DPDP Act 2023 Compliant

Privacy Policy

Learn how we collect, use, protect, and handle your contract data, verification records, and personal information in compliance with data privacy regulations.

Last updated: October 6, 2026

Create Free Contract See How It Works

SignSenders ("we," "us," "our") is committed to protecting your privacy and handling your personal data in full compliance with applicable data protection laws, including the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at signsenders.online.

1. INFORMATION WE COLLECT & CONSENT MECHANISMS

We collect personal data strictly on lawful grounds with clear, unambiguous, and informed consent:

1.1 Information You Provide:

Account Information: Name, email address, password (stored in salted, hashed format)
Profile Information: Business name, professional details you add
Contract Content: Client names, client emails, project descriptions, payment terms, scopes of work, and custom clauses you enter
Communication: Messages and inquiries you send to our support team

1.2 Information Collected Automatically:

Device & Browser Data: IP address, browser type, operating system, device identifiers
Usage Data: Pages visited, features used, timestamps, referral sources
Verification & Audit Data: When contracts are signed, we record:
- Signer's IP address and geolocation indicators
- Signer's device user-agent string
- Exact UTC and local timestamps of viewing and signing
- Out-of-band OTP verification results (success/failure)
- WebAuthn biometric verification status (Face ID / Fingerprint / Passkey cryptographic proofs)
- Cryptographic hash (SHA-256) of the signed document

1.3 Client Consent Mechanism:

When a client accesses the contract signing page via an authorized link, a prominent consent notice is displayed informing them that their name, email address, IP address, device details, and biometric authentication status will be processed and sealed in a tamper-evident audit trail for legal contract enforceability. Clients must review the document terms and provide explicit, affirmative consent prior to executing the agreement.

1.4 Payment Information:

When you purchase contract credits, payment processing is handled securely by certified third-party payment gateways (such as Razorpay). We do not store complete credit/debit card numbers, CVVs, or UPI PINs on our servers. We receive only transaction identifiers, payment verification status, and purchase amounts.

2. HOW WE USE YOUR INFORMATION

We use the collected information for specific, necessary purposes:

Provide, maintain, and enhance the SignSenders contract signing platform
Generate legally-binding contracts, authenticate parties via OTP and WebAuthn biometrics, and create verifiable PDF records
Generate immutable audit trails and completion certificates compliant with the IT Act, 2000 and the Indian Evidence Act
Send transactional communications (signing links, signature confirmations, link renewals, credit balance updates)
Respond to customer support inquiries and provide technical assistance
Monitor and prevent fraud, unauthorized access, abuse, and security incidents
Comply with statutory obligations under Indian data protection and electronic transaction laws

3. HOW WE SHARE YOUR INFORMATION

We do not sell, rent, or trade your personal information to third parties. We disclose data solely in the following defined circumstances:

With Contract Counterparties (Clients): When you send a contract, the recipient client receives the contract text and your identification details as the sender.
With You (the Freelancer): When a client executes the agreement, you receive their signature metadata, timestamp, IP address, and the complete audit certificate.
Authorized Service Providers: We work with trusted infrastructure providers for:
- Secure cloud hosting and database storage (with end-to-end encryption at rest and in transit)
- Transactional email and messaging delivery
- Payment gateway processing
- These providers access only the minimal data required to perform their contracted duties and are bound by stringent confidentiality and data protection obligations.
Legal Compliance & Regulatory Authorities: We may disclose information if required by applicable law, court order, regulatory summons, or law enforcement authority to protect our legal rights, security, or the safety of users.

4. DATA SECURITY

We implement robust technical and organizational security measures to protect personal data against unauthorized access, alteration, disclosure, or destruction:

Passwords are securely hashed using bcrypt with salt
One-Time Passwords (OTPs) and biometric challenge tokens are cryptographically hashed and single-use
All network traffic is encrypted using modern TLS 1.3 / HTTPS
Database access is enforced through strict Row-Level Security (RLS) policies and least-privilege service-role access
Signed contracts and audit certificates are sealed with SHA-256 cryptographic hashes for tamper-evidence

5. DATA BREACH NOTIFICATION

In compliance with the Digital Personal Data Protection Act, 2023:

In the event of a personal data breach affecting personal information on SignSenders, we will notify the Data Protection Board of India within 72 hours of becoming aware of the incident.
We will notify all affected users without delay, providing clear details regarding the nature of the breach, the categories of data affected, potential consequences, and the immediate remedial and mitigation measures taken.

6. DATA RETENTION

Contract records, signed PDF certificates, and associated audit logs are retained for a minimum of 7 years to uphold legal enforceability under applicable contract and limitation laws.
User account information is retained for the duration of an active account.
Upon an account deletion request, user profiles are purged; however, executed legal contracts involving counterparties will be retained strictly for the statutory limitation period required by law.

7. YOUR RIGHTS (DPDP ACT 2023)

Under the Digital Personal Data Protection Act, 2023, you have comprehensive rights regarding your personal data:

7.1 Right to Access & Summary:

You have the right to request a summary of the personal data being processed and the identities of third parties with whom it has been shared.

7.2 Right to Correction & Erasure:

You may request the correction of inaccurate or misleading data, the completion of incomplete data, or the erasure of personal data that is no longer necessary for the purpose it was collected.

7.3 Right to Withdraw Consent:

You may withdraw your consent to data processing at any time by emailing us at [email protected]. Please note that withdrawing consent will result in the termination of platform services and account deletion (subject to mandatory legal retention for already executed contracts).

7.4 Right to Nominate:

You have the right to nominate another individual who shall, in the event of your death or incapacity, exercise your data protection rights in accordance with the provisions of the DPDP Act. To record or update a nomination, please reach out to our Grievance Officer at [email protected].

7.5 Right of Grievance Redressal:

You have the right to readily available grievance redressal through our designated Grievance Officer.

To exercise any of these rights, contact us at: [email protected]

8. COOKIES & TRACKING

We use strictly essential cookies and authentication tokens necessary for platform navigation, security verification, and session management. We do not deploy third-party advertising tracking cookies or sell your browsing behaviors.

9. CHILDREN'S PRIVACY

SignSenders is intended exclusively for individuals who are at least 18 years of age and legally competent to enter into contracts. We do not knowingly collect or process personal data belonging to minors.

10. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically to reflect technological, legal, or operational updates. We will notify you of material changes by publishing the updated policy on this page with an updated "Last Updated" date.

11. GRIEVANCE OFFICER (DPDP ACT COMPLIANCE)

In accordance with the Digital Personal Data Protection Act, 2023, the contact details of our designated Grievance Officer are provided below:

Designation: Data Protection & Grievance Officer

Email: [email protected]

Response Time: Within 30 days of receiving the grievance

For any complaints, data protection requests, or concerns regarding the handling of your personal data, please write directly to our Grievance Officer at [email protected].

12. CONTACT US

If you have any questions or concerns regarding this Privacy Policy or our security practices, please contact us at:

Email: [email protected]

Website: signsenders.online