Signyd Privacy Policy
Last updated: October 24, 2026 This Privacy Policy explains how Villaces Inc., (“Signyd”, “we”, “us” or “our”), collects, uses, shares and protects personal data when you visit signyd.com, use the Signyd application at app.signyd.com, receive a document to sign, or use Signyd Verify (together, the “Service”). It should be read together with our Terms and Conditions, Payments and Refunds Policy, and Cookie Policy.1. Who is responsible for your data
We act in two roles:- As controller (or “business”) for data we collect for our own purposes: website visitors, account holders and billing contacts, support requests, security and fraud prevention, and legal compliance.
- As processor (or “service provider”) for data contained in documents and signing workflows that our customers (“Customers”) send through the Service. This includes the personal data of Signers. In that case the Customer decides why and how the data is used, and we process it on the Customer’s instructions under our Data Processing Addendum. If you are a Signer and have questions about a document, contact the organization that sent it to you.
2. Data we collect
2.1 Data you provide
- Account data: name, business email, company name, role, login credentials and session information, and team member invitations.
- Billing data: billing name and address, plan, and transaction records. Payment card details are collected and processed by Stripe, and we do not store full card numbers.
- Customer Content: documents, templates, attachments, custom fields, signature images or typed signatures, names and email addresses of Signers, and messages sent with signature requests.
- Support and communications: the information you send to us when you contact support, request a demo or reply to our emails.
2.2 Data generated when you use the Service
For each signing event, the Service records evidence needed for the audit trail and Certificate of Completion, which may include:- the document hash and signing events (viewed, signed, declined, completed);
- UTC timestamps;
- IP address of the Signer or Sender;
- a hash of the Signer’s email address;
- browser type, device and operating system information provided by the browser;
- the authentication method used (for example a magic link).
2.3 Identity verification data (Signyd Verify)
If a Customer enables Signyd Verify, the Signer may be asked to provide:- images of a government-issued identity document and the data printed or encoded on it (such as name, date of birth, document number, nationality and expiry date);
- a live selfie or short video;
- biometric data derived from the selfie and the document photo (such as a facial geometry template) to compare them and detect spoofing;
- the result of the check (for example pass or fail, and reason codes).
2.4 Data from our website
We collect basic technical data when you visit signyd.com, such as IP address, browser type and pages requested, through server logs. We do not use third-party analytics, advertising or tracking tools. See our Cookie Policy.3. How we use data and our legal bases
We do not use Customer Content to train artificial intelligence models, and we do not sell personal data or share it for cross-context behavioral advertising.
Health information: Customers on the Custom Plan who need to process protected health information under HIPAA may do so only under a business associate agreement (BAA) signed with Signyd. Do not submit protected health information on any other plan.
4. How we share data
We share personal data only as described here:- With the Customer and other parties to the document: Signers’ names, emails, signatures, timestamps and audit trail data are visible to the Sender and to other signers of the same document as needed to complete the agreement.
- Service providers (subprocessors): companies that help us run the Service, including: Cloudflare (application hosting, document storage and transactional email); Amazon Web Services (hosting for customers on the Custom Plan, including regional data residency where selected); OVH (infrastructure services); Stripe (payment processing); our HSM provider (cryptographic signing and sealing of completed documents); Gellum (hosting of signyd.com and corporate email, managed in Costa Rica by 3-102-944062 Sociedad de Responsabilidad Limitada, which uses services provided in the United States by Gellum Inc.); Mintlify (hosting of our product documentation); and, where Signyd Verify is enabled, Didit (didit.me), which performs identity document and biometric verification. They may only process data on our instructions and under confidentiality and security obligations. A current list of subprocessors is available on request at legal@villaces.com.
- Legal and safety: where required by law, court order or valid legal process, or to protect the rights, safety and security of our users, the public or Signyd.
- Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to protections consistent with this Policy.
- With your consent or at your direction.
5. International transfers
We are based in the United States. Documents and other Customer Content are stored in the United States by default, and Customers on the Custom Plan may choose a different region for data residency where available. Other data may be processed in the United States, in Costa Rica (where our hosting and corporate email provider Gellum is managed) and in other countries where we or our providers operate. Where we transfer personal data from the EEA, the UK or Switzerland to countries without an adequacy decision, we use appropriate safeguards, such as Standard Contractual Clauses and supplementary measures where needed.6. How long we keep data
- Account data: for as long as the Account is active and for a reasonable period afterwards for legal, tax and dispute purposes.
- Customer Content and signed documents, with audit trails: for the period chosen by the Customer or, by default, for the life of the Account plus a limited export period, unless a longer period is required by law. Signed agreements and their Certificates of Completion may need to be retained so that their validity can be verified later.
- Identity verification data: images and biometric templates are kept only as long as needed to complete verification and the applicable dispute window, and in any case are destroyed within the period stated in our biometric retention schedule in section 8, unless the Customer or the law requires otherwise and the Signer has been informed.
- Logs and security records: generally up to 12 months, unless needed to investigate an incident.
- Billing records: as required by tax and accounting laws.
7. Security
We use measures designed to protect personal data, including encryption in transit and at rest, access controls, logging, and HSM-protected keys for Signyd’s cryptographic signature and seal (AATL certificates and TSA). No system is completely secure. If a breach affects your personal data we will notify you and the relevant authorities as required by law.8. Biometric data notice
Signyd Verify may process biometric identifiers (such as facial geometry) and images of identity documents solely to verify the Signer’s identity for the Customer who requested the check.- Consent: we ask for the Signer’s explicit consent before collecting biometric data, where required by law. If the Signer does not consent, they can decline, and the Customer may offer another way to sign.
- Purpose limitation: we do not sell, lease or trade biometric data, and we do not use it for advertising or for any purpose other than identity verification and fraud prevention.
- Retention schedule: biometric data and identity document images are deleted when the initial purpose is satisfied, or within 1 year after the verification, whichever occurs first, and in no case more than three years after the Signer’s last interaction with the Service.
- Sharing: biometric data may be processed by Didit (didit.me), our identity verification provider, acting as our subprocessor, under confidentiality and data protection obligations.
9. Your rights
Depending on where you live, you may have the right to:- access the personal data we hold about you and obtain a copy;
- correct inaccurate or incomplete data;
- delete your data;
- restrict or object to certain processing, including processing based on legitimate interests;
- data portability;
- withdraw consent at any time, where processing is based on consent, without affecting prior processing;
- not be subject to decisions based solely on automated processing with legal effects, where applicable;
- lodge a complaint with your local data protection authority.