Privacy policy.
What we collect. What we never do.
Summary in one paragraph.
CyberSygn collects the smallest amount of information needed to make signing work. Detection runs in your browser; the PDF never leaves your device during that step. When you invite remote signers, we store the PDF encrypted in Cloudflare KV for thirty days. We use Resend to send transactional emails, Stripe to process payments, and Cloudflare to host everything. We do not use cookies for tracking, we do not sell your data, we do not run ad networks, we do not share contact lists with anyone, and we do not train AI models on your contracts.
1. What we collect.
Account data. Name, email, password hash (if you create a paid account), and a stable sender ID we generate in your browser localStorage. Used to identify you in the dashboard and tie documents to your account.
Document data. Uploaded PDFs and Word documents when you invite remote signers. Stored encrypted at rest in Cloudflare KV. A document that is never completed is deleted thirty days after it was created. A completed document, the signed PDF we build for it, and its audit certificate are retained for the life of your account, because the certificate issued to every signer states that we do so, and a signer relying on that promise did not choose your plan. Delete it yourself at any time at cybersygn.io/erase: enter your address, click the link we email you, and it is done in about a minute with no human involved. hello@cybersygn.io still works if you would rather ask a person. The PII-free verification record is retained permanently so a finished document can still be verified after the files themselves are gone. That record holds only hashes, a count, and two timestamps: the SHA-256 fingerprint of the document as it was sent for signature, the fingerprint of the signed PDF we issued for it when one was produced, the number of signers, and the dates it was created and completed. It carries no name, no email address, no document title, and no document content, and a hash cannot be reversed back into any of those. Detection itself runs in your browser; the document does not leave your device during detection.
Signer data. Names and email addresses of people you route documents to. Stored on the document record. Signers themselves do not need a CyberSygn account.
Audit metadata. Every signing event captures a timestamp, the signer's IP address, and their user agent string. This is what makes the signed document evidentiary. The audit certificate page includes this data.
Payment data. When you pay, your card information goes directly to Stripe. We never see card numbers or CVCs. We do see your subscription tier, status, current period end, and a Stripe customer ID.
Telemetry. Page views, feature events (upload, send, sign, complete), and caught errors. Stored in Cloudflare Workers Analytics Engine, our own first-party storage. Linked to a hashed sender ID, not your name or email. No cookies, no third-party tracking, no advertising identifiers.
2. What we do not collect.
- Card numbers, CVCs, or bank details. Those go directly to Stripe.
- Browsing history outside CyberSygn.
- Location beyond country and city (resolved from your IP by Cloudflare).
- Anything from third-party data brokers.
- Biometric data.
- Contents of your other documents, calendar, or contacts.
3. Why we collect what we collect.
- Account data: to let you sign in, see your documents, and contact you about your account.
- Document and signer data: to deliver the signing service you asked for.
- Audit metadata: because a signature without a trail is just a picture.
- Payment data: to charge you the right amount and keep your subscription accurate.
- Telemetry: to know which pages convert, which features get used, and where the product breaks. Aggregated, never to profile individuals.
4. Who we share data with.
Three vendors, all listed below. Each is a subprocessor under standard data-processing agreements. We do not share data with anyone else.
- Cloudflare (hosting, storage, DNS, analytics). All your data lives on Cloudflare infrastructure.
- Resend (transactional email). Your name and email address get sent to Resend when we deliver magic links and completion emails.
- Stripe (payments). Card data goes here. Stripe gets your email and the subscription details.
We do not share data with advertising networks, data brokers, or marketing platforms. There is one exception involving an AI provider, and it only happens when you ask for it: the two optional AI features (drafting a contract from a description, and summarising a completed document) send the text you submitted to Anthropic in order to produce that result. That is the only circumstance in which document content leaves CyberSygn's infrastructure. It never happens in the background, it does not happen at all if you do not use those features, and the content is not used to train any model. Field detection and signing involve no AI provider: detection runs in your browser.
5. How long we keep it.
- Account data: until you delete it yourself at cybersygn.io/erase, which removes it from production systems immediately. We do keep encrypted daily backups, so a deleted record can persist in a snapshot until that snapshot ages out, which takes up to 35 days. Backups are never restored selectively, and older snapshots are deleted automatically.
- Document files: thirty days after upload if nobody finishes signing, then auto-deleted. Once every signer completes, the original, the signed PDF we issue, and the audit certificate are kept for the life of your account, because the certificate handed to each signer says so. You can delete them sooner at cybersygn.io/erase.
- Verification records: kept permanently, and not removed by an erasure request. They are PII-free by construction (hashes, a signer count, and two timestamps, described in section 1) and they are what lets the other party to a completed contract still check it after your files are gone.
- Audit metadata: kept with the document record; deleted when the document record is deleted.
- Payment records: as long as Stripe and our accountants need them for tax law (typically seven years).
- Telemetry: ninety days, then aggregated and the raw events deleted.
6. Your rights.
Wherever you live, you can:
- Ask what we have about you. We will send a JSON export within thirty days.
- Ask us to correct or delete it. Same thirty-day window.
- Cancel and walk away. Your subscription stops at the end of your billing period; your data deletes within thirty days unless you say keep it.
- Opt out of telemetry. We do not currently surface a toggle in the UI; email us and we will exclude your sender ID from collection within seven days.
If you live in the EU, UK, or California, you also have rights under GDPR, UK GDPR, and CCPA respectively. They overlap heavily with what we already do above. Specific requests: privacy@cybersygn.io.
7. Cookies.
We do not use cookies for tracking. We use one localStorage key (cybersygn.senderId) to identify your browser as belonging to one user, one key for your theme preference, and a token key when you are signed in. None of these leave your device except as documented above.
8. AI training.
We do not use your contracts to train AI models, and we do not allow our vendors to. One narrow exception applies on the free tier, where signing up carries consent to it: we keep a field map, meaning each field's page, type, position, size and the short label text beside it, used to improve field detection. It carries no other page content and no signed PDF, and paid plans are excluded. Our robots.txt deliberately welcomes AI crawlers to our public marketing pages because we want to be cited when someone asks ChatGPT for a DocuSign alternative, but no AI crawler ever has access to documents you upload.
9. Children.
CyberSygn is not for children. We do not knowingly collect data from anyone under thirteen.
10. Security.
Documents are encrypted at rest. Sessions are scoped to the device that signed in. Magic links are 256-bit random tokens. Audit certificates carry a SHA-256 fingerprint for every file that exists for the signing, and name which file each fingerprint was taken from. No system is perfectly secure; if we discover a breach affecting you, we will notify you within seventy-two hours of confirming it.
11. Changes.
If we change this policy in a way that affects you, we will email you before the change takes effect. Material changes also surface on this page with the updated date at the top.
12. Improving field detection on the free tier.
To use the free tier, you agree that documents you process on it may be used to improve CyberSygn's automatic field detection: the feature that finds where signatures, dates, and initials belong on a page. What we learn from is the layout, specifically the positions of detected fields and the structural shape of the document. We do not read, keep, or learn from the personal content of your contract for this purpose: not the names, the amounts, the terms, or the language of the agreement.
This is required to use the free tier. If you would rather your documents never contribute to detection, use a paid plan. Documents on paid accounts are never used to improve detection, and this is a hard rule, not a setting. This is the one narrow exception to the AI training statement in section 8: it improves field detection from layout only, and it never touches your contract's content or any paid document.
Contact.
privacy@cybersygn.io for privacy questions. hello@cybersygn.io for everything else. We answer.