What we collect

If you have an account: your email, name, a hashed password (or Google/passkey login instead), an optional profile photo, and your plan/payment status.

If you're signing a document someone sent you: the name, email, and phone number the sender entered for you, plus your IP address, timestamp, and signature image at the moment you sign - this forms the legal audit trail that makes the signature valid.

If you choose Google Drive when uploading: you pick the Google account and the exact files; we get access only to those files (Google's drive.file permission), only for that upload. The access token stays in your browser and is never stored by us, and it is separate from how you log in to SignThru.

We don't collect: card details (handled entirely by our payment processor, Mamo Pay), tracking cookies, analytics scripts, or any data from anyone under 18.

Why we collect it

• To run your account and let you send, sign, and store documents
• To verify signer identity with a one-time code before each signature
• To keep a legal audit trail proving who signed what, when, and from where
• To send you the transactional emails the service needs (links, OTPs, confirmations) - never marketing, unless you opt in
• To enforce your plan's document and signer limits

Who we share it with

We don't sell or rent your data. It only goes to the vendors that make SignThru work:

• Mamo Pay - processes subscription payments
• Google - only if you choose to sign in with Google

We'll disclose data if legally required to, and only the minimum necessary.

How long we keep it

• Your account and documents - while your account is active, deleted on request
• Signing audit trail (IP, timestamp, verification record) - 7 years, a legal requirement for the signature to hold up, not something we can shorten
• Login sessions - 30 days, cleared on logout
• OTP codes - 10 minutes, then gone

Your rights

You can access, correct, export, or delete your data, and object to or restrict how we use it. Email [email protected] and we'll respond within 30 days. EU users can also complain to their local data authority; UAE users to the TDRA.

Security

• Everything travels over TLS-encrypted connections
• Passwords are hashed, never stored as plain text
• Passkeys use the WebAuthn standard - your device never shares the actual key
• Documents and audit data sit in access-locked storage, readable only by the SignThru service itself

Cookies

One cookie: a secure, HTTP-only session token that keeps you logged in for up to 30 days. No ad or tracking cookies.

Changes to this policy

If we make a material change, we'll email active account holders at least 14 days ahead and update the date at the top of this page.

Contact us