Privacy Policy

1. Introduction

This policy applies to all users of the SignSeal platform whose accounts are provisioned by their organization. It describes our practices for handling personal data in connection with the service.

2. Information We Collect

• Account information: name, email address, phone number, department, and job title, as provided by your employer or through Active Directory synchronization.
• Documents: PDF files uploaded by your organization’s administrators for compliance purposes.
• Usage data: document viewing history, acknowledgment and signature timestamps, and interactions with the platform.
• Technical and audit data: IP addresses and immutable audit logs of security-relevant actions.

3. How We Use Information

• To provide and operate the document compliance management service.
• To track document acknowledgment and signatures for legal and regulatory compliance.
• To secure the platform, detect misuse, and maintain audit trails.
• To communicate with you, including notifications and reminders about pending documents.
• To generate compliance reports for your organization’s administrators.

4. Data Storage & Security

• Data is hosted on Supabase with enterprise-grade infrastructure and daily backups.
• All data is transmitted over HTTPS (TLS encryption in transit).
• Sensitive fields, such as phone numbers, are encrypted at rest using AES-256-GCM.
• Role-based access control ensures users only access data relevant to their role.
• All security-relevant actions are recorded in an immutable audit log.

5. Data Sharing

We do not sell or trade your personal data. Data is accessible only to your organization’s authorized administrators and to SignSeal operators for technical support. We rely on the following processors who handle data on our behalf:

• Supabase — database hosting and authentication.
• Vercel — application hosting.
• Resend — transactional email delivery.

6. Data Retention

We retain your data for as long as your organization maintains an active subscription. Upon cancellation, company data — including personal information, documents, and audit logs — is permanently deleted within 30 days, unless a longer retention period is required by law.

7. Your Rights

8. Cookies & Local Storage

• Session and authentication cookies are required to keep you signed in; the platform cannot function without them.
• Your language preference is stored in your browser’s local storage.
• We do not use third-party advertising or cross-site tracking cookies.

9. Children’s Privacy

The platform is intended for use by organizations and their personnel and is not directed to individuals under the age of 18. We do not knowingly collect personal data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the platform, and the “Last updated” date will reflect the latest revision.

11. Governing Law

This Privacy Policy is governed by the laws of the Hashemite Kingdom of Jordan, and any disputes are subject to the exclusive jurisdiction of the competent courts of Jordan.

12. Contact