Privacy Policy

The Service is provided by the OnlineSignatures operator.

The operator's contact details and up-to-date information about the owner of the Service are published on the relevant legal pages of the site.

For questions related to the processing of personal data, the user may contact us through the Contact Us page or by the email address indicated on the site.

Depending on which functions of the Service the user uses, the following categories of data may be processed.

2.1. Account data

Registration and authorization in OnlineSignatures are performed using a Google account.

When creating or using an account, we may receive from Google and store the data necessary for the Service to operate, including:

• email address;
• unique Google account identifier;
• name or display name, if provided by Google and required for the relevant function;
• technical information related to authorization.

OnlineSignatures does not receive or store the user's Google account password.

Authentication is performed through Google OAuth infrastructure. Use of Google is also governed by Google's own policies and terms.

2.2. Email

To send service-related emails, OnlineSignatures uses Amazon Simple Email Service (Amazon SES).

Depending on the functions used, Amazon SES may send:

• account-related messages;
• security notifications;
• subscription notifications;
• document-related messages;
• links to access documents;
• API notifications;
• other necessary service messages.

Amazon SES is used exclusively as an email infrastructure provider. We do not sell users' email addresses to Amazon SES or other third parties for their own marketing purposes.

Depending on the functions of the Service used, the user may create, upload or process:

• images of their own signatures;
• photographs or images of signatures;
• documents;
• PDF files;
• images;
• Microsoft Word documents and other supported formats;
• logos;
• profile images;
• documents intended for signing by other persons;
• other materials the user independently submits to the Service.

Such materials are processed solely to the extent necessary to provide the relevant functions of the Service, ensure security, prevent abuse, and fulfill legal obligations.

We do not sell user documents, signature images or other user materials to third parties.

Some OnlineSignatures functions run directly in the user's browser.

Depending on the specific function, processing may be performed locally on the user's device without transmitting the source material to the OnlineSignatures server.

For example, a photograph or image of a signature may be processed directly in the user's browser.

However, certain functions, including saving the result, creating a document, sending a document, syncing between devices, or using the API, may require transmitting the relevant data to OnlineSignatures' server infrastructure.

The user should therefore review the description of the specific function and the Service's settings.

To store user files and related data, OnlineSignatures uses Cloudflare R2.

Depending on the function used, Cloudflare R2 may store:

• signature images;
• documents;
• document pages;
• images;
• temporary files;
• logos;
• other materials necessary to provide the relevant function.

Cloudflare Workers and other Cloudflare infrastructure components may be used to process, route and deliver files.

Access to object storage is restricted by technical security measures. In certain cases, temporary or otherwise secured links may be used to access files.

Cloudflare is a third-party infrastructure provider. Cloudflare's data processing is governed by Cloudflare's own applicable terms and policies.

Because Cloudflare provides a global infrastructure, data processing may take place in various countries and jurisdictions.

When visiting and using the Service, technical information necessary for its operation, security and analysis may be processed automatically.

It may include:

• IP address;
• approximate location, determined by IP address;
• browser type and version;
• device type;
• operating system;
• browser or interface language;
• time zone;
• cookie information;
• date and time of access to the Service;
• pages visited;
• functions used;
• technical logs;
• error information;
• other technical data necessary for the operation and protection of the Service.

We use such information to:

• ensure the Service operates properly;
• protect accounts;
• prevent fraud;
• prevent automated attacks;
• detect abuse;
• diagnose technical issues;
• analyze performance;
• improve the Service;
• investigate incidents;
• resolve disputes.

Users of paid API tariffs may use the OnlineSignatures API in accordance with the terms of the relevant tariff plan.

When API requests are performed, the following may be processed:

• the API key or API key identifier;
• IP address;
• User-Agent;
• date and time of the request;
• the endpoint used;
• the number of requests;
• information necessary to calculate API usage;
• the technical status of the request;
• information necessary to ensure API security.

This data is used to:

• provide the API;
• account for usage;
• apply tariff limits;
• prevent abuse;
• protect infrastructure;
• investigate technical and security incidents.

API keys must be kept secure by the user and must not be shared with third parties.

OnlineSignatures uses cookies and similar technologies.

8.1. Necessary cookies

Some cookies are necessary for:

• authorization;
• security;
• account operation;
• saving settings;
• protection against abuse;
• the proper operation of the Service's functions.

Disabling such cookies may cause certain functions to work incorrectly.

8.2. Analytics cookies

To analyze use of the Service and improve its operation, we may use Google Analytics.

Google Analytics may process technical information about site usage in accordance with Google's applicable settings and policies.

8.3. Advertising technologies

Certain pages of the Service may display advertising using Google AdSense and related advertising technologies.

Such technologies may use cookies or similar identifiers to display and measure advertising in accordance with the user's settings and applicable law.

The user can manage the available cookie settings through the consent-management mechanism provided on the site, where such a mechanism is available in the relevant jurisdiction.

We may use the user's data for the following purposes:

1. providing and maintaining the operation of the Service;
2. registering and authorizing users;
3. creating and storing user signatures;
4. processing documents;
5. providing document-signing functions;
6. sending documents and notifications;
7. providing the API;
8. managing subscriptions and tariffs;
9. processing payments;
10. providing technical support;
11. ensuring security;
12. preventing fraud and abuse;
13. diagnosing errors;
14. analyzing use of the Service;
15. improving functionality;
16. sending necessary service messages;
17. complying with legal requirements;
18. establishing, exercising or defending legal claims.

Depending on the specific purpose of processing, we may process data on the following bases:

• the necessity to perform a contract with the user;
• the necessity to provide the service requested by the user;
• the user's consent;
• compliance with a legal obligation;
• OnlineSignatures' legitimate interest, including ensuring security, preventing fraud, improving the Service and protecting rights and legitimate interests.

Where processing is based on the user's consent, the user has the right to withdraw such consent at any time, unless otherwise provided by applicable law.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

To process paid orders and subscriptions, OnlineSignatures uses a third-party payment provider.

OnlineSignatures does not store users' full bank card data on its servers.

Depending on the payment method chosen, the payment provider may process:

• payment instrument data;
• the name or billing details provided by the user;
• billing address;
• transaction data;
• subscription information;
• data necessary to process refunds;
• information necessary to prevent fraud;
• data necessary to handle chargebacks and payment disputes.

Once the payment provider is finally selected, its name and applicable data-processing policy will be specified in this section and on the relevant payment pages.

To operate OnlineSignatures, we use individual infrastructure and service providers.

Depending on the function used, these may include:

• Google — authorization and related services;
• Amazon Web Services / Amazon SES — sending email;
• Cloudflare — CDN, security, request processing, Workers, and R2 object storage;
• Google Analytics — analytics;
• Google AdSense — advertising technologies;
• a payment provider — processing payments and subscriptions;
• other technical providers necessary for the Service to operate.

Such providers receive only the data necessary to provide the relevant service.

We do not sell users' personal data.

We may disclose the user's data to third parties only where necessary, including:

• to provide the relevant function of the Service;
• to process a payment;
• to send a service message;
• to ensure security;
• to prevent fraud;
• to investigate abuse;
• to comply with a legal obligation;
• to comply with a lawful request from a government authority or court;
• to protect the rights and legitimate interests of OnlineSignatures, users, or third parties.

We do not provide user documents or signature images to third parties for their own commercial use.

In certain cases, authorized OnlineSignatures employees or administrators may obtain limited access to account data or user materials where necessary for:

• technical support;
• fault diagnosis;
• incident investigation;
• ensuring security;
• preventing abuse;
• fulfilling legal requirements.

Such access is limited to the necessary scope and is not used for independent commercial use of user content.

We apply reasonable technical and organizational measures to protect information from:

• unauthorized access;
• unlawful alteration;
• disclosure;
• loss;
• destruction;
• unlawful use.

Security measures may include:

• secure connections;
• access control;
• restriction of administrative access;
• secure object storage;
• temporary secured links;
• API protection;
• security monitoring;
• measures against automated attacks;
• logging of certain technical operations.

Despite the measures applied, no method of transmission or storage of data over the Internet can guarantee absolute security.

We retain data only for as long as necessary for the relevant purpose, unless a longer period is required by law.

The retention period depends on the type of data.

Account data

Account data may be retained until the user deletes the account or until the need to retain it ceases.

Documents and signatures

The retention period for documents and signature images depends on the function used, the settings chosen by the user, and the relevant tariff plan.

Temporary documents, links and files may be automatically deleted after the established access period ends.

Technical logs

Technical and API logs are retained for a limited period necessary for the operation, security, diagnostics and abuse prevention of the Service.

Payment data

Payment information may be retained longer where necessary for accounting, tax, legal record-keeping, refund processing, or resolving payment disputes.

The user may delete their account using the functions available in the Service or by contacting support.

After an account is deleted, the relevant personal data and user materials are deleted or anonymized in accordance with the established retention procedures.

Some data may be retained after account deletion where necessary for:

• compliance with legal requirements;
• tax or accounting record-keeping;
• processing a refund;
• resolving a payment dispute;
• preventing fraud;
• protecting rights and legitimate interests;
• establishing, exercising or defending legal claims.

In such cases, only the information necessary for the relevant purpose is retained.

Depending on the user's country of residence and applicable law, the user may have the right to:

• access their personal data;
• obtain information about its processing;
• correct inaccurate or incomplete data;
• request deletion of data;
• restrict processing;
• object to certain processing;
• withdraw consent;
• receive a copy of certain data;
• lodge a complaint with a competent data-protection authority.

To exercise these rights, the user may contact us through the Contact Us page or by the email address indicated on the site.

We may request additional information necessary to verify the identity of the requester and to protect the account from unauthorized requests.

OnlineSignatures is an international service available to users from various countries.

To operate the Service, we use providers that may process data in different countries and jurisdictions.

Therefore, the user's personal data may be processed outside the country of their residence, including countries where data-protection legislation may differ from the legislation of the user's country.

Where applicable law establishes special requirements for the international transfer of personal data, we apply the legally required protective mechanisms.

Some OnlineSignatures functions allow the user to send documents to other persons for viewing or signing.

In such cases, the user independently determines the recipients of the relevant document.

The user is responsible for having the necessary rights and permissions to share the document, its content, and any personal data it contains with third parties.

OnlineSignatures does not verify the user's rights to each document uploaded to the Service.

OnlineSignatures is not intended for unlawful use.

It is prohibited to use the Service to:

• forge documents;
• create or use forged signatures;
• impersonate another person without permission;
• commit fraud;
• sign documents without authorization;
• deceive third parties;
• unlawfully gain access to documents;
• infringe the rights of third parties;
• engage in any other unlawful activity.

Additional restrictions are set out in the OnlineSignatures Terms of Use.

If abuse is detected, we may restrict or terminate access to the relevant account and take other necessary measures.

The Service is not intended for persons under 16 years of age or another minimum age established by applicable law.

We do not intentionally seek to collect personal data from children below the relevant age.

If we become aware that such data has been provided without the necessary legal basis, we will take reasonable steps to delete it.

OnlineSignatures may contain links to third-party sites, applications or services.

We do not control the content, security, or data-processing practices of such third-party resources.

Use of a third-party resource is governed by its own terms and privacy policy.

We may periodically amend this Privacy Policy.

In the event of material changes, an updated version will be published on this page with a new effective date.

Where required by applicable law, we will additionally notify users of material changes.

We recommend checking this page periodically.

If you have any questions regarding this Privacy Policy or the processing of personal data, please contact us through the Contact Us page or at the contact email address indicated on the site.

OnlineSignatures.net