Privacy Policy

About this policy

eSignSimple is operated by Mustafa Buğra Sözeri (Mobtive), a sole proprietorship based in Türkiye, which is the controller of the personal data described in this policy. If anything is unclear, email hello@esignsimple.com.

This policy explains what personal data eSignSimple (“we”, “us”) processes when you visit esignsimple.com, use our free in-browser tools, send documents for signature or sign a document someone sent you, and what rights you have over that data.

Data we process

Account data: the name, email address and profile picture from the Google account you use to sign in. Sign-in is handled by Google through Firebase Authentication, so we do not store a password.

Documents: the PDFs you upload to send for signature, the fields placed on them, the completed signed PDFs and their certificates of completion.

Signer data: the names and email addresses of the people a sender asks to sign, and the signatures, initials and field values they enter.

Audit trail data: for each event on a document (sent, opened, signed, completed, downloaded), a timestamp, IP address and device and browser information. This data is the evidence that makes a signature meaningful and is central to the service.

Website analytics: we use Google Analytics to understand how visitors use our site, such as which pages are viewed and approximate location derived from IP address. Google Analytics uses cookies or similar identifiers.

Correspondence: messages you send to hello@esignsimple.com.

Free tools: files you open in the Fill PDF tool and signatures you create in the signature generator are processed entirely in your browser and are not uploaded to us. We do not receive or store them. Documents you sign with the Sign PDF tool are uploaded and stored like any other document in your account.

Why we process it and our legal bases

To provide the service you asked for: creating your account, storing and delivering documents, emailing signers, sending reminders, recording the audit trail and producing certificates. For senders, the legal basis under the GDPR is performance of a contract (Article 6(1)(b)).

To process signer data on behalf of senders: when a sender asks someone to sign, the sender decides which documents and people are involved. For the content of those documents, the sender is generally the controller and we act as a processor on their behalf. For the audit trail we keep to operate and secure the service, we rely on our legitimate interests and those of the parties in having reliable evidence of signing (Article 6(1)(f)).

To secure and improve the service, prevent abuse and fix problems: legitimate interests.

To understand how our website is used with Google Analytics: your consent where required by law, otherwise legitimate interests. You can decline analytics cookies where a consent choice is offered, or block them in your browser.

To comply with legal obligations, such as responding to lawful requests from authorities: legal obligation (Article 6(1)(c)).

We do not sell personal data and do not use your documents to train machine learning models or for advertising.

How long we keep data

Documents are kept until the sender deletes them. Audit trail data and certificates are retained together with the document they relate to and are deleted with it. Signers who need a copy should download the completed document when they receive it.

Account data is kept while your account is active. If you close your account, we delete your account data and documents within a reasonable period, except where we must keep limited records to comply with law or resolve disputes.

Analytics data is retained according to the retention settings of our Google Analytics property. Email correspondence is kept as long as needed to deal with your request and for a reasonable period afterwards.

Who processes data for us

We use a small number of service providers (processors) who handle data on our instructions: Hetzner, which hosts our servers and stored data in the European Union; Cloudflare, which provides content delivery, network and security services and therefore handles traffic to our site; and Google, which provides Google Analytics and, through Firebase Authentication, Google sign-in. We also use an email delivery provider to send signing requests and notifications.

Payments are handled by Creem (creem.io), our reseller and merchant of record. When you buy a paid plan, Creem receives your name, email address, billing country and payment details to process the payment, issue invoices and handle taxes. We never see or store your full card number.

Some providers may process data outside the European Economic Area, for example in the United States. Where that happens, we rely on appropriate safeguards such as the European Commission's standard contractual clauses or an adequacy decision.

We may disclose data if required by law, to protect our rights or users' safety, or as part of a business transfer, in which case this policy would continue to apply to your data.

Security

We protect data with encryption in transit and at rest, access controls and a tamper-evident audit trail. No system is perfectly secure, and we are an early-access service without formal security certifications. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as the law requires.

Your rights

Depending on where you live, you have the right to access your personal data, correct it, delete it, restrict or object to certain processing, receive a copy in a portable format, and withdraw consent at any time where we rely on consent. You also have the right to complain to a data protection supervisory authority, for example the authority in the EU country where you live.

If you are a signer and your data is in a document sent by someone else, we may refer your request to that sender, since they control the document. Note that deleting audit data from a completed agreement can affect its value as evidence for all parties, so some requests may be balanced against the legitimate interests of the other signers.

To exercise your rights, email hello@esignsimple.com. We aim to respond within one month.

Children, changes and contact

eSignSimple is not directed at children under 16 and we do not knowingly collect their data.

We will update this policy as the service develops. When changes are material, we will tell account holders by email or on the site before they take effect. The date at the top shows the latest version.

Questions or requests: hello@esignsimple.com.