Privacy Notice

Data the service processes

• Account: your email, a hash of your password (never the password itself), the name and the language setting. With Google sign-in also the Google account identifier and the email that Google sends.
• Files that you upload and the signed results, for the storage period.
• Details that you declare (creation method, author, tool, note). They go into the signed file.
• Job history: file names, states, times and check results.
• API keys and MCP connections. Secrets are stored only as one-way digests.
• Technical logs for operation and security. They contain no file content, no secrets and no declared details.

Purpose

The data is used only to provide the signing service that you request, to keep it secure, and to answer your requests. Files are not used to train models and are not published.

Recipients

• If you sign in with Google, Google receives the sign-in request.
• The email service of the operator delivers the confirmation and password reset emails.
• When a time-stamp service is configured, it receives a digest of the signature, not the file.
• The hosting provider of the service stores the data on behalf of the operator.

The service does not sell data and does not use analytics or advertising cookies.

Data retention

Uploaded source files

30 days

Job history

180 days

Sign-in sessions

7 days

Security logs

Kept by the hosting log system. Logs contain no file content.

Backups

Set by the database hosting.

Account deletion ends access at once: API keys and MCP connections stop working and new operations are refused. The stored files are removed in the next cleanup run.

Details inside a signed file stay in every copy of that file. The service cannot delete copies that were downloaded or shared.

Cookies

Only cookies that the service needs: the sign-in session, the sign-in state during a sign-in, and the language preference.

Your rights

Depending on the applicable law, you can ask for access to your data, for correction, deletion or restriction of processing, object to processing, and ask for a copy of your data in a portable format.

If you have an account, export your data and delete your files or your account yourself on the “Privacy & data” page of the dashboard. These actions take effect at once.

Privacy & data →

For all other requests, and if you have no account, write to the contact below. This also applies to people whose data appears in content that someone else uploaded. The operator answers each request.

Contact for personal data

privacy@orisigil.com