Privacy Policy

DRAFT — pending legal review Effective date: [effective date — set when counsel approves this draft] Contact: access@essentialworktools.com Draft pending legal review. This is not legal advice, and it is not in effect until counsel approves it. This Privacy Policy describes how TrueSign handles information when a customer sends a document and when a person signs it. It is a draft for a hosted electronic-signature service. It is not a promise about a customer's own privacy practices. A customer may replace this text for the documents it sends. Who is responsible The customer (the business that sends the document) is the data controller for signer information it uploads or collects through TrueSign. TrueSign is the processor of that signer data. TrueSign uses it to run the service the customer asked for. TrueSign is the controller for its own account data, such as a customer's login and billing contact, if billing is added later. There is no separate billing provider in the product today. Information we collect - Names and email addresses of account users, signers, and people copied on a document. - Documents, field values, and signature images. - IP address, user agent, and device details the browser sends, plus the time of each action. - Document hashes and the append-only audit trail. - For in-person signing, the host user who handed over the device, with that device's IP address and user agent. - Email delivery status (sent, delivered, bounced, or complained) when the email provider reports it. We do not ask signers to create a password to sign. We do not sell personal information. How it is used TrueSign uses this information to show the document, record who signed, build the audit certificate, detect changes to the file, email links and the finished PDF, and keep the service secure. The customer uses it to complete the transaction it started. Email and hosting Email is sent through Resend. The service is hosted on Railway. They receive the information needed to deliver mail and to run the application, including message contents and stored files on the host. TrueSign does not authorize them to use signer data for their own marketing. Sharing The finished PDF and the audit certificate are sent to the signers, the people the customer copied, and the sender. TrueSign shares information with the email and hosting providers above, and when the law requires it. TrueSign does not sell this information. Retention How long a completed document is kept follows the sending organization's retention setting. Until the customer sets a number of days, documents are kept. After a purge, the PDF and stored field values can be removed. The audit trail, including names and emails already written into it, is kept so the hash chain can still be checked. Customers should download copies they need to keep for their own records. Security Access to the application requires an account. Secrets such as webhook signing keys and uploaded certificate passwords are encrypted at rest. The audit trail is append-only and hash-chained. You should still use a unique password and treat signing links as private. Signer choices A signer may decline a request before signing. That withdraws consent to sign that document electronically. A signer who wants paper, or who has a question about how the customer will use the information, should contact the customer who sent the document. Account holders can ask TrueSign, at the contact below, for access or correction of account information. Children TrueSign is a business service. It is not directed at children under 16, and customers must not use it to collect information from children. Governing law This policy is governed by the laws of the State of Oregon, without regard to conflict-of-law rules. Contact Privacy questions about the TrueSign service: access@essentialworktools.com Privacy questions about a document you were asked to sign: contact the business named on the request.