Privacy policy

What we collect

Sender and signer name, email address, IP address, browser user agent, and a SHA-256 hash of the original document. Nothing else.

What we don't store

The PDF itself. It is encrypted at rest and deleted immediately after signing. Pending unsigned documents are deleted after 30 days.

Legal basis

Processing is necessary to perform the signing service you requested — Art. 6(1)(b) GDPR (performance of a contract).

Retention

Signing records (names, emails, document hash, timestamp) are retained indefinitely as an audit trail for future signature validation. Pending unsigned documents and their records are deleted after 30 days.

Third parties

Emails are delivered via Resend (EU-compliant, Standard Contractual Clauses apply). This site uses Plausible Analytics — cookieless, no personal data collected. No other third parties receive your data. No cookies are set.

Infrastructure

All processing on EU servers only — Hostinger VPS, Lithuania. No US cloud providers.

Your rights

Under GDPR you have the right to access, correct, or request deletion of your personal data, and to lodge a complaint with your national data protection authority.

Contact: john@stitchedlogic.com