Privacy Policy

Data we collect

• Account data: your email address and, if you provide them, your name and branding (company name, logo).
• Documents and signer details:the documents you create or upload, field values, and each signer's name and email address.
• Audit trail data: for each signer, IP address, browser user agent and timestamps of views, one-time-code verification, consent, signatures and declines.
• Billing data: plan, credits and transaction references. Card details are handled by Paddle and never reach us.

Why we use it

• To provide the Service: sign-in, sending documents, collecting signatures and delivering final PDFs.
• To create a tamper-evident audit trail and certificate that can prove how a document was signed.
• To process payments, prevent fraud and abuse, and keep the Service secure (for example rate limiting).
• To send service emails such as one-time codes, signing requests, reminders and completion notices.

Our legal bases are performance of a contract, our legitimate interests in operating a secure and reliable service, and compliance with legal obligations. For signers, we rely on legitimate interests: providing a reliable signing process and evidence of it.

Signers

If you are asked to sign a document, the sender chose to send it to you and gave us your name and email address. Before we send you a one-time code, we show you a short notice that links to this policy. Your name, email address, IP address and device appear on the certificate attached to the signed document. Every party to the document receives that certificate.

Processors and payments

We use these service providers to run KarmaKoders Sign, each under its own data processing terms:

• Vercel: website and application hosting
• Neon: database hosting
• Cloudflare: encrypted file storage (R2)
• Resend: transactional email
• Upstash: rate limiting

Paddle.com is the merchant of record for purchases. It is an independent controller of the payment data it collects, and its own privacy notice applies to it.

Retention

• Completed documents: 7 years.
• Drafts: deleted after 12 months without changes.
• Declined, voided or expired documents: 2 years.
• When a sender deletes a completed document: we delete its document files, but keep its certificate and audit trail for the rest of the 7 years, as evidence for every party to it.

One-time codes and expired sessions are deleted regularly. Billing records are kept as long as tax law requires.

Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, to receive a copy of it, to object to or restrict how we use it, and to complain to a data protection authority.

Under the GDPR and UK GDPR you may request access to, correction of, deletion of, restriction of or a copy of your personal data, object to processing, and complain to your data protection authority.

We do not sell personal information.

Signers' data inside a document is controlled by the sender; we will forward signer requests to the sender where appropriate.

International transfers

We and our processors may process data outside your country, including in India, the United States and the European Union. For personal data from the European Economic Area and the United Kingdom, we use the European Commission's Standard Contractual Clauses and the UK Addendum to them, and each provider's data processing terms. We process personal data in line with India's Digital Personal Data Protection Act 2023.

Contact and requests

Send privacy requests to info@karmakoders.com. We reply within 1-2 business days and complete requests within the time the law requires.