advertising, and we do not knowingly collect information from anyone under 16.
• Sensitive information: we use account login details only to let you sign in and keep your account secure.
• Your rights: to know, delete and correct your information, and not to be discriminated against for asking. Use them as described above.

10. Security

We protect information with encryption in transit and at rest, isolation between workspaces, hashed credentials, and restricted staff access. The measures are described in Annex III of the DPA and on our security page. To report a security problem, write to security@signenvoy.com.

11. Children

SignEnvoy is a service for businesses. You must be at least 18 to create an account, and we do not knowingly collect information from children.

12. Changes to this policy

When we make a material change to this policy, we will email account owners and admins at least 30 days before it takes effect, and update the date at the top of this page.

13. Contact

Privacy questions and requests: privacy@signenvoy.com, handled by our Privacy Administrator.

By mail: SignEnvoy, Inc., Attn: Privacy Administrator, 1044 E Brandon Blvd, Brandon, FL 33511.