Privacy

We store your workspace, clients, documents, signatures (name, email, IP, user agent, document hash), and billing identifiers needed to run the product.

Public document links are unguessable. We do not list documents to the public. Signed PDFs are stored privately and issued through short-lived downloads.

We use Supabase for database, auth, and file storage; Resend for transactional email; and Dodo Payments for Client Kit subscription billing. We never collect your client’s card on our merchant account.

Data about your clients

When you send a job link, we store what you enter about the client (name, email, WhatsApp number if you add it, GSTIN and billing address if you add them). When the client opens the link we record the time, IP address and browser identifier, so you can see that it was opened and so there is a record of agreement. When they sign, we store the typed name, email, time, IP, browser identifier and a SHA-256 fingerprint of the exact document. When they tell you they paid, we store the amount, method and the UTR or transaction reference they typed (never a screenshot). If they verify by email code, we store only a one-way hash of the code and that it was used. All of this exists to create a tamper-evident record of the job for both sides; it is shown to the client on the link, and to you in the dashboard and the Proof Pack. We do not show the client’s IP address in the dashboard; it stays in the audit record.

If you connect your own Razorpay account, we store your key and webhook secret encrypted and use them only to create payment links on your account and to read Razorpay’s “paid” notifications. Disconnecting deletes them.

Lawful basis (India DPDP Act 2023; GDPR for visitors in the EU): performance of the agreement between you and your client, and your legitimate interest in keeping a record of it. Retention after you delete your account is described in the Terms. Clients can ask us or you to see or correct their data at the address on the About page.

Client links carry no advertising or session-recording trackers.