Privacy Policy

Language: This text is available in German and English. The German version is legally binding. The English version is a translation for your convenience.

Last updated: 18.10.2026

1. Who is responsible

signround – Inh. Eray Yilmaz, Europaring 90, 53757 Sankt Augustin, Germany. Email: info@signround.com. Contact form: /contact. We are not required to appoint a data protection officer.

Two roles:

• For your account, our website and security logs, we are the controller.
• For documents you send (content, signer names and emails, signatures, audit trail), you (the sender) are the controller. We process this data on your behalf under our Data Processing Agreement (Art. 28 GDPR). If you are a signer, please send requests about a document to its sender. If you contact us, we will forward your request.

2. Data we process

• Account: name, email, company, password (stored only as a hash), logo and colour settings, login times, the date you accepted our terms.
• Documents: uploaded files (PDF, images, TXT) and the PDF created from them, field values, signatures (drawn, typed or uploaded image), templates.
• Signers: name, email, signing steps, decline reason.
• Audit trail: events, times, IP address, browser details, SHA-256 hashes of the original and final document.
• Emails: login, confirmation and password emails; delivery status of invitations, reminders and final documents.
• Paid plans (business customers): company name, billing address, VAT ID, plan, invoices, payment status. Card or bank details are handled by our payment provider; we do not store them.
• Contact form and emails to us: name, email, your message.
• Verification page (/verify): the document fingerprint (hash) is calculated in your browser. We do not store files you check there.
• Technical logs: IP address, time of request, errors.

We do not record handwriting speed or pressure. A signature is stored only as an image.

3. Why we use it and legal basis (Art. 6 GDPR)

• To provide your account and the service: contract (Art. 6(1)(b)).
• To run signing for senders: on their behalf as processor (see section 1).
• Security, misuse prevention and handling reports of illegal content: legitimate interest in a safe service (Art. 6(1)(f)).
• Answering your messages: Art. 6(1)(b) if it concerns your contract, otherwise Art. 6(1)(f).
• Billing for paid plans: contract (Art. 6(1)(b)); keeping invoices: legal duty (Art. 6(1)(c)).
• Legal duties, e.g. tax records: Art. 6(1)(c).
• Newsletter: your consent (Art. 6(1)(a)), see section 10.
• Only necessary cookies, no tracking (see Cookie Notice).

You need to give us your name and email to use the service. Without them we cannot create an account or send documents.

4. Recipients

• Other parties of a document: they receive the final PDF including the audit trail (names, emails, IP addresses, times).
• Our service providers: Supabase (database, file storage), Resend (sending emails), Netlify (website hosting and server functions), STRATO (our email inbox info@signround.com). See Subprocessors.
• Time stamp service: DigiCert, Inc. (USA) receives only a fingerprint (hash) of the completed PDF to add a time stamp. It receives no names, email addresses or document content.
• Payment provider for paid plans: Stripe Payments Europe, Ltd., Dublin, Ireland. Stripe processes payment data (e.g. card details) partly as its own controller, see stripe.com/privacy. Stripe may transfer data to Stripe, Inc. in the USA under the EU-US Data Privacy Framework and Standard Contractual Clauses.
• Tax advisor and tax office, for invoices.
• Authorities, only where the law requires it.

5. Where data is stored and processed

• Storage: documents, signatures, accounts and audit trails are stored in the EU, in Frankfurt, Germany (Supabase).
• Processing in the USA: our server functions run at Netlify on Amazon Web Services in the USA (Ohio). When you upload, sign or complete a document, the document, signature images, names, email addresses and IP addresses are processed there briefly. Nothing is stored there permanently.
• Emails are sent via Resend from an EU region (Ireland). Resend is a US company.
• Legal basis for transfers to the USA: the EU-US Data Privacy Framework (Netlify, Resend), as well as EU Standard Contractual Clauses (Supabase, and as a fallback for the others).

6. How long we keep data

• Documents (original file, PDF) and audit trail: until you delete them or your account.
• Signing links: expire when the document is completed, declined, voided or expired.
• Account data: deleted 30 days after you delete your account, unless the law requires us to keep it. During these 30 days the account is blocked.
• Technical logs: 30 days.
• Messages to us: 3 years after the matter is closed.
• Invoices and billing records: 8 years (German tax law, § 147 AO).
• Backups at our database provider: overwritten automatically after at most 7 days.

Please keep your own copy of completed documents. You are responsible for any legal duty to keep them.

7. Your rights

You have the right to access (Art. 15), correction (16), deletion (17), restriction (18), data portability (20) and to object (21). Where you gave consent, you can withdraw it at any time (7(3)). Contact: info@signround.com. You can complain to a data protection authority. Ours is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Düsseldorf, Germany.

8. Security

Encrypted connections, private file storage, access controls on every database table, signing links stored only as hashes, limits on repeated requests.

9. Automated decisions

We make no automated decisions with legal effect (Art. 22).

10. Newsletter

• What: news about signround, new features, blog posts, tips and offers. Up to 2 emails per month.
• Sign-up: only with your consent (Art. 6(1)(a) GDPR, § 7(2) German Unfair Competition Act). We use double opt-in: you receive an email and must confirm by clicking a link. If you do not confirm within 30 days, we delete your address.
• What we store: email address, name (optional), language, time and IP address of sign-up and confirmation, the consent text you saw. We keep this proof as long as you are subscribed and for 3 years after you unsubscribe (Art. 6(1)(c) and (f) GDPR), to show that we had your consent.
• No tracking: we do not measure whether you open emails or click links.
• Unsubscribe: any time, with the link in every email or by email to info@signround.com. After that, we keep your address only on a block list so that you get no more newsletters.
• Service provider: Resend (see Subprocessors).
• Email addresses of signers who were only invited to sign a document are never used for the newsletter.

11. Blog

Reading our blog requires no account and sets no extra cookies. We do not embed content from other providers (such as videos or social media posts). There is no comment function. Technical logs are kept as described in section 6.

12. Changes

We will update this page when needed and inform account holders of important changes.