Privacy policy

SignLink sends a PDF for signature and collects that signature online. Signers create no account. This page sets out exactly what the service collects, why, for how long, and what you can demand.

1. Who is responsible for what

The role of À COMPLÉTER depends on the processing, and the distinction decides who you should talk to:

• For customer accounts (sign-up, billing, usage figures), À COMPLÉTER is the controller. Address your requests to us directly.
• For document contents and signer data, À COMPLÉTER acts as a processor under Article 28 GDPR, on behalf of the sender who uploaded the document. They are the ones who decided to collect your signature. If you are a signer and want to know why you are being asked to sign, ask that person first. We will help you identify them if needed.

2. Data processed

If you send a document

• Email address, name if you provide one, and a password if you create an account.
• The PDF itself, its filename, its size and its cryptographic hash.
• Upload IP address, date and time.
• Stripe customer id and subscription status, if you take the paid plan.

If you sign a document

• The name and email address you enter.
• The image of your signature and initials, whether you draw them, pick a handwriting style or upload them.
• The wording the document asks you to reproduce by hand.
• A one-time verification code sent to your email address, and the fact that the address was verified.
• IP address, browser user agent and declared language, timestamped at consent and at signature.
• The cryptographic hash of the signed document.

We ask for no identity document, no date of birth and no national identifier. No special category data under Article 9 GDPR is requested. The contents of the document are outside our control: the sender chooses them, and we do not read them.

3. Why, and on what basis

4. Retention

• Documents and signatures: 7 days from upload (30 days when sent from a Pro account), then deleted automatically. Download your signed copy before then; afterwards we cannot provide it.
• Signing links: they expire with the document and stop working.
• Evidence of signature (verified identity, consent, timestamps, hashes, audit trail): kept beyond the document itself, because its whole purpose is to be producible if the signature is disputed. It does not contain the document contents.
• Customer account: until you delete it, then erased.
• Invoices: ten years, under accounting obligations.

5. Who else has access

We sell no data and pass none to advertisers. Only the providers the service needs are involved:

• Supabase Inc.: database and file storage, hosted in Paris (eu-west-3), France.
• Vercel Inc.: application hosting, running in Frankfurt (fra1), European Union.
• Resend: transactional email, including signing links and verification codes.
• Stripe: subscription payments. We never see your card number, which you enter with Stripe.

Some of these providers are established outside the European Union. Any transfer relies on the European Commission's standard contractual clauses. Service data itself is stored and processed in the Union.

6. Cookies and audience measurement

SignLink sets no advertising cookie and does no cross-site tracking. The only cookies used keep your session alive when you sign in to an account: they are strictly necessary and therefore need no consent. Audience measurement is aggregate and works without cookies or persistent identifiers. That is why there is no cookie banner: there is nothing for you to accept.

7. Security

• Encryption in transit and at rest.
• Document access through a link carrying a random, time-limited token, one per party.
• The signer's email address is verified with a one-time code before the signature is applied.
• Cryptographic hash of the document before and after signature, so later modification can be detected.
• Timestamped audit trail of signature events.

8. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. Write to contact@signlink.app. We answer within one month.

One limit is worth stating plainly: once you have signed a document, the evidence of that signature cannot be erased on request, since its very purpose is to remain enforceable. You can still ask for the erasure of anything not needed for that evidence.

If our answer does not satisfy you, you may complain to the French data protection authority, cnil.fr, or to your own supervisory authority.

9. Information at the point of collection

Article 13 GDPR requires this information to be given when the data is obtained. That is why this page is reachable from the signing page itself, before you sign anything.

10. Changes

Any substantial change will be announced on this page with a new update date. The applicable version is the one in force when you use the service.