1. Introduction
Welcome to True Autograph (“we,” “our,” or “us”). Protecting your privacy and the security of your data is fundamental to our service. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website, application, and related e-signature services (collectively, the “Services”).
By accessing or using our Services, you agree to the data practices described in this policy. If our Services are provided to you through your employer or another organization, that organization may act as the "Data Controller," and their specific privacy policies may also apply to your information.
2. Information We Collect
We collect information to provide a legally binding e-signature experience, secure your account, and improve our platform.
A. Information You Provide Directly
- Account & Contact Details: When you register, we collect your name, email address, password, and phone number.
- Billing Information: If you purchase a paid subscription, we collect payment details (processed securely via our third-party payment providers) and billing addresses.
- Profile & Signature Data: We collect the signatures and initials you save, your profile photo, the documents you upload for signing, and any mapped data signers type into them. Documents, signatures, and answers for a request are deleted when it ends (see Data Retention).
- Communications: Information you share when contacting customer support, submitting feedback, or participating in surveys.
B. Information We Collect Automatically
- Audit & Transactional Data: To ensure the legal validity of electronic signatures, we automatically record metadata surrounding document transactions. This includes IP addresses, authentication methods, timestamps, and the sequence of actions taken by all signers.
- Device & Usage Data: We log information about the device you use to access our Services (e.g., operating system, browser type) and how you navigate our platform (e.g., pages visited, time spent, error logs).
- Cookies & Tracking Technologies: We use cookies to keep you logged in, remember your preferences, and understand how our Services are used.
- Website Analytics (Google): Our public pages, such as our home, pricing, and help pages, use Google Analytics, loaded through Google Tag Manager, to understand which pages are useful. Google collects the pages you visit, time on page, the site that referred you, your approximate location (city or region), your browser and device type, and a cookie that recognizes a returning visitor. These tools do not run on signing pages or inside your account, and never receive your documents, signatures, or signer details. You can block these cookies in your browser, or opt out with Google's browser add-on at https://tools.google.com/dlpage/gaoptout. Google's privacy policy is at https://policies.google.com/privacy.
C. Information from Third Parties
- Third-Party Integrations: If you connect your account to third-party tools (e.g., Google Workspace, CRM software), we may receive information to facilitate that integration.
- Google API Disclosure: Our use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Customer Data obtained through Google Workspace APIs to train generalized AI or machine learning models.
- Other Users: We may receive your name and email address if another user sends you a document to review or sign.
3. How We Use Your Information
We use your data strictly to operate our business and provide you with a reliable e-signature platform. Your information is used to:
- Deliver the Services: Create your account, facilitate document signing, and process payments.
- Ensure Legal Validity: Generate secure, verifiable audit trails for signed documents.
- Maintain Security: Detect and prevent fraud, unauthorized access, and malicious activities.
- Provide Support: Respond to your inquiries and troubleshoot technical issues.
- Improve the Platform: Analyze usage trends to optimize the user experience and develop new features.
- Communicate: Send transactional emails (e.g., signature requests, account updates) and marketing messages (which you can opt out of at any time).
4. How We Share Your Information
We do not sell your personal data. We only share your information in the following circumstances:
- With Other Users: When you send, sign, or review a document, your name, email, signature, and relevant audit data are visible to the other parties involved in that specific transaction.
- With Service Providers: We use trusted third-party vendors to help run our infrastructure, process payments, send emails, and analyze platform data. These partners are legally bound to protect your data.
- For Legal Compliance: We may disclose information if required by law, subpoena, or court order, or to protect the rights, property, and safety of True Autograph, our users, or the public.
- Business Transfers: If we are involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. You will be notified of any such change in ownership.
5. Data Retention
Zero retention. True Autograph does not keep the documents people sign. When a request ends, we delete the document, every signature and initials image, and every answer typed into it:
- Signed by everyone: right after the signed PDF is emailed to every signer and the sender. If the request was sent from a connected CRM (such as Salesforce or HubSpot), we wait until the CRM has saved its copy, for up to three days. If the signed PDF was too large to attach and was sent as a download link, we wait until the link expires, seven days later.
- Declined or voided: right away.
- Expired unsigned: 30 days after it expires, so the sender can reopen it until then.
- Never sent: drafts are deleted 30 days after they were last changed, and files uploaded but never used are deleted after a day.
What we keep, and why: the record that proves each agreement. That is who signed, their email address, when and how they signed, the IP address and browser they signed from, the consent they gave, the name they typed, and SHA-256 fingerprints of the original and the signed PDF. We keep this record indefinitely, because it is what establishes the legal validity and non-repudiation of the agreement. It does not include the document itself.
What you keep in your own account until you delete it: your templates (including their PDFs), your saved signatures, and your logo. We keep your account details for as long as your account is active.
Copies outside True Autograph: the signed PDF sent by email passes through our email provider, and copies you ask us to send elsewhere (your CRM, or your own systems through webhooks or the API) are kept under those systems' own policies. A document you send for AI review is processed by our AI provider to produce the review and is not stored by True Autograph.
6. Your Privacy Choices & Rights
Depending on your location (such as California or the European Economic Area), you have specific rights regarding your personal data:
- Access & Export: Request a copy of the personal data we hold about you.
- Correction: Update or correct inaccurate account information.
- Deletion: Request the deletion of your personal data. Documents, signatures, and answers are already deleted when each request ends; we may be legally required to keep the record that proves an agreement (see Data Retention).
- Opt-Out of Marketing: Click "unsubscribe" in any promotional email to stop receiving marketing communications.
- Cookie Preferences: Manage or disable cookies through your browser settings. To opt out of Google Analytics, use Google's add-on at https://tools.google.com/dlpage/gaoptout.
To exercise any of these rights, please contact us at support@trueautograph.com.
7. Security
We implement robust organizational, technical, and physical security measures to protect your data from unauthorized access, loss, or alteration. While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet is 100% secure.
8. Children's Privacy
Our Services are intended for professional and adult use. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that a minor has provided us with personal information, we will take steps to delete it.
9. Changes to this Policy
We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. If we make material changes, we will notify you via email or by posting a prominent notice on our platform before the changes take effect.
10. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us at: support@trueautograph.com
