Privacy Policy
Last updated October 15, 2026 · Effective date: [EFFECTIVE DATE]
1. Who we are
EasySign is an electronic signature service operated by[LEGAL ENTITY NAME], a[ENTITY TYPE AND STATE OF FORMATION], located at[STREET ADDRESS] ("EasySign", "we", "us"). This policy explains what personal information we handle when you use easysignit.com, the EasySign app, or sign a document sent through EasySign.
2. Businesses and their signers
EasySign has two kinds of users:
- Senders: businesses (and the people who work for them) who create an account and send forms for signature.
- Signers: the people a sender asks to review and sign a form. Signers don't need an account.
When a business sends you a form through EasySign, that business decides what goes in the form, who receives it, and what it does with the signed copy. The business is responsible to you for that information. EasySign processes it on the business's behalf to deliver the form, verify your email address, record your signature and keep the signed record. If you have questions about a form you received, or want to exercise a right over it, contact the business that sent it; we will help them respond.
3. What we collect
From senders
- Account details: your email address and password. Passwords are handled by Amazon Cognito; we never see or store them in readable form.
- The business name you enter when sending a form.
- The forms you send: the recipient's name and email address and the details you fill in (for example member name, phone number, dates).
- Activity records: when you create, send, resend, cancel or download a document, along with your IP address and browser user agent.
From signers
- Your name and email address, as provided by the sender.
- The form contents the sender filled in, and any fields you complete (for example your name in "Acknowledged by").
- Your signature (a typed name or a drawn image) and your initials.
- Verification and consent records: that we emailed you a one-time code and that you entered it correctly (we keep a one-way hash of the code, never the code itself), and the exact electronic-records consent text you agreed to, with its version.
- Technical details at each step: date and time, IP address and browser user agent.
From visitors to easysignit.com
- Standard request logs kept by our hosting provider (such as IP address and the page requested). We don't use analytics, advertising or tracking tools on the site.
4. How we use it
- To provide the service: send signing requests, one-time codes and confirmation emails; show the form to the signer; record the signature; produce the signed PDF and certificate of completion.
- To prove what happened: the signed PDF, the certificate of completion and an audit trail record who signed, how they were verified, what they agreed to and when. Each audit entry is linked to the one before it, so a changed or removed entry can be detected.
- To keep the service secure: rate limits, lockouts after repeated wrong codes, and investigating misuse.
- To operate our business: account administration, support and complying with law.
We don't sell personal information, and we don't use it for advertising.
5. Who we share it with
We use these service providers to run EasySign. They process data only to provide their services to us.
| Provider | What they do | What they receive |
|---|---|---|
| Amazon Web Services (US East, N. Virginia) | Hosting, databases (DynamoDB), file storage (S3), encryption keys (KMS), sign-in (Cognito), email delivery (SES), content delivery (CloudFront), computing (Lambda) | All data described in this policy, stored and processed on our behalf |
| DigiCert | Independent timestamp for sealed documents | Only a cryptographic hash of the document, not its contents or anyone's personal details |
| Twilio | Text-message delivery, if SMS is enabled (it is not used today) | The recipient's phone number and message text |
We also share information with the business that sent a form (it receives the signed PDF, the certificate of completion and the audit trail), when required by law, or to protect the rights and safety of our users and EasySign. If EasySign is involved in a merger or sale, information may transfer as part of that transaction under this policy.
6. Cookies and browser storage
We don't set advertising or analytics cookies. The app uses your browser's session storage only to keep you signed in (senders) or to remember that you verified your code (signers). Session storage is cleared when you close the tab. Signer sessions also expire after one hour.
7. Security
- All connections use HTTPS (TLS).
- Documents and records are encrypted at rest with keys managed in AWS Key Management Service.
- Signing links contain a random token; we store only a one-way hash of it. Links expire after 7 days unless the sender resends.
- Before a signer can view a form, we email a 6-digit one-time code. Codes expire after 10 minutes and the link locks after 5 wrong attempts.
- Completed documents and certificates are digitally sealed and timestamped, so any later change is detectable.
No system is perfectly secure. If we learn of a breach affecting your information, we will notify you and the sending business as the law requires.
8. How long we keep it
- Signed documents, certificates of completion and audit records are kept for7 years from completion in write-once storage. During that period they arelocked against change or deletion; the lock can only be overridden by a restricted administrative permission that we use only where the law requires it. This protects the integrity of the signed record for both parties. After 7 years they are deleted automatically.
- Signing links and one-time codes expire (links after 7 days; codes after 10 minutes). Link records are removed automatically about 30 days after they expire.
- Rate-limit counters are kept for minutes and then removed automatically.
- Account details are kept while your account is open.
Because of the 7-year lock, we cannot delete a signed document, its certificate or its audit record before the period ends, even on request. We will tell you this when you ask, and we will restrict the record to the purposes above.
9. The /verify page
Anyone can upload a PDF at easysignit.com/verify to check whether its EasySign seal is intact. The file is processed only to run that check and is not stored. If the file exactly matches a document we sealed, the page shows the document title, the sending business's name and the date it was completed: information already contained in the file.
10. Your rights
Depending on where you live, you may have the right to:
- know what personal information we hold about you and get a copy;
- correct information that is wrong;
- delete your information, except signed records still within the 7-year retention period (see section 8);
- object to or restrict certain processing; and
- not be treated differently for exercising these rights.
These include rights under US state privacy laws (such as the California Consumer Privacy Act) and, where they apply, laws like the EU and UK GDPR. If you signed a form for a business, contact that business first; we will support its response. Otherwise contact us at[CONTACT EMAIL]. We will verify your request and reply within the time the law requires.
11. Children
EasySign is not intended for children. Senders must be at least 18. We don't knowingly collect information from children under 16; if a business sends a form to a minor, the business is responsible for any required parental consent.
12. Where your data is processed
EasySign stores and processes data in the United States (AWS US East region). If you use EasySign from outside the US, your information will be transferred to and processed in the US.
13. Changes to this policy
We will post any changes on this page and update the date above. If a change materially affects how we use your information, we will notify account holders by email before it takes effect.
14. Contact us
[LEGAL ENTITY NAME]
[STREET ADDRESS]
[CONTACT EMAIL]