01
Controller or processor
Signibility is operated by Carousify Private Limited, A-266, Triveni Nagar, Jaipur 302018, Rajasthan, India (“we”). This page supplements our Privacy Policy, which lists the data we collect, and does not repeat it.
“GDPR” means the EU General Data Protection Regulation (EU) 2016/679 and, for the UK, the UK GDPR. Article numbers on this page refer to both.
- Controller. We are the controller for account, workspace, billing, security and website data.
- Processor. For documents, field values and recipient details that a workspace sends, the workspace is the controller and we are its processor under Article 28, acting only on its documented instructions. We add no purposes of our own to that data.
EU and UK representative. We are established outside the EU and UK. Where Article 27 requires us to appoint a representative, we will publish their details on this page; until then, contact us directly at [email protected].
02
The lawful bases
| Processing | Lawful basis |
|---|---|
| Providing the account, workspace and plan; sending, signing and sealing documents; billing | Contract, Art. 6(1)(b) |
| Keeping tax, accounting and other records the law requires | Legal obligation, Art. 6(1)(c) |
| Security: sign-in counts, rate limits, bot checks, fraud prevention, error diagnostics | Legitimate interests, Art. 6(1)(f), in protecting users and the Service |
| The audit trail and certificate, including IP addresses | Legitimate interests, Art. 6(1)(f), of every party in a provable signature |
| Transactional email | Contract, and legitimate interests |
| Tips and offers email to existing customers | Legitimate interests, Art. 6(1)(f), and national soft opt-in rules for similar services; object at any time |
| Product updates email | Consent, Art. 6(1)(a) |
| Connected integrations such as Dropbox, and Google sign-in | Contract, at your request; disconnecting stops it |
| Cookieless aggregate analytics and onboarding survey answers | Legitimate interests, Art. 6(1)(f) |
| Affiliate referral cookie | Legitimate interests; clear the cookie to object |
Where we act as processor, the sending workspace must establish its own lawful basis for the documents it sends. Where we rely on legitimate interests, we have balanced them against your rights, and you may ask us for that assessment.
03
Your rights, article by article
- Access, Art. 15: email us, or use the export in Account settings.
- Rectification, Art. 16: edit your profile in Account settings, or email us.
- Erasure, Art. 17: schedule deletion in Account settings; the limits are below.
- Restriction, Art. 18, and objection, Art. 21: email us. You can object to direct marketing at any time with the unsubscribe link or in Account settings, and we will stop.
- Portability, Art. 20: Account settings downloads your data as machine-readable JSON.
- Withdraw consent, Art. 7(3): at any time, without affecting earlier processing.
- Automated decisions, Art. 22: we make no decisions with legal or similarly significant effect by solely automated means.
We respond within one month, which may be extended by two further months for complex or numerous requests, with notice. We may ask for information to confirm your identity. Requests are free unless manifestly unfounded or excessive.
If you signed as a guest, the sending workspace controls that document. We will forward your request to it and help where it cannot be reached.
You may lodge a complaint with a supervisory authority, in particular in the EU or EEA country where you live or work, or with the Information Commissioner’s Office in the UK.
04
What erasure actually deletes
When the 30-day grace period after a deletion request ends, the account is deleted, not flagged.
- Deleted: the account, sessions, passkeys, saved signatures, preferences, connected accounts, API keys and memberships; drafts, in-progress and voided documents with their files; anything already in the trash; and workspaces you own that hold no completed documents. Active subscriptions are cancelled, and other members of those workspaces are told.
- Retained as records: completed and declined documents with their audit trails. A signed agreement is also the evidence of every other party, and one party’s deletion request cannot destroy it. We rely on Art. 17(3)(b) where retention is required by law and Art. 17(3)(e) for the establishment, exercise or defence of legal claims. A workspace holding such records is kept without members, and cannot be used.
- De-linked: retained records are reassigned to an inactive placeholder that cannot sign in. Audit entries keep the name and email recorded at the time of each action, because changing them would destroy their evidential value.
- Share links you created are transferred to someone who can still revoke them, or revoked.
05
Transfers outside the EU
We are based in India, which does not currently have an EU or UK adequacy decision, and our providers operate in countries including the United States. For personal data transferred from the EU, EEA, UK or Switzerland we rely on:
- the European Commission’s standard contractual clauses (and the UK International Data Transfer Addendum), in data processing agreements with customers who request one, and in the data protection terms our providers offer; and
- the EU–US Data Privacy Framework or an adequacy decision, where a provider or country is covered.
As supplementary measures, stored files are encrypted before they reach a storage provider, and all data is encrypted with TLS in transit.
06
A DPA, and our sub-processors
Customers that need a data processing agreement under Article 28, with standard contractual clauses, can request one at [email protected] or through the contact page. Its terms prevail over this page for that customer.
Our current sub-processors are listed in the services table of the Privacy Policy. We will update that list before adding or replacing a sub-processor, and customers with a DPA may object as set out in it. Sub-processors are bound by data protection obligations equivalent to ours.
We will notify affected customers of a personal data breach without undue delay after becoming aware of it, with the information they need to meet their obligations under Articles 33 and 34.
07
The other EU question: is the signature valid?
The legal effect of an electronic signature in the EU is governed by the eIDAS Regulation (EU) No 910/2014, not the GDPR.
Signibility provides a simple electronic signature, supported by a sealed PDF, a hash-chained audit trail and a certificate of who acted, when and from where. Under Article 25(1) of eIDAS, an electronic signature cannot be denied legal effect or admissibility solely because it is electronic or does not meet the requirements for a qualified electronic signature.
We do not provide advanced or qualified electronic signatures. Some documents, under national law, require a qualified signature or a handwritten one. It is your responsibility to decide whether a simple electronic signature is sufficient for your document. This page is not legal advice.
For the law in each EU member state and outside the EU, see eSignature legality, country by country.