Privacy Policy

1. Who we are

DocAutoSign (docautosign.com) is an online tool for editing, filling, and electronically signing documents, operated by Phoenixwebhost Inc. This policy explains what information we collect, why, who we share it with, how long we keep it, and the choices you have.

2. Information we collect

Account information: your email address, a password (stored only as a secure hash by our sign-in provider), and basic profile and business settings you choose to add (such as business name and logo).

Documents and signatures: the files you upload, scan, or create, the text and fields you add, signature and initials images, signer names, email addresses and phone numbers you enter, and the version history of each document.

Activity and audit records: when a document is created, edited, sent, viewed, signed, completed, and downloaded, plus the IP address and browser details recorded with signing events. These records are part of how e-signatures are verified.

Abuse prevention: when you sign up, we store a one-way hash (not the raw value) of your IP address, a device identifier, and a browser fingerprint so we can stop repeat sign-ups from claiming free credits. We can't turn these hashes back into your IP or device details.

Phone number: new accounts give a US mobile number, which we verify with a 6-digit text code sent through our SMS provider (Twilio). We store the number and a one-way hash of it (and of your normalized email) so each phone number and email gets one free trial. We don't use it for marketing.

Payment information: if you buy AI credits, payment is handled by Stripe. We receive a record of the purchase (amount, credits, status), but we never see or store your full card number.

Contact messages: if you use our contact form or email us, we receive your name, email address, and message.

3. How we use it

To run the service: store and display your documents, send signing requests and notifications, record signatures, and keep your account secure.

To prevent fraud and abuse, including misuse of free credits and trials.

To process payments and keep your AI credit balance.

To answer support requests and send important service messages (for example, email confirmation, password resets, and trial reminders).

We don't sell your personal information, we don't use your documents for advertising, and we don't use your documents to train AI models.

4. Electronic signature records

When someone signs a document, we record their name, email, the time, IP address, and browser, and add a signing certificate to the completed PDF (including a SHA-256 fingerprint of the original file). The document owner can see this record. We keep it with the document so the signature can be verified later.

5. Service providers we use

Supabase stores account data, documents, and files (database and private file storage, encrypted at rest) and handles sign-in.

Vercel hosts the website and app.

Resend delivers our emails, such as signing invitations, confirmations, and password resets.

Stripe processes payments for AI credit packs.

OpenAI processes images only when you use an AI feature. For AI edits, we send just the area you selected (a cropped image), not your whole document. For the scanner, we send the photo you choose to analyze. We use OpenAI's API, which does not use API data to train its models by default.

These providers process data on our behalf under their own security and privacy terms, and only as needed to provide their service.

6. Cookies and local storage

We use cookies and your browser's local storage for things the app needs to work: keeping you signed in, remembering your language and color preferences, recovering unsaved drafts, and the device identifier used for abuse prevention. We don't use third-party advertising cookies.

7. How long we keep data

We keep your account and documents while your account is active. When you delete a document, it is removed from your workspace and we delete its stored files, along with its versions and activity record.

When your account is deleted, we delete your documents and account data, except records we must keep for legal, tax, or accounting reasons (such as payment records).

Abuse-prevention hashes are kept as long as needed to prevent repeat sign-ups. Support messages are kept as long as needed to handle your request.

8. Your choices and deletion requests

You can view, download, and delete your documents in the app at any time. To delete your account and associated data, or to ask for a copy of your data, email support@docautosign.com from the address on your account. We'll confirm the request and respond within 30 days.

Depending on where you live (for example, California), you may have additional rights to know, correct, or delete personal information. We honor these requests and won't treat you differently for making one.

9. Security

Data is encrypted in transit (HTTPS) and at rest by our storage provider. Database rules let each account read only its own documents, and signing links are unique and hard to guess. No system is perfectly secure, so please use a strong password and keep signing links private.

10. Children

DocAutoSign is not intended for children under 13, and we don't knowingly collect their information.

11. Changes

If we make material changes to this policy, we'll update the date above and, where appropriate, notify you in the app or by email.

12. Contact us

Questions about this policy or your data? Email support@docautosign.com or use the contact page. See also our Terms of Use · Security & Trust.