Privacy Policy

The short version

Your documents are your business and your clients' business. EsigIt uses what you give it to get a document signed and to keep the proof. That's it.

• We never sell your data or your clients' data. Not to advertisers, not to anyone.
• We don't run ads, ad trackers or analytics scripts on esigit.com.
• We don't open or read your documents unless you ask us to help with one, or the law requires it.
• The free signing tool never uploads your file. It works entirely in your browser and the PDF never leaves your device.

What we collect, and why

• Your account: your email address and your password, stored only as a one-way hash. We can't see your password.
• Your documents: the PDFs you upload and the signed copies, so your signers can sign them and you can download them.
• Your signers: the names and email addresses you enter, so we can send them a signing link and a code.
• The signing record: when each person opened the link, verified their code, agreed to sign electronically and signed, plus their IP address and browser. That record is what makes the signature hold up later, so it goes on the certificate page of every signed PDF.
• Payment: Stripe handles your card. EsigIt never sees or stores your full card number. We keep only the Stripe reference needed to charge $1.99 when a document is finished.

How we protect it

• esigit.com only serves pages over HTTPS. Plain HTTP is redirected, and browsers are told to always use HTTPS.
• Each signer gets their own random signing link. It expires after 72 hours. The link to download a finished copy lasts 30 days.
• Before anyone can sign, we email them a 6-digit code, and the signing session is tied to the browser that entered it. A code stops working after five wrong tries, and a link locks after too many wrong guesses.
• Uploaded documents and records are not reachable from the web. They can only be downloaded through your account or the signer's own link.
• Every step of a signing is recorded in a hash-chained log, so a changed record shows.

No system can promise perfect security, and we won't pretend otherwise. If something ever goes wrong with your data, we'll tell you plainly and quickly.

Who else touches your data

Only the companies we need to run EsigIt: Stripe processes payments, Resend delivers our emails, and Hostinger runs our servers in the United States. They get only what their job requires.

Cookies

The sender app keeps your login in your browser's storage so you stay signed in. We don't use tracking or advertising cookies.

How long we keep it, and deleting it

We keep completed documents and their signing records so they can back you up later. You can ask us to delete your account and your documents at any time by emailing support@esigit.com. We'll do it, except for anything the law or an open payment dispute requires us to keep.

Changes

If we change this policy, we'll post the new version here with a new "Last updated" date. If a change affects how we use data you already gave us, we'll email you first.