Privacy Policy

SignSafe is an AI-powered contract analysis platform built for Indian founders, freelancers, legal professionals, and businesses. When you access or use our services, you entrust us with personal details and confidential business documents.

Under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), SignSafe operates as a Data Fiduciarywith respect to your account details and technical identifiers — meaning we determine the purpose and means of processing and remain legally accountable for its security, lawful handling, and timely disposal.

By creating an account, accessing the platform, or submitting documents for review, you acknowledge and consent to the data governance practices described herein. If you disagree with any aspect of this policy, please cease using our services immediately.

We collect and process only the minimum necessary information required to provide intelligent, accurate contract risk audits:

• Encryption at rest: Uploaded document files and extracted parsed text are encrypted using industry-standard AES-256 cipher storage.
• Encryption in transit: All data transmissions between your browser, our servers, and our parsing engine are protected with TLS 1.3 / HTTPS.
• Strict access isolation: Only your authenticated account has authorization to view your uploaded documents and associated risk reports. SignSafe engineering staff cannot inspect document contents without your explicit, written incident-response consent.
• Zero AI model training: We do not use your uploaded contracts, private clauses, or extracted terms to train, fine-tune, or reinforce any public or multi-tenant machine learning models. Your content remains exclusively your property.
• Deterministic disposal: See Section 6 for our complete retention and irreversible deletion lifecycle.

In accordance with the DPDP Act 2023, SignSafe processes your personal data strictly under established legal bases:

To provide our services efficiently, we engage vetted third-party data processors (Data Processors under the DPDP Act):

• Google Cloud & Firebase:Authentication management, encrypted database hosting (Firestore), and encrypted cloud asset storage. Governed by Google’s enterprise Data Processing Addendum (DPA).
• SignSafe AI Analysis Engine: Proprietary models deployed within virtual private cloud environments for clause extraction, ambiguity detection, and risk scoring.
• Vercel Cloud Infrastructure: Edge delivery, compute routing, and frontend application hosting.

No Data Brokering: We do not sell, rent, monetize, or disclose your personal data or uploaded documents to any advertising networks, data brokers, or commercial third parties under any circumstances.

Cross-Border Transfers: Where sub-processors operate infrastructure outside the Republic of India, transfers are governed by standard contractual clauses and DPDP Act provisions ensuring equivalent data protection standards.

We retain personal data and generated analyses only for as long as necessary to fulfill the specific purposes outlined in this policy:

You may request immediate erasure of your account, documents, and historical reports at any time by emailing support@signsafe.in. We will execute hard deletion within 30 days, barring items required under tax or legal mandate.

As a Data Principal under Indian law, you hold enforceable statutory rights over your personal data:

To exercise any statutory right, submit an email to support@signsafe.in with the subject line “Data Rights Request — [Your Name]”. In compliance with Indian DPDP rules, we confirm receipt within 48 hours and complete actions within 30 days.

We implement robust enterprise security protocols designed to prevent unauthorized access, accidental alteration, disclosure, or destruction of confidential data:

• Cryptographic Protection: AES-256 encryption at rest for database records and file storage; mandatory TLS 1.3 across all communication channels.
• Access Minimisation & RBAC: Strict role-based permissions; no employee has standing access to client database stores.
• Firebase Authorization Rules: Cryptographically validated security rules ensuring each authenticated client UID can strictly read and write their own documents.
• Automated Token Expiration: Session tokens undergo periodic validation and rotation to neutralize session-hijacking attempts.
• Statutory Breach Protocol: In the unforeseen event of a personal data security breach, SignSafe will issue prompt notifications to impacted Data Principals and the Data Protection Board of India within 72 hours of verification.

SignSafe uses limited, non-invasive cookies and local browser storage essential for core functionality:

• Essential Authentication Tokens: Cryptographic session tokens stored in secure browser local storage to maintain your authenticated state across page navigations. These are strictly necessary for service operation.
• Performance & Aggregated Telemetry: Anonymised usage analytics to measure page load speeds and feature utilization. All telemetry adheres to IP-masking and data minimization.
• Zero Third-Party Advertising Trackers: We do not run Facebook Pixel, third-party behavioral cookies, retargeting pixels, or programmatic advertising trackers.

SignSafe is built exclusively for individuals aged 18 years or older. Under Section 9 of the DPDP Act 2023, we do not intentionally process personal data belonging to minors or engage in tracking or behavioral monitoring of children.

If you have reason to believe that a minor has submitted personal details to SignSafe without lawful parental consent, contact our Grievance Officer immediately. We will initiate immediate investigation and purge the associated records within 48 hours.

We may revise this Privacy Policy periodically to incorporate new regulatory requirements under the DPDP Act, updated technological frameworks, or new platform features.

When material amendments are made, we will revise the “Last Updated” date at the top of this document, deliver an email notice to all registered account owners, and display a prominent banner within the application for 30 consecutive days. Your continued use of the platform following notification constitutes acknowledgment of the revised provisions.

In compliance with the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, SignSafe has designated a formal Grievance Officer for privacy concerns, data rights requests, and statutory disputes: