Privacy Policy
Version 2026-10-29 · Effective 2026-10-29
This Privacy Policy explains how [Legal entity name] ("Parapho", "we", "us") collects, uses, shares and protects personal data when you use the Parapho website, applications, signing pages and APIs (the "Service"). It also explains the choices and rights you have.
1. Our role: controller or processor
Parapho acts in two different capacities:
- As a controller for account data about our customers' users (for example your name, email, password hash, authentication and security logs, and billing contacts) and for website visitors.
- As a processor (or "service provider") for Customer Data: the documents, templates, field values, signatures and recipient details that a customer workspace uploads or collects through the Service. The customer (the organization that sends a document) is the controller of that data, and we process it only on their documented instructions under our Data Processing Addendum.
If you received a document to sign from a Parapho customer, that customer is responsible for how your data is used in the agreement. See section 12.
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, work email, workspace name, role, hashed password (scrypt), encrypted two-factor secret, hashed recovery codes, terms acceptance records | You |
| Customer Data | Uploaded PDFs, templates and field layouts, recipient and witness names and emails, typed text and choices, signature, initials and image uploads, file attachments signers upload, messages to recipients, workspace branding (logo, colors, reply-to address) | Customers and signers |
| Audit and evidence data | Timestamps of each envelope event (sent, viewed, consent given, signed, declined, voided), IP address, browser user agent, SHA-256 document fingerprints | Collected automatically when the Service is used |
| Security data | Sign-in attempts, two-factor events, session records (IP, user agent, created and last-seen times), account lockouts | Collected automatically |
| Billing data | Plan, billing interval, Stripe customer and subscription identifiers, usage counts (envelopes, API envelopes), billing name and address, and any business tax ID you provide (used to calculate tax). Payment card details are collected and stored by Stripe, not by us | You and Stripe |
| Integration data | Hashed API keys and their usage times, webhook URLs, encrypted webhook signing secrets, allowed embed origins | Workspace admins |
| Communications | Emails we send on a customer's behalf (subject, recipient, delivery status); support correspondence | You and us |
| Verification requests | The SHA-256 fingerprint of a file submitted for verification (never the file itself) and the requesting IP address for rate-limiting | Anyone using the verify page |
We do not sell personal data, we do not use Customer Data to build advertising profiles, and we do not use Customer Data to train machine-learning models.
3. How we use data and our legal bases
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Providing the Service: storing documents, routing envelopes, sending signing invitations and reminders, producing sealed PDFs and certificates of completion | Performance of a contract (Art. 6(1)(b)); for Customer Data, the customer's instructions as controller |
| Creating tamper-evident audit trails that can show who signed, when and from where | Legitimate interests of the customer and signers in enforceable agreements (Art. 6(1)(f)); legal obligation where record-keeping is required (Art. 6(1)(c)) |
| Securing accounts: two-factor authentication, rate limiting, lockouts, fraud and abuse detection, security logs | Legitimate interests in protecting users and the Service (Art. 6(1)(f)) |
| Service emails such as invitations, security alerts and legal notices | Performance of a contract; legitimate interests |
| Recording your acceptance of these terms and of electronic-signature disclosures | Legal obligation; legitimate interests |
| Complying with law, responding to lawful requests, enforcing our Terms | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have balanced them against your rights. You can object at any time (see section 10).
4. Quick Sign and verification run on your device
Quick Sign (/quick) processes your PDF entirely inside your browser using open-source libraries. The file, your signature and the signed result are never sent to our servers. If you choose "Remember my signature on this device", the signature image is kept in your browser's local storage, where only you can see it. You can remove it at any time from the same screen or by clearing your browser data.
Verification (/verify) calculates the file's SHA-256 fingerprint in your browser and sends only that fingerprint to us. If it matches a sealed document, we show the document title, sender, completion time and signer names with partially masked email addresses.
5. How we share data
- With other participants in an envelope. Signers see the document and the values other signers have already completed. Senders see each recipient's status and audit events. The final sealed PDF, including its certificate of completion, is available to every participant.
- Within your workspace. Members of a workspace can see that workspace's templates and envelopes. Admins can see team membership and integration settings.
- With sub-processors who host and operate the Service for us (see section 6), under written contracts that require confidentiality and appropriate security.
- With destinations you configure, such as your webhook endpoint or the website that embeds signing.
- For legal reasons, when we believe in good faith that disclosure is required by law or legal process. Where permitted, we will notify the affected customer first and challenge requests that are overbroad.
- In a business transfer, such as a merger or acquisition, subject to this Policy.
6. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services, Inc. (Amazon RDS for PostgreSQL) | Encrypted database hosting | Region selected for your deployment |
| Amazon Web Services, Inc. (Amazon S3, AWS KMS) | Encrypted document storage and key management | Region selected for your deployment |
| Twilio Inc. (SendGrid) | Delivering signing invitations and service emails (link and open tracking disabled) | United States |
| Stripe, Inc. | Subscription billing and payment processing. Card details go directly to Stripe and never reach our servers | United States |
We will give at least 30 days' notice of new sub-processors to customers who subscribe to updates, so they can object.
7. International transfers
Customer Data is stored in the AWS region chosen for the deployment. Where personal data is transferred out of the UK, EEA or Switzerland, we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum where relevant), together with supplementary measures such as encryption in transit and at rest.
8. Retention
- Customer Data is kept until the customer deletes it (workspace admins can permanently delete an envelope, its documents and its audit trail) or closes their workspace. Sealed documents and audit trails exist to provide evidence, so customers decide how long to keep them.
- Account data is kept while your account is active. When you delete your account, we delete your profile immediately and remove it from backups within 35 days.
- Security logs are kept for 12 months and then deleted automatically.
- Sessions expire after 30 minutes of inactivity, and after 12 hours at most, by default. Expired session records are purged automatically.
- We may keep limited records for longer where required by law, or to establish, exercise or defend legal claims.
9. Security
We use administrative, technical and physical safeguards appropriate to the risk, including: mandatory two-factor authentication for every account; scrypt password hashing; encryption in transit (TLS 1.2+) and at rest (AES-256 with AWS KMS); database row-level security that isolates each workspace; single-use, hashed signing links; private object storage with no public access; strict browser security headers; rate limiting and account lockout; and tamper-evident sealing of completed documents. See our Security overview. No system is perfectly secure. If we learn of a personal data breach affecting you, we will notify you and the relevant authorities as the law requires, and within 72 hours where GDPR applies.
10. Your rights
Depending on where you live, you may have the right to: access your personal data; correct it; delete it; restrict or object to processing; data portability; withdraw consent where processing relies on consent; and not be subject to decisions based solely on automated processing.
Signed-in users can export their account data and delete their account under Account security → Your data. For anything else, email [privacy@yourdomain]. We will respond within one month (GDPR) or 45 days (US state laws), and we may need to verify your identity first. If your request concerns Customer Data, such as a document someone sent you, we will refer it to the customer who controls that data and help them respond.
11. US state privacy rights
Residents of California and other US states with comprehensive privacy laws have the right to know, access, correct and delete personal information, and to opt out of its "sale" or "sharing" for cross-context behavioral advertising. We do not sell or share personal information as those terms are defined, and we do not process sensitive personal information to infer characteristics. We will not discriminate against you for exercising your rights. You may use an authorized agent to submit requests. In the last 12 months we collected the categories in section 2 for the business purposes in section 3, and disclosed them only to the recipients in section 5.
12. If you were asked to sign
You don't need a Parapho account to sign. When you open a signing link we record your consent to do business electronically, each action you take, and your IP address and browser details. We store your signature image and field values with the document, and include them in the certificate of completion. This evidence lets everyone involved show that the agreement was validly signed. The sender is the controller of this information. Please contact them about how they use or keep the agreement. We will help them respond to any request you make.
13. Cookies and local storage
We use only strictly necessary storage. We do not use advertising or analytics cookies, and we do not load third-party trackers, fonts or scripts.
| Name | Type | Purpose | Duration |
|---|---|---|---|
__Host-parapho_sid | HTTP-only, Secure, SameSite cookie | Keeps you signed in. Holds a random token; the server stores only its hash. | Up to 12 hours |
parapho-quick-sig | Local storage (optional) | Remembers your Quick Sign signature on this device, only if you opt in | Until you remove it |
parapho-ac-* | Session storage | Remembers an access code you entered for a protected document during that browser tab's session | Until the tab closes |
Because these are strictly necessary, no consent banner is required. You can block them in your browser, but sign-in will not work without the session cookie.
14. Children
The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
15. Automated decisions
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Automated security controls, such as temporary lockouts after repeated failed sign-ins, can be reviewed by contacting us.
16. Changes to this policy
We will post any changes here and update the version date. If a change is material, we will notify account holders by email or in the app at least 30 days before it takes effect.
17. Contact and complaints
[Legal entity name], [Registered address]. Privacy and data protection enquiries: [privacy@yourdomain].
You have the right to complain to a supervisory authority, such as the UK Information Commissioner's Office (ico.org.uk) or the data protection authority where you live or work. We would appreciate the chance to address your concern first.