Privacy Policy

What we collect

We collect only what we need to run the service:

• Account details. Your name, email address, profile picture and the settings you choose, such as language and time zone. If you sign in with Google or a passkey, we receive what is needed to identify you.
• Documents and signatures. The documents you upload, send or receive, the values entered in their fields, your saved signatures and the contacts you save.
• Selfie videos. When a sender asks for selfie verification: the video you record, a still frame placed in the signed PDF, and your location if you allow your browser to share it.
• Activity and device. Your IP address, browser and device type, sign-in times, active sessions, and the audit events for each document you take part in.
• Payments. The tokens you buy and when. Card payments are handled by Stripe; we keep only the card brand and its last four digits.

How we use it

We use your data to:

• send, sign and store documents, and tell you when something needs your attention;
• create the digital signature, audit trail and evidence that show who signed and when;
• keep accounts secure, for example with two-step sign-in and by spotting misuse;
• process payments and keep the records the law requires;
• answer your questions and fix problems.

We do not sell your personal data, and we do not use your documents or videos for advertising.

Selfie videos and face checks

While you record, checks that one face is visible and that the person is present run in your own browser. We do not create a face template or use your video for facial recognition.

The video is encrypted (AES-256) before it is stored. It is kept with the document as evidence, available to the sender and to anyone the signed document and its evidence are shared with, until the document is deleted or an automatic deletion rule removes it.

Who we share it with

We share personal data only:

• with the other people on a document, who see the names, email addresses and signatures of everyone on it, and its audit trail;
• with the admins of a workspace, for documents that the workspace owns;
• with the providers that run parts of the service for us: our cloud host, Google (email delivery, Google sign-in, the AI features and, if you choose it, the Google Drive file picker) and Stripe (payments);
• when the law requires it, or to protect the rights and safety of our users.

AI features

If you use AI document generation or automatic field placement, the text you enter and the pages of that document are sent to Google Gemini to produce the result. Nothing is sent to Gemini unless you use one of these features.

How long we keep it

We keep your data while your account is open. Documents and selfie videos stay until you delete them, or until an automatic deletion rule you turn on in Settings, under Data & Privacy, removes them. Automatic deletion is off unless you turn it on.

When you close your account, we wait 30 days and then delete your personal content. Audit trails of documents other people signed and purchase records are kept with your details removed, for as long as the law requires.

Your choices and rights

From your account you can:

• download a copy of your data (Settings, under Data & Privacy);
• correct your profile details (Settings, under Profile & Account);
• choose which emails and in-app notifications you receive;
• close your account and have your data deleted.

Depending on where you live, you may also have the right to object to or restrict how we use your data, and to complain to your data protection authority. Contact us to use any of these rights.

Security

Data travels over encrypted connections (HTTPS). Selfie videos are encrypted at rest, and every completed document is digitally signed so that any later change is visible. Access inside a workspace follows the roles its admins set, and you can protect your account with passkeys and two-step sign-in.

Cookies

SelfieSign uses only the cookies it needs to work:

• a session cookie that keeps you signed in and protects your forms;
• a language cookie that remembers the language you picked;
• a time zone cookie so that dates are shown in your local time.

We do not use advertising or third-party analytics cookies. Some pages also keep unsaved work in your browser storage so that it is not lost.

Children

SelfieSign is not intended for children under 16, and we do not knowingly collect their data.

Changes to this policy

If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect. The date at the top shows when it last changed.