Privacy Policy

Account holders

• Identity and contact: name, email address and, if you add them, phone number, job title and profile photo.
• Sign-in data: a hash of your password (never the password itself), or the public key of a passkey; failed sign-in counts and lock times; connected Google sign-in identifiers.
• Workspace data: workspace name, your role, plan, seats, branding (logo, website, custom domain) and, if a workspace connects its own mail server, those settings in encrypted form.
• Answers you give us: onboarding answers such as how you heard about us and what you intend to use the Service for, and, if you cancel, the reason you choose and any detail you type.
• Preferences: time zone, date format and notification and email settings.
• Billing references: the subscription and customer identifiers issued by our payment provider, plan and payment status. We never receive or store your card or bank details; see Lemon Squeezy below.
• Correspondence: emails you send us and our replies.

Signers and recipients

• Name and email address, as entered by the sender.
• A mobile number, only where the sender requires SMS verification.
• Everything typed into the document’s fields, the signature you draw, type or upload, the time you consented to sign electronically, and your reason if you decline.
• Where a share link restricts viewing to named people, the viewer’s email address.

Everyone

• Documents and files uploaded to the Service, and their file names.
• Technical and evidence data recorded against every action on a document: IP address, the forwarding headers our network adds to identify that address, browser user-agent and time. See the audit trail.
• Website usage data: aggregate, cookieless page-view measurement through Cloudflare Web Analytics, and, if you arrive through an affiliate link, an affiliate referral identifier. See cookies.

We do not collect sensitive categories of data on purpose, such as health, biometric or financial account data. If a document you upload or sign contains such data, it is processed only as part of that document, on the sender’s instructions. Passkey biometrics are checked by your own device and never reach us.

Purpose	Data used	Legal ground
Create and run your account, workspace and plan; send, sign and seal documents	Account, workspace, document and recipient data	Performance of our contract with you (GDPR Art. 6(1)(b)); your consent and use for the specified purpose you gave the data for (DPDP ss. 6–7)
Take payment and manage subscriptions	Billing references, plan, workspace name, email	Contract; legal obligations on tax and accounting records
Produce evidence of who signed what, when and from where	Audit trail and technical data	Legitimate interests of the sender and every signer in a provable record (GDPR Art. 6(1)(f)); use for the purpose the signer provided it for (DPDP s. 7(a))
Keep the Service secure: rate limits, account lockout, bot checks, fraud and abuse prevention, error diagnostics	Sign-in data, IP address, technical data	Legitimate interests; legal obligations, including under the Information Technology Act, 2000 and CERT-In directions
Transactional email: sign-in codes, signing invitations, receipts, security and deletion notices, billing alerts	Name, email, document title	Contract; legitimate interests. These cannot be switched off while you hold an account
Product updates and tips and offers email	Name, email, plan and usage milestones	Consent, or for existing customers our legitimate interest in telling you about similar services. Withdraw any time with the unsubscribe link in every such email or in Account settings
Understand how the product is found and used, in aggregate	Onboarding answers, cookieless page-view counts	Legitimate interests
Comply with law, respond to lawful requests, and establish, exercise or defend legal claims	Any data relevant to the matter	Legal obligation; legitimate interests; GDPR Art. 17(3)(e); DPDP s. 7

Marketing email, stated plainly: “Product updates” is off until you switch it on. “Tips and offers” is on by default for account holders, and you can switch it off at any time with one click. Signers who never created an account receive no marketing email from us.

We do not use personal data or document content to train artificial intelligence models, we do not make decisions about you by solely automated means that have legal or similarly significant effects, and we do not sell or rent personal data.

Every file stored by the Service, including documents, signatures, profile photos and workspace logos, is encrypted with AES-256-GCM under a key unique to that file before it is written to storage. Each file key is itself encrypted by a master key held separately from the storage.

• We do not read your documents. Our internal admin tools show document titles, statuses and counts, and cannot display a document’s contents.
• Technical access exists, and we limit it. Because the Service must render and seal your documents, the application can decrypt them. A person with privileged access to our production systems could therefore technically do the same. We do so only where required by law, or where you ask us to investigate a specific problem and authorise it.
• The database is not encrypted at the application layer. Names, email addresses, IP addresses and field values are stored as ordinary database records, protected by access controls rather than by field-level encryption. Passwords, session tokens, sign-in codes and API keys are stored only as hashes. Third-party credentials, connected-account tokens and mail-server settings are encrypted.

A signature is only as useful as the evidence behind it. Every meaningful action on a document, including sent, opened, consented, verified, signed, declined and voided, is written to a hash-chained audit trail.

• Each entry records the actor’s name and email as they were at that moment, their IP address, forwarding headers, browser user-agent and time.
• The completed document’s certificate shows these details, including IP addresses, and is delivered to every party. Other signers can therefore see where you signed from. This is disclosed to you before you sign.
• Entries cannot be edited. The database rejects any change to them, including by us. An individual entry cannot be corrected or redacted; it can only be removed by deleting the entire document it belongs to.

We use cookies and browser storage that the Service needs to work, plus two items that are not strictly necessary and are listed separately. We use no advertising cookies and no cross-site tracking.

Strictly necessary

Name	Purpose	Duration
session	Keeps you signed in	Browser session (server session lasts 7 days), or 30 days with “Remember me”
signed_in	Lets public pages show your initials without exposing your session	Matches your session
signier_ws	Remembers the workspace you last opened	1 year
sign_verify	Remembers that a signer passed an email or SMS check	24 hours
Share unlock	Remembers that a share link’s password was entered	1 hour
oauth_state, oauth_next	Protect a Google or Dropbox connection while it is set up	10 minutes
signier_intent	Carries the plan, billing cycle and code you chose into signup and checkout	7 days
flash	Shows a one-time confirmation message	30 seconds
tz, docs_view	Your time zone and your preferred document list view	1 year

Browser storage (never sent to our servers) holds your cookie-notice answer, whether the sidebar is collapsed, and scroll position between pages.

Not strictly necessary

• Lemon Squeezy affiliate referral (ls_aff_ref). Only if you arrive through an affiliate’s link: records which affiliate referred you so they can be credited if you subscribe. Set by Lemon Squeezy’s script on our public pages, for the period Lemon Squeezy applies, unless you clear it.
• Cloudflare Web Analytics. Counts page views in aggregate without setting cookies or building a profile of you.

Google reCAPTCHA sets its own cookies on pages with a protected form (sign-in, sign-up, password reset, verification and share unlock) to tell people from bots. You can block or delete cookies in your browser; strictly necessary cookies are required for sign-in and signing to work.

We share personal data only with the service providers below, each bound by contract to use it solely to provide its service to us, and with no one else except as required by law.

Provider	Purpose and data received	When
Cloudflare	Network, DDoS protection and TLS for our website and app; sees IP addresses and request data in transit. Cookieless page-view analytics.	Every visit
Cloud hosting and object storage providers	Run our servers and database; store files, which reach storage already encrypted by us.	Always
Email delivery provider	Recipient address, name and the message, which may name the sender and document title.	Every email we send
Lemon Squeezy	Our Merchant of Record. Processes payments, calculates and remits tax, issues invoices and handles refunds. Receives your name, email, billing address and payment details directly at checkout under its own privacy policy; receives your workspace reference from us.	When you buy, change or cancel a paid plan, or arrive through an affiliate link
Google	reCAPTCHA: IP address and browser signals. Google sign-in: identity returned from your Google account if you choose it.	Protected forms; only if you choose Google sign-in
Dropbox	Access you grant to list and import the files you pick.	Only if you connect it
Twilio	A signer’s mobile number, to deliver a verification code.	Only if the sender requires SMS verification
Timestamp authority	A cryptographic hash of the sealed document, never the document.	When a document is sealed, where timestamping is enabled
Sentry	Error reports to diagnose faults, configured not to attach cookies, user details or local variables, though a report can include the page address and technical context of the fault.	When an error occurs, where enabled

Customer-controlled destinations. A workspace may send its email through its own mail server, or serve signing pages on its own domain. Where it does, messages and page requests pass through infrastructure that the workspace controls and is responsible for.

We may also disclose personal data where required by law, court order or a lawful request from a government authority; to protect the rights, safety or property of our users or the public; or to a successor in a merger, acquisition or sale of assets, which would remain bound by this policy.

Carousify is based in India. Our service providers operate servers in other countries, including the United States and member states of the European Union, so your data may be processed outside the country where you live.

• For transfers out of India, we transfer only to countries not restricted by the Central Government under section 16 of the DPDP Act.
• For personal data from the EU, EEA, UK or Switzerland, we rely on adequacy decisions, the EU–US Data Privacy Framework where a provider is certified, or standard contractual clauses published by the European Commission or UK authorities.

Data	How long
Account, profile and preferences	While the account exists; deleted 30 days after you ask us to delete the account
Completed and declined documents, with their audit trails	Kept as records for as long as the workspace exists, and after account deletion where needed to establish or defend legal claims (see what erasure deletes)
Drafts, in-progress and voided documents	Until deleted, and with the account
Documents moved to trash	30 days, then permanently deleted with their files
Signing links	Expire after 120 days, or 48 hours after the document completes
Share links	Until revoked, or until the expiry the owner sets (up to one year)
Sign-in codes	10 minutes; password reset links 1 hour; email sign-in links 24 hours; cleared shortly after expiry
Sessions	7 days, or 30 with “Remember me”; expired records deleted 45 days later
Workspace invitations	7 days
In-app notifications	90 days after being read, or 365 days if unread
Billing and tax records	As long as required by Indian tax and company law, generally 8 years; payment records held by Lemon Squeezy under its own policy
Email campaign send records	Until the account is deleted

When an account is deleted we remove it from live systems. Copies in backups and logs held by our infrastructure providers are overwritten in their normal cycles and are not restored except to recover from an incident.

We use reasonable security practices and procedures appropriate to the nature of the data, including:

• AES-256-GCM encryption of every stored file under a per-file key, and TLS for all data in transit, with HSTS on our app.
• Passwords hashed with Argon2id; passkeys (WebAuthn) supported; accounts locked after repeated failed sign-ins; sign-in rate limits and, on protected forms, reCAPTCHA.
• Sessions, sign-in codes and API keys stored only as hashes; third-party credentials encrypted.
• Completed PDFs sealed with a digital signature, and an audit trail hash-chained and protected against edits at the database.
• Role-based access inside workspaces, cross-site request protection and strict browser security headers.
• Automated checks of our software dependencies for known vulnerabilities.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. The Security page describes these measures, and what we have not yet done, in more detail.

Personal data breaches. If a breach affects your personal data, we will notify you and the relevant authorities, including the Data Protection Board of India, CERT-In and, where the GDPR applies, the competent supervisory authority, within the time and in the manner the law requires. Where we are processing for a workspace, we will inform that workspace without undue delay so it can meet its own duties.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and information about how it is processed;
• Correct, complete or update it;
• Erase it, subject to the limits below;
• Withdraw consent at any time, as easily as you gave it, without affecting processing before withdrawal;
• Object to or restrict processing based on legitimate interests, and object to direct marketing at any time;
• Data portability: receive your data in a structured, machine-readable format;
• Nominate another person to exercise your rights in the event of your death or incapacity (DPDP Act s. 14); and
• Grievance redressal, and to complain to a regulator (see below).

Much of this is self-serve: Account settings lets you edit your profile, export your data as a JSON file and schedule deletion of your account. For anything else, email [email protected]. We may need to verify your identity before acting, and we will respond within the time the law allows, and in any case within 30 days.

Limits we apply. An audit trail entry cannot be edited or partly redacted. We may retain a completed or declined document, and its audit trail, despite an erasure request where it is needed to comply with law or to establish, exercise or defend legal claims, because it is also the other parties’ evidence. If you signed a document as a guest, the sending workspace controls that document, and we will pass your request to it.

California residents: we do not sell or share personal information for cross-context behavioural advertising, and you will not be discriminated against for exercising your privacy rights.

The Service is not intended for anyone under 18. We do not knowingly collect personal data from children. By accepting the Terms of Service, account holders confirm that they are at least 18. If you believe a child has given us personal data, contact us and we will delete it.

Complaints and requests about your personal data, or about this policy, can be sent to our Grievance Officer:

• Grievance Officer, Signibility (Carousify Private Limited)
• Email: [email protected]
• Post: A-266, Triveni Nagar, Jaipur 302018, Rajasthan, India

We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India. If you are in the EU, EEA or UK, you may also complain to your local data protection supervisory authority. We would welcome the chance to address your concern first.

We may update this policy as the Service or the law changes. The date at the top shows the latest version. If a change materially affects how we use personal data, we will tell account holders by email or in the app before it takes effect, and where the law requires consent we will ask for it again.