Privacy Policy

1. Introduction

Signatura, operated by Austrat Trading Corp. (“Signatura,” “we,” or “us”), provides an electronic signature platform. This Privacy Policy describes how we collect, use, store, and share personal information.

The Service has two kinds of users, and our role differs between them:

• Account holders — people who sign up to send documents for signature. For account-holder personal data, Signatura is the data controller (we decide what to collect and why).
• Signers — people who receive a document via Signatura and sign it. For signer personal data, the account holder who sent the document is the controller; Signatura acts primarily as a data processor on the sender's behalf, and as an independent controller for limited operational purposes (audit-trail integrity, security, statutory record-keeping for legal validity of electronic signatures).

A separate notice for signers is at getsignatura.com/signer-privacy.

2. Who we are

Austrat Trading Corp., operating as Signatura.

Registered office: 3310 Jackson Crt, Kelowna, BC V1Y 2T6, Canada.

Contact channels:

• Privacy: privacy@getsignatura.com
• Legal: legal@getsignatura.com
• Security: security@getsignatura.com

Privacy Contact: Silas Allan, privacy@getsignatura.com.

Regional posture — transparency note

Signatura is a Canadian company operating internationally. Our infrastructure runs in the United States. We have not yet appointed an Article 27 representative in the European Union or the United Kingdom — we will appoint one when our user base in those regions justifies a dedicated contact. Until then, users in any region can reach us directly at privacy@getsignatura.com, and Section 12 below explains how to exercise your rights and lodge complaints with the supervisory authority in your jurisdiction.

3. Personal data we collect

From account holders

• Name, email address, and password (at registration)
• Company name, title, phone number, and address (optional profile fields)
• Subscription, billing, and payment metadata (handled by Stripe; we do not store full card details)
• Documents you upload, templates you create, and contacts you add
• Branding assets (logo, colors) and email-template customizations
• Saved signatures and initials
• Usage data (documents sent, Auto-Sign usage)

From signers

• Name and email address (provided by the sender)
• Signature and initials images (drawn, typed, or uploaded by the signer)
• Form-field entries (text, dates, checkboxes)
• IP address and timestamp at signing
• User-agent string and city-level geolocation derived from IP

Automatically collected

• IP addresses (for audit trail and security)
• Browser, device, and operating-system information from standard HTTP request headers

Categories of sources

Within the preceding 12 months, we have collected personal information from these sources:

• Directly from you — when you register, fill in your profile, upload documents, save signatures, or contact support.
• From document senders — when an account holder adds you as a signer, the sender provides your name and email.
• Automatically from your device — IP address, user-agent, and approximate geolocation derived from IP, captured when you view or sign documents.
• From our payment processor (Stripe) — billing metadata, subscription state, and transaction history (we do not store full card details).

CCPA / CPRA category disclosure

The table below states, for each of the 12 personal-information categories enumerated by the California Privacy Rights Act (Cal. Civ. Code § 1798.140(v)), whether we have collected information in that category within the preceding 12 months. Categories of recipients, business purposes, and retention periods for any category we do collect are described in Sections 5, 6, and 7.

Sale and sharing: Within the preceding 12 months we have not sold personal information for monetary or other valuable consideration, and we have not shared personal information for cross-context behavioral advertising (CCPA/CPRA terms). We do not have a “Do Not Sell or Share My Personal Information” link because we do not engage in either activity; if that ever changes, we will update this policy and provide the link before doing so.

Disclosure for business purposes: We disclose personal information in every category we collect to our service providers and contractors (Stripe, Supabase, Resend, Cloudflare, and — only when you opt in to Auto-Sign — Anthropic) solely for the business purposes listed in Section 5 and subject to written contractual restrictions in each vendor's commercial terms. See Section 7 and our Sub-Processors page for details.

4. Sensitive personal information

Signatura does not request or knowingly collect “Sensitive Personal Information” as defined by the CCPA/CPRA, “special categories of personal data” as defined by GDPR Article 9, or equivalent categories under other privacy laws (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data for unique identification, health data, sex life or sexual orientation, government identifiers).

If an account holder uploads a document that contains such information inside the document content, Signatura processes that information only as part of contract performance — we do not extract, analyze, or use it for inferring characteristics about you.

5. How we use your information

We process personal data only for the purposes listed below, each tied to a specific lawful basis:

• Provide and operate the Service (account creation, document storage, signing-link delivery, signature collection, audit-trail generation, Certificate of Completion delivery) — contract performance (GDPR Art. 6(1)(b)).
• Establish the legal validity of signed documents (audit-trail integrity, document hashing, retention of signing evidence) — legal obligation (GDPR Art. 6(1)(c)) under the ESIGN Act, UETA, eIDAS Regulation, and equivalent record-keeping laws.
• Send transactional emails (signing invitations, reminders, confirmations, account notifications) — contract performance.
• Process payments and manage subscriptions — contract performance + legal obligation (tax and accounting record-keeping).
• Provide AI-assisted Auto-Sign (optional) — consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time without affecting any other feature.
• Connect optional cloud-storage integrations (Google Drive, Dropbox, OneDrive) — consent.
• Detect, prevent, and respond to fraud, abuse, and security incidents — legitimate interest (GDPR Art. 6(1)(f)) in keeping the Service safe.
• Improve the Service (aggregated, non-identifying usage signals such as Auto-Sign success rates) — legitimate interest.
• Respond to support requests — contract performance.
• Comply with legal obligations and respond to lawful requests — legal obligation.

We do not use your personal information for behavioral advertising, do not sell personal information, and do not share personal information for cross-context behavioral advertising (CCPA terms). We do not train AI models on your content; see Section 10.

6. How long we keep it

• Account profile — for the life of your account. When you delete your account we permanently disable sign-in and remove or anonymize your profile together with your private data (drafts, templates, contacts, signatures, and settings). Your completed signed documents are kept as described below.
• Completed signed documents and their audit trails — retained for up to 10 years after completion (or the longer period required by applicable record-keeping or limitation laws), so we can establish, exercise, or defend legal claims and protect the rights of the other parties to the document. A completed document and its audit trail necessarily include the parties’ names, email addresses, and signatures recorded when it was signed; your account profile and other personal data (such as IP addresses) are removed or anonymized when you delete your account. After the retention period these records are permanently deleted.
• Documents that were never completed (drafts, sent-but-unsigned, or partially signed) — kept until you delete them; deleted when you delete your account.
• Auto-Sign analysis cache — up to 1 hour, then automatically deleted.
• OAuth state tokens and rate-limit records — up to 15 minutes.
• Error logs — 30 days.
• Signer data-request audit records — 90 days after the request is completed.
• Billing and tax records — as required by applicable tax law (typically 6–7 years).

7. Sharing & sub-processors

We share personal data only with the limited set of sub-processors needed to operate the Service. We rely on each sub-processor's published commercial data-protection terms (which generally include Standard Contractual Clauses or Data Privacy Framework certification where the vendor offers them) for international transfers, rather than separately negotiated agreements.

Categories of recipients (GDPR terms): infrastructure and database providers; transactional email providers; payment processors; AI-analysis providers (only when Auto-Sign is opted in); optional cloud-storage providers (only when you connect them); and our legal, accounting, and professional advisors when needed.

See the full list at getsignatura.com/sub-processors.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not engage in targeted advertising or build advertising profiles.

8. International data transfers

Personal data is processed primarily in the United States, where our infrastructure is hosted. For transfers from the European Economic Area, the United Kingdom, or anywhere else outside the United States, we rely on the international-transfer safeguards published by each sub-processor — which generally include EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or EU–US Data Privacy Framework certification where the vendor offers them — supplemented by technical measures (TLS 1.3 in transit, AES-256 at rest, server-side encryption of credentials). Signatura has not separately negotiated transfer agreements with these vendors; we rely on their published commercial terms.

9. Cookies and similar technologies

We use only essential cookies and browser storage needed to keep you signed in and operate the Service. We do not use analytics, advertising, social-media, or cross-site tracking technologies. Because we set no non-essential cookies, no consent banner is required. We honor the Global Privacy Control signal.

See our Cookie Notice for the full inventory.

10. Automated decision-making (Auto-Sign)

In accordance with GDPR Article 22 and equivalent provisions in other laws, we disclose our use of automated processing for the optional Auto-Sign feature:

• Auto-Sign uses Anthropic Claude to detect and suggest signature, date, and text fields in documents you upload.
• Auto-Sign does not make legally binding decisions — every detected field requires your explicit review and confirmation before any signing occurs.
• Auto-Sign is opt-in; you can disable it at any time without affecting any other feature.
• What happens with the data: page images are sent to Anthropic's API for real-time analysis. Anthropic does not retain your content after the API call and does not train its models on customer inputs (per Anthropic's Data Processing Agreement). The analysis result returned to Signatura (field positions and types — not document content) is cached on our infrastructure for up to 1 hour to avoid re-running the analysis if you reload the page, and is then automatically deleted.
• You have the right to request a human review of any AI-generated suggestion by contacting privacy@getsignatura.com.

11. Electronic signature compliance

Signatura is designed to comply with applicable electronic signature laws:

• ESIGN Act (15 U.S.C. § 7001) and UETA — electronic signatures are intended to be legally binding and have the same legal effect as handwritten signatures, subject to the statutory exclusions in each (e.g., wills, family law, certain notices). Signer consent is obtained and recorded before each signing session, including the hardware/software requirements for access and retention.
• eIDAS Regulation (EU 910/2014, as amended by EU 2024/1183) and UK retained eIDAS — Signatura supports Simple Electronic Signatures (SES) admissible as evidence under Article 25(1). Advanced Electronic Signatures (AdES) and Qualified Electronic Signatures (QES) are not currently offered; member-state law may require AdES or QES for certain document types.
• Document integrity — each signed document is hashed using SHA-256 and the hash is recorded against your account. Anyone can re-hash the PDF at app.getsignatura.com/verify to check it against our completion record.
• Audit trail — every signature event is logged with IP address, user-agent, timestamp, and signer identification.
• Certificate of completion — a certificate PDF is generated for every completed document, embedding signer metadata and the SHA-256 integrity record.

12. Your rights

Depending on where you live, you may have one or more of the following rights: to access the personal data we hold about you; to correct/rectify inaccurate data; to delete/erase your data; to object to or restrict certain processing; to data portability in a machine-readable format; to withdraw consent for processing based on consent; to opt out of certain processing (sale, sharing, targeted advertising, or significant-effects profiling); and to lodge a complaint with your local supervisory authority.

Account holders can exercise most rights through Settings > Security in the app (export, account deletion). Signers can exercise rights at getsignatura.com/signer-privacy. For anything else, email privacy@getsignatura.com — we aim to respond within 30 days.

United States — California (CCPA / CPRA)

We provide the rights below to California residents regardless of whether the CCPA's thresholds currently apply to us, both as good practice and to be ready as we scale.

Your rights under the CCPA/CPRA

• Right to know — the categories of personal information we have collected, the categories of sources, the business or commercial purposes for collecting, the categories of recipients we have disclosed it to, and the specific pieces of personal information we hold about you. The category-level disclosures are in Section 3 (collection and sources), Section 5 (purposes), and Section 7 (recipients). For the specific pieces of personal information we hold about you, submit a request (see “How to exercise your rights” below).
• Right to delete — subject to legal exceptions under Cal. Civ. Code § 1798.105(d), which include records we must retain for electronic-signature legal-validity purposes (signed documents and their audit trails) and tax records.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing — we do neither, but the right is preserved.
• Right to limit use of Sensitive Personal Information — we do not collect SPI in the first place (see Section 4); the right is preserved.
• Right to data portability — we deliver export downloads as machine-readable JSON, transmittable to another service without hindrance.
• Right to non-discrimination — we will not deny you the Service, charge you a different price or rate, provide a different level or quality of the Service, or suggest any of the above because you exercised a privacy right. We do not offer financial incentives in exchange for personal information.
• Global Privacy Control — we honor the GPC browser signal. Because we do not sell or share personal information for cross-context behavioral advertising, GPC has no additional behavioral effect (see our Cookie Notice).

How to exercise your rights

We operate primarily online and have a direct relationship with each consumer whose information we collect, so under California Code of Regulations § 7020(c) we may provide a single submission method. That method is email to privacy@getsignatura.com. Account holders can also exercise the most common rights directly in the app at Settings > Security (data export, account deletion). Signers without a Signatura account can use the OTP-verified self-service form at getsignatura.com/signer-privacy.

Verification

In line with the verification standards in §§ 7060–7062 of the CCPA Regulations:

• For account holders: we verify identity by confirming control of the account email on file (e.g., by responding to your request from that address or by completing an authenticated action in the app). For deletion or specific-pieces-of-PI requests we apply a reasonably high degree of certainty and may ask for additional information that matches what we already hold (e.g., your most recent invoice ID).
• For signers without an account: identity is verified through the OTP code delivered to your signing email address via the form at getsignatura.com/signer-privacy.
• If we cannot verify your identity to the standard required for the type of request, we will respond declining the substantive request and explaining why, and you may still exercise rights that do not require verification (e.g., opt-out signals).

Authorized agents

You may designate an authorized agent to submit a request on your behalf under § 7063 of the Regulations. The agent must provide either (i) a power of attorney granted under Cal. Probate Code §§ 4000–4465, or (ii) written permission signed by you authorizing the agent to act on your behalf, together with verification that the agent is who they claim to be. We may also contact you directly to confirm that the agent has authority.

Response timelines

We will confirm receipt of your request within 10 business days and provide a substantive response within 45 calendar days of receipt. If we need more time we will notify you and may take up to an additional 45 days (90 days total), with an explanation of the reason.

Minors

The Service is not directed to individuals under 18 (see Section 15). We do not knowingly collect personal information from minors. If we ever sold or shared personal information for cross-context behavioral advertising — which we do not — we would require opt-in consent from minors aged 13–15 and from a parent or guardian for children under 13, as required by Cal. Civ. Code § 1798.120(c).

Financial incentives

We do not offer financial incentives or price/service differences in exchange for personal information.

If we deny a rights request, you may appeal by replying to the denial within 60 days; we will respond within 60 days of receiving the appeal. If CCPA thresholds apply to us in a calendar year, we will publish 12-month rights-request metrics on this page.

Other U.S. states

To the extent state law applies to us (most US state privacy laws have business-size and consumer-volume thresholds), residents of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Hampshire, New Jersey, Iowa, Indiana, Kentucky, Maryland, Minnesota, Nebraska, Rhode Island, Tennessee, and Utah have rights to access, correct, delete, port, and opt out of targeted advertising, sale, and significant-effects profiling. We do not engage in any of those activities. If we deny a rights request, you may appeal within 60 days by replying to the denial; we will respond within 60 days of receiving the appeal.

European Economic Area (GDPR)

Signatura follows GDPR principles. We have not yet appointed an Article 27 representative in the EEA. Until we do, EEA users can exercise their rights — access, rectification, erasure, restriction, objection, portability, and withdrawal of consent — by emailing privacy@getsignatura.com directly. You also have the right to lodge a complaint with your national supervisory authority. The full list is available at edpb.europa.eu; common ones include CNIL (France), BfDI (Germany), AEPD (Spain), Garante (Italy), AP (Netherlands), and DPC (Ireland).

United Kingdom (UK GDPR + DPA 2018)

Signatura follows UK GDPR principles. We have not yet appointed a UK Article 27 representative. UK users can exercise their rights by emailing privacy@getsignatura.com and may lodge a complaint with the Information Commissioner's Office (ico.org.uk).

13. Security

We implement industry-standard security measures including TLS 1.3 in transit, AES-256 at rest, row-level security policies in the database, server-side OAuth-token encryption, document hash sealing (SHA-256), and audit-trail logging. Sensitive credentials are handled exclusively server-side and never exposed to the browser. See our Security page for the full details.

14. Data breach notification

If we become aware of a personal-data breach affecting you, we will notify you and any applicable supervisory authority without undue delay and within the timeframes required by applicable law. Our notice will include the nature of the breach, the categories and approximate number of affected individuals and records, the likely consequences, and the measures we have taken or intend to take.

15. Children's privacy

Signatura is not intended for use by individuals under the age of 18, and we do not knowingly collect personal information from anyone under 18. We do not knowingly process personal information from US children under 13 (per COPPA) or from EEA children under 16 (per GDPR Article 8; the digital-consent age varies by member state, ranging from 13 to 16). If you believe a child has provided us personal information, contact us at privacy@getsignatura.com and we will delete it.

16. Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we will notify account holders by email at least 30 days in advance. We will also publish updates to our sub-processor list at getsignatura.com/sub-processors at least 30 days before any change takes effect. Continued use of the Service after a non-material update constitutes acceptance of the updated policy.

17. Contact

For privacy-related inquiries, contact us at privacy@getsignatura.com.

Austrat Trading Corp.
Operating as Signatura
3310 Jackson Crt
Kelowna, BC V1Y 2T6
Canada