Privacy Policy

1. Information we process

Accounts and profiles. You may provide your name, email address, password, organization, telephone number, website, profile details and workspace membership information. We maintain account identifiers, roles, settings and service-plan information.

Authentication and security. We process password verification information, sessions, account verification and recovery requests, and security events. If you enable multi-factor authentication, we maintain authentication setup information and protected recovery-code verification records. Do not send passwords, authenticator secrets or recovery codes to support.

Google and other external login providers. When you choose Sign in with Google or link your Google Account, ReviSign receives only the identity information authorized for that login flow. The requested scopes are openid, email and profile. Information may include a provider-specific account identifier, email address, email-verification status and display name, depending on what Google supplies. Not every field is necessarily available. We use the provider identifier to associate the login with your ReviSign User, and record linking and use times. Google authentication does not expand your document permissions.

ReviSign does not request Gmail, Google Drive, Calendar, Contacts or other unrelated Google service access for login. We do not receive your Google password. Google operates its authentication service under its own policies; its availability does not imply endorsement of ReviSign. Other enabled external login providers may supply comparable identity information for the login you authorize.

Documents and signing content. We process uploaded files, templates, document fields and entered values, recipients’ names and contact details, recipient assignments, signatures and initials, review comments, and supporting attachments. Documents may contain personal or confidential information supplied by customers or recipients.

Signing evidence and activity. Envelope identifiers, workflow status, timestamps, recipient actions, delivery and signing events, revisions, completion records and audit evidence help operate and document a transaction. Depending on the action, technical evidence may include IP address and browser or device information.

Alternate identities, Rooms and integrations. We process alternate email addresses and verification records, Room members and invitations, document versions, tasks, comments and activity, and API client identifiers, permissions and webhook records. Other users may provide your information when adding you as a recipient or member. BuyRest-sponsored access links product accounts and uses source-account identifiers, eligibility, entitlement and synchronization records; authorized workflows share Room/document status and content needed for the integration.

Launch notifications. If you request a launch notification, we store your email address and consent time and process anti-abuse information to handle that request. Contact us to withdraw the request.

Public-page analytics. We use Google Analytics (G-7H0WZTGTYY) on eligible anonymous visits to the public homepage, Terms and Privacy pages without query strings. Google Analytics can process cookie identifiers, browser/device information and usage data. Our implementation sends the canonical public page URL and title, disables Google signals and advertising personalization, and does not load analytics on authenticated, signing, document, Room, account or other sensitive pages. Google processes analytics data under its own policies. Browser controls can block analytics cookies or requests.

Billing. Where paid service is available, Stripe processes payment information through its payment services. ReviSign maintains service terms, customer and subscription references, invoice and payment status, and refund or billing-operation records. Payment details submitted directly to Stripe are handled under Stripe’s policies.

Support and technical information. Support requests include the messages and attachments you choose to submit. We also process request, error, delivery, integration and security logs needed to operate and troubleshoot the service. Avoid including unrelated sensitive information in support requests.

Cookies and sessions. Session cookies and related browser technologies support authentication, request security and preferences. Disabling them may prevent login or signing features from working. Third-party authentication and payment pages may use their own cookies.

2. How information is used and disclosed

We use information to provide accounts and document preparation, conversion, review, signing, storage and retrieval; route documents to intended recipients; preserve transaction evidence; deliver service messages and webhooks; manage plans and payments; respond to support requests; and maintain, secure and improve the service.

Providing electronic-signature services requires processing customer content. Documents and relevant information are transmitted to designated recipients, authorized workspace administrators, and integrations the customer uses. The customer is responsible for selecting appropriate recipients and integrations.

We use service providers for functions such as hosting, storage, network protection, email delivery and payment processing. They receive information needed for their role. External identity providers handle the login flow you choose. We do not use Google login identity information to obtain access to unrelated Google services.

Information may be disclosed when reasonably necessary to comply with applicable law or valid legal process, protect rights and safety, investigate abuse or security incidents, or enforce service terms. If the service is transferred or reorganized, relevant records may be transferred with it, subject to applicable privacy obligations.

3. Organizations and workspace administration

Ordinary members’ document views are limited to their own created or sent documents. Sharing an Account does not by itself grant access to another member’s documents. Authorized Account Owners and Administrators can explicitly access Account Documents, including other members’ documents; administrative access is recorded. Do not treat a company workspace as personal storage inaccessible to its administrators.

Recipient signing links and authorized provider integrations have separate access rules needed to carry out the transaction. Protect those links and integration credentials. Support personnel have limited operational access; submitting a support attachment makes that attachment available for handling your request.

4. Retention and deletion

We retain information according to the purposes for which it is processed, service operation, customer instructions where applicable, transaction integrity, security, legal obligations and dispute needs. Different records may need different retention treatment. Cancellation or removal from a workspace does not necessarily delete signed records, audit history, billing records or backup copies.

We do not promise a universal retention or deletion period. Contact support about access, export or deletion requests. Requests affecting a document controlled by another organization may need to be directed to that organization. Legal and integrity requirements may limit what can be changed or deleted. Keep independent copies of records you need.

5. Security and processing locations

We maintain administrative, technical and organizational safeguards intended to protect information, including access restrictions and account-security controls. Safeguards vary by service component and processing context. No storage or transmission system can guarantee absolute security. You are responsible for securing devices, passwords, authentication factors, recipient links and integrations.

Information may be processed in the United States and other countries where the service or its providers operate. Privacy laws may differ from those where you live. This policy does not promise storage in a particular country or a particular certification or compliance status.

6. Your choices and requests

You can update available profile settings, manage supported authentication methods, enable MFA, and unlink external identities in Security Settings when another sign-in method remains available. You can also manage ReviSign’s access through your Google Account. Revoking Google access does not by itself delete your ReviSign account or signing history.

Depending on applicable law, you may have rights to request access, correction, deletion or restrictions on use of your personal information. Contact support to make a request; we may need to verify your identity and authority. We assess requests under applicable law and the rights of others involved in the records. For organization-controlled documents, contact the sending organization as well.

7. Children

ReviSign accounts are intended for adults authorized to use the service. The service is not directed to children under 13. Do not knowingly submit children’s information without appropriate authority and a lawful basis. Contact support if you believe a child has supplied information improperly.

8. Changes and contact

We may update this policy as the service and its practices change. The date above identifies the latest revision. We will provide additional notice when required by law. Contact [email protected] with privacy questions or requests.