Privacy Policy

Account information: your name, work email, organization, role and sign-in details.

Transaction activity: requests, submissions, approvals, signatures, messages and access records.

Content you upload: samples and supporting documents, which may contain personal data about other people.

Usage and device information, such as log data and browser type. Payment details are collected by our payment provider, not stored by us.

To run the transaction pipeline, confirm that you can act for your organization, scan samples for quality and personal data, keep the audit trail, prevent fraud and abuse, contact you about your account and transactions, improve the platform, and meet legal obligations.

Data owners are responsible for having a lawful basis for any personal data they submit. We detect personal data in samples and flag or redact it so it can be removed or pseudonymized at the source.

We process this data only to deliver the transaction it belongs to. We do not use sample content to train our own models, and we do not keep full datasets unless a delivery mode requires it under the license.

Under the GDPR and UK GDPR, we rely on performance of a contract, our legitimate interests in running and securing the platform, compliance with legal obligations, and, where required, your consent.

Other parties to your transaction see what they need to act on it, such as your name, organization, role and approvals.

Service providers that help us run the platform, listed on our Subprocessors page, under contracts that limit their use of the data.

Authorities, where the law requires it, and a successor in a merger or acquisition, under the same protections. We do not sell personal data.

Where personal data leaves the European Economic Area or the United Kingdom, we use approved safeguards such as the European Commission's Standard Contractual Clauses.

Account data is kept while your account is open. Transaction records are kept for the life of the license and any statutory retention period after it. Samples are deleted when they are no longer needed for the transaction, unless the parties agree otherwise.

Access to transaction data is limited to the parties and to staff who need it. Access is logged. Data is encrypted in transit and at rest.

You can ask to access, correct, delete, restrict or port your personal data, object to processing, and withdraw consent. Contact [email protected], or our data protection officer at [email protected]. You may also complain to your data protection authority.

If personal data about you appears in a sample or deal document, we will pass your request to the party responsible for it and help them respond.

California residents have similar rights under the CCPA and CPRA, including the right to know, delete and correct personal information. We do not sell or share personal information for cross-context advertising.

General Data is not intended for anyone under 18, and we do not knowingly collect their personal data.

We will post any changes on this page and notify you of material ones. Questions: [email protected].