> ## Documentation Index
> Fetch the complete documentation index at: https://docs.signyd.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy

# Signyd Privacy Policy

**Last updated:** October 24, 2026

This Privacy Policy explains how Villaces Inc., ("Signyd", "we", "us" or "our"), collects, uses, shares and protects personal data when you visit signyd.com, use the Signyd application at app.signyd.com, receive a document to sign, or use Signyd Verify (together, the "Service").

It should be read together with our [Terms and Conditions](https://docs.signyd.com/legal/terms.md), [Payments and Refunds Policy](https://docs.signyd.com/legal/payments.md), and [Cookie Policy](https://docs.signyd.com/legal/cookie.md).

## 1. Who is responsible for your data

We act in two roles:

* **As controller (or "business")** for data we collect for our own purposes: website visitors, account holders and billing contacts, support requests, security and fraud prevention, and legal compliance.
* **As processor (or "service provider")** for data contained in documents and signing workflows that our customers ("Customers") send through the Service. This includes the personal data of Signers. In that case the Customer decides why and how the data is used, and we process it on the Customer's instructions under our Data Processing Addendum. If you are a Signer and have questions about a document, contact the organization that sent it to you.

## 2. Data we collect

### 2.1 Data you provide

* **Account data:** name, business email, company name, role, login credentials and session information, and team member invitations.
* **Billing data:** billing name and address, plan, and transaction records. Payment card details are collected and processed by Stripe, and we do not store full card numbers.
* **Customer Content:** documents, templates, attachments, custom fields, signature images or typed signatures, names and email addresses of Signers, and messages sent with signature requests.
* **Support and communications:** the information you send to us when you contact support, request a demo or reply to our emails.

### 2.2 Data generated when you use the Service

For each signing event, the Service records evidence needed for the audit trail and Certificate of Completion, which may include:

* the document hash and signing events (viewed, signed, declined, completed);
* UTC timestamps;
* IP address of the Signer or Sender;
* a hash of the Signer's email address;
* browser type, device and operating system information provided by the browser;
* the authentication method used (for example a magic link).

We also keep technical logs (such as requests, errors and security events) to operate and protect the Service.

### 2.3 Identity verification data (Signyd Verify)

If a Customer enables Signyd Verify, the Signer may be asked to provide:

* images of a government-issued identity document and the data printed or encoded on it (such as name, date of birth, document number, nationality and expiry date);
* a live selfie or short video;
* biometric data derived from the selfie and the document photo (such as a facial geometry template) to compare them and detect spoofing;
* the result of the check (for example pass or fail, and reason codes).

See section 8 for more on biometric data.

### 2.4 Data from our website

We collect basic technical data when you visit signyd.com, such as IP address, browser type and pages requested, through server logs. We do not use third-party analytics, advertising or tracking tools. See our Cookie Policy.

## 3. How we use data and our legal bases

| Purpose | Examples | Legal basis (GDPR/UK GDPR) |
| :- | :- | :- |
| Provide the Service | Create accounts, deliver signing requests, generate sealed PDFs and Certificates, run Signyd Verify | Performance of a contract; for Signers, our Customer's instructions as processor |
| Billing and account management | Process payments, send invoices and renewal notices | Contract; legal obligation |
| Security and fraud prevention | Detect misuse, protect the audit trail, investigate incidents | Legitimate interests |
| Support | Respond to requests and troubleshoot issues | Contract; legitimate interests |
| Service communications | Verification emails, signing invitations, security alerts and policy updates | Contract; legitimate interests |
| Product improvement | Measure reliability and performance using aggregated or de-identified data | Legitimate interests |
| Legal compliance | Respond to lawful requests, enforce our Terms, keep records | Legal obligation; legitimate interests |
| Biometric processing | Verify a Signer's identity at the Customer's request | Explicit consent of the Signer, where required by law |

We do not use Customer Content to train artificial intelligence models, and we do not sell personal data or share it for cross-context behavioral advertising.

Health information: Customers on the Custom Plan who need to process protected health information under HIPAA may do so only under a business associate agreement (BAA) signed with Signyd. Do not submit protected health information on any other plan.

## 4. How we share data

We share personal data only as described here:

* **With the Customer and other parties to the document:** Signers' names, emails, signatures, timestamps and audit trail data are visible to the Sender and to other signers of the same document as needed to complete the agreement.
* **Service providers (subprocessors):** companies that help us run the Service, including: Cloudflare (application hosting, document storage and transactional email); Amazon Web Services (hosting for customers on the Custom Plan, including regional data residency where selected); OVH (infrastructure services); Stripe (payment processing); our **HSM** provider (cryptographic signing and sealing of completed documents); Gellum (hosting of signyd.com and corporate email, managed in Costa Rica by 3-102-944062 Sociedad de Responsabilidad Limitada, which uses services provided in the United States by Gellum Inc.); Mintlify (hosting of our product documentation); and, where Signyd Verify is enabled, Didit (didit.me), which performs identity document and biometric verification. They may only process data on our instructions and under confidentiality and security obligations. A current list of subprocessors is available on request at [legal@villaces.com](mailto:legal@villaces.com).
* **Legal and safety:** where required by law, court order or valid legal process, or to protect the rights, safety and security of our users, the public or Signyd.
* **Business transfers:** in connection with a merger, acquisition, financing or sale of assets, subject to protections consistent with this Policy.
* **With your consent or at your direction.**

## 5. International transfers

We are based in the United States. Documents and other Customer Content are stored in the United States by default, and Customers on the Custom Plan may choose a different region for data residency where available. Other data may be processed in the United States, in Costa Rica (where our hosting and corporate email provider Gellum is managed) and in other countries where we or our providers operate. Where we transfer personal data from the EEA, the UK or Switzerland to countries without an adequacy decision, we use appropriate safeguards, such as Standard Contractual Clauses and supplementary measures where needed.

## 6. How long we keep data

* **Account data:** for as long as the Account is active and for a reasonable period afterwards for legal, tax and dispute purposes.
* **Customer Content and signed documents, with audit trails:** for the period chosen by the Customer or, by default, for the life of the Account plus a limited export period, unless a longer period is required by law. Signed agreements and their Certificates of Completion may need to be retained so that their validity can be verified later.
* **Identity verification data:** images and biometric templates are kept only as long as needed to complete verification and the applicable dispute window, and in any case are destroyed within the period stated in our biometric retention schedule in section 8, unless the Customer or the law requires otherwise and the Signer has been informed.
* **Logs and security records:** generally up to 12 months, unless needed to investigate an incident.
* **Billing records:** as required by tax and accounting laws.

After these periods we delete or irreversibly anonymize the data.

## 7. Security

We use measures designed to protect personal data, including encryption in transit and at rest, access controls, logging, and **HSM**-protected keys for Signyd's cryptographic signature and seal (AATL certificates and TSA). No system is completely secure. If a breach affects your personal data we will notify you and the relevant authorities as required by law.

## 8. Biometric data notice

Signyd Verify may process biometric identifiers (such as facial geometry) and images of identity documents solely to verify the Signer's identity for the Customer who requested the check.

* **Consent:** we ask for the Signer's explicit consent before collecting biometric data, where required by law. If the Signer does not consent, they can decline, and the Customer may offer another way to sign.
* **Purpose limitation:** we do not sell, lease or trade biometric data, and we do not use it for advertising or for any purpose other than identity verification and fraud prevention.
* **Retention schedule:** biometric data and identity document images are deleted when the initial purpose is satisfied, or within 1 year after the verification, whichever occurs first, and in no case more than three years after the Signer's last interaction with the Service.
* **Sharing:** biometric data may be processed by Didit (didit.me), our identity verification provider, acting as our subprocessor, under confidentiality and data protection obligations.

## 9. Your rights

Depending on where you live, you may have the right to:

* access the personal data we hold about you and obtain a copy;
* correct inaccurate or incomplete data;
* delete your data;
* restrict or object to certain processing, including processing based on legitimate interests;
* data portability;
* withdraw consent at any time, where processing is based on consent, without affecting prior processing;
* not be subject to decisions based solely on automated processing with legal effects, where applicable;
* lodge a complaint with your local data protection authority.

To exercise these rights, email [legal@villaces.com](mailto:legal@villaces.com). We may ask you to verify your identity. If your data is in a document sent by one of our Customers, we may refer your request to that Customer, because they control the data. We will respond within the time required by law (generally within one month under GDPR and 45 days under U.S. state laws). You will not be discriminated against for exercising your rights.

### Additional information for U.S. residents

In the past 12 months we have collected the categories of personal information described in section 2 (identifiers, commercial information, internet or network activity, audio, electronic or visual information such as selfie images, biometric information, and professional information). We disclose them to the recipients described in section 4 for business purposes. We do not sell personal information or share it for cross-context behavioral advertising, and we do not knowingly sell or share data of people under 16. Residents of certain states (including California, Colorado, Connecticut, Virginia, Texas and Florida) may have the rights in section 9 and may appeal a refusal by writing to [legal@villaces.com](mailto:legal@villaces.com).

### Additional information for EEA and UK residents

Villaces Inc. is the controller for the data described in section 1.

## 10. Children

The Service is intended for businesses and individuals aged 18 or older. We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we will delete it.

## 11. Third-party links

The Service may contain links to third-party websites or services that have their own privacy practices. We are not responsible for them.

## 12. Changes to this Policy

We may update this Policy from time to time. We will post the new version with a revised "Last updated" date and, for material changes, notify account holders by email or in the Service before the changes take effect.

## 13. Contact us

Villaces Inc. Privacy and legal: [legal@villaces.com](mailto:legal@villaces.com) Support: [support@signyd.com](mailto:support@signyd.com)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.