Privacy Policy

1Information We Collect

We collect information you provide directly to us, as well as information collected automatically when you use our Service.

Information You Provide

• Account Information: When you create an account, we collect your name, email address, and organization details, and assign account and workspace identifiers. Password sign-in uses a stored password hash. If you use Google sign-in, we receive account information needed to identify you; we do not receive your Google password.
• Document Content: Documents you upload for signature, including any personal information contained within those documents.
• Signature Data: Electronic signatures you create, including signature images and related metadata. If you save a signature for reuse, a copy can be stored in your browser on that device. A signature applied to a document is also processed as part of that document.
• Payment Information: If you subscribe to a paid plan, Stripe processes payment details. PearSign handles billing contact details, subscription status, and transaction references needed to administer your plan. We do not store your full payment-card number.
• Communications: Information you provide when you contact us for support or feedback.
• Recipients and Integrations: Recipient names and contact details you enter or import, and information exchanged when you use connected services.
• AI Inputs: Prompts, conversation history, document text, and other context supplied to an AI feature, as explained in the AI features section below.
• Form and Application Data: When you complete a form or an application sent through the Service — including an application for financing — you may be asked for your name, email address, mailing address, phone number and details about you or your business, which can include a Social Security number, tax identification number, credit history and financial data. We collect this information as a processor on behalf of the business that sent you the document.

Information Collected Automatically

• Usage Data: Information about how you use the Service, including pages viewed, features used, and actions taken.
• Device Information: Information about your device, including browser type, operating system, and IP address.
• Audit Logs: Records of document-related activities for compliance and security purposes.

2How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process and complete electronic signature transactions
• Send you technical notices, updates, and administrative messages
• Respond to your comments, questions, and support requests
• Monitor and analyze usage patterns and trends
• Detect, investigate, and prevent fraudulent or unauthorized activities
• Comply with legal obligations and enforce our terms
• Personalize your experience and provide recommendations

AI features and external processing

When you use an AI feature to generate, edit, or discuss a document, relevant inputs are sent to an external AI service to produce a response. Inputs can include your prompt, conversation history, and the current document content supplied to that feature.

PearSign supports OpenAI and Anthropic. The provider used depends on the feature, your organization's integration settings, and PearSign's configuration. Some features can use a platform provider or fallback if an organization-specific provider is unavailable. Inputs may also pass through a configured integration service. Provider processing is part of using these features; this policy does not promise that all processing stays on your device.

Only supply information you are authorized to use for the task. Review generated material before relying on it or sending it to another person. Contact support@pearsign.com for information about the providers and data-handling terms applicable to your organization.

3Information Sharing

We do not sell your personal information. We may share your information in the following circumstances:

• With Your Consent: We may share information when you direct us to do so.
• Document Signers: When you send a document for signature, we share relevant information with the recipients.
• Service Providers: We work with third-party service providers who assist in operating our Service (e.g., hosting, payment processing, email and SMS delivery, analytics, and AI processing).
• Legal Requirements: We may disclose information if required by law, regulation, or legal process.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred.

Third-Party Disclosure

We do not sell, trade or otherwise transfer your Personally Identifiable Information to outside parties without giving you advance notice. This does not include hosting partners and other providers who help us operate the Service, conduct our business or serve our users, provided they agree to keep the information confidential. We may also disclose information where doing so is appropriate to comply with the law, enforce our policies, or protect the rights, property or safety of PearSign or others.

PearSign works with selected service providers whose services complement and support our own. These include content delivery networks, data and cyber security services, billing and payment processing, domain registrars, fraud detection and prevention, web analytics, email distribution and monitoring, and performance measurement. Such providers may receive or have access to personal information in whole or in part, depending on their role, and may use it only for the purpose of providing their service to us.

Our Service may link to other websites or services. We are not responsible for their privacy practices, and we encourage you to read the privacy statement of every site you visit.

4Data Security

PearSign uses access controls, password hashing, session checks, and document activity records to help protect personal information. Authenticator-based two-factor authentication is available. The Service uses HTTPS to protect information in transit.

Document access depends on workspace permissions and the signing links you share. Protect your account and share signing links only with their intended recipients. AI processing and connected services involve the providers described in this policy.

No transmission or storage method is completely secure. See our Security page for information about the controls provided by PearSign and how to report a concern. Card payment details are processed by Stripe.

5Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this policy. Specifically:

• Account Data: Retained while your account is active and for a reasonable period after closure.
• Signed Documents: Retained according to your retention settings and applicable legal requirements.
• Audit Logs: Retained for a minimum of 7 years for compliance purposes.
• Usage Data: Generally retained for up to 2 years for analytics purposes.
• Application Data: Typically retained for 7 years after account closure, to meet legal obligations, resolve disputes and enforce our agreements.

Deleting an organization does not erase every related record. The current organization-deletion process retains immutable audit history and the promotional send ledger (recipient email, campaign, and send date). We also retain hashed contact identifiers to preserve marketing opt-outs, hashed lifecycle cohort assignments, pseudonymous email-delivery status records, and aggregate baseline counts used in reporting. Related account links, organization-specific product and payment outcomes, and reply-case history are removed by organization deletion. Cancelling a subscription or closing an account also does not remove copies of executed documents held by other parties. These records must be considered when responding to a deletion request; account closure alone is not proof that all data was erased.

6Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

You can initiate account and associated data deletion in Settings → General → Delete account, or at pearsign.com/delete-account. A submitted request starts review; it does not mean erasure is complete. PearSign support completes eligible account deletion within 30 days and emails you when it is finished. For other rights or if you cannot sign in, contact us at support@pearsign.com. We will respond to your request within 30 days. We may need to verify your identity and identify the organization responsible for the information. You do not need to send a password or a full identity document in your initial request.

7Cookies and Tracking

We use cookies and browser storage for different purposes:

• Session and security: Cookies support sign-in, session security, and access to temporary PDF results.
• Choices and saved content: Browser storage remembers cookie choices and can hold saved signatures and other feature preferences.
• Optional analytics: The website's cookie banner offers Accept All and Reject Optional. Google Analytics, when configured, and consent-controlled guest engagement measurement run only after analytics is accepted.
• Referral attribution: Referral links can record a click and set a referral cookie to associate a later signup with that link. This processing is separate from the optional analytics choice.

You can block or clear cookies and site storage through your browser settings. This can sign you out, remove saved signatures or choices on that device, and prevent access to an unclaimed PDF result. Clearing browser data does not delete records already held by PearSign.

Browser privacy signals

The analytics choice above controls the consent-based analytics features. A Do Not Track browser setting is not a replacement for that choice. Contact support@pearsign.com to exercise privacy rights described in this policy.

8California Privacy Notice

The California Online Privacy Protection Act (CalOPPA) requires commercial websites and online services that collect Personally Identifiable Information from California consumers to post a conspicuous privacy policy stating exactly what is collected and who it is shared with. In accordance with CalOPPA:

• You can visit our website anonymously.
• A link to this policy appears on our home page and, at minimum, on the first significant page after entering the site. The link includes the word “Privacy” so it is easy to find.
• You will be notified of any changes to this policy on this page.
• You can review and change your personal information by logging in to your account.

If you are a California resident, you also have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right not to be discriminated against for exercising those rights. See section 6 for how to exercise them.

9Children's Privacy

The Service is not intended for use by children under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information.

The Children’s Online Privacy Protection Act (COPPA) puts parents in control of the collection of personal information from children under 13, and is enforced by the Federal Trade Commission. We do not market to children under 13 and do not knowingly collect their personal information.

10Fair Information Practices

The Fair Information Practice Principles form the backbone of privacy law in the United States. To remain in line with them, if a data breach occurs we will notify affected users by email within 7 business days.

We also agree to the Individual Redress Principle: individuals have the right to pursue enforceable rights against data collectors and processors who fail to adhere to the law, and to have recourse to courts or government agencies to investigate or prosecute non-compliance.

11Email Communications

The CAN-SPAM Act sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to stop those messages, and sets penalties for violations.

We collect your email address in order to:

• Send documents, signature requests, reminders and completion notices through the Service
• Send technical notices, security alerts and administrative messages about your account
• Respond to your enquiries, support requests and other questions
• Send product updates and marketing, which you can opt out of at any time

To be in accordance with CAN-SPAM, we agree to the following:

• We do not use false or misleading subjects, sender names or email addresses.
• We identify commercial messages as advertising where required.
• We include a way to unsubscribe from marketing email in every such message.
• We honour opt-out and unsubscribe requests promptly.

If at any time you would like to stop receiving marketing email, use the unsubscribe link in any message or contact us at support@pearsign.com, and we will remove you from all marketing correspondence. Transactional messages about documents you are a party to, and messages about your account, are not marketing and may continue.

12Internal Do Not Call (DNC) Policy

PearSign respects the privacy of individuals and is committed to complying with all applicable laws and regulations governing telephone communications. This policy sets out how we manage and honour Do Not Call requests.

Policy Overview

We maintain an internal Do Not Call list in accordance with federal and state law. Anyone who asks not to receive telephone solicitations from us is added to that list.

How to Request DNC Status

You can ask to be placed on our internal Do Not Call list by telling us during a call that you do not wish to be contacted again, or by writing to support@pearsign.com. So that we can record the request accurately, please give us the telephone number or numbers it applies to.

Timeframe for Processing

We process Do Not Call requests as quickly as possible, and no later than 30 days from the date of the request, as required by law.

Duration

Once added, a number stays on our internal Do Not Call list indefinitely, unless you give written or verbal authorisation to resume communications, or you contact us again.

Limited Exceptions

This policy applies to telemarketing communications only. It does not apply to:

• Calls made in response to an enquiry or application you initiated
• Non-marketing communications, such as account updates or servicing information
• Existing business relationships, where contact is permitted by law

Legal Compliance

We make reasonable efforts to comply with all applicable federal and state law, including the Telephone Consumer Protection Act (TCPA) and the Do Not Call Implementation Act, and to train our staff accordingly.

13International Transfers

Your information may be transferred to and processed in countries other than your country of residence. We take steps to ensure that your information receives adequate protection in accordance with this policy and applicable law.

For transfers from the European Economic Area (EEA), we rely on:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions where applicable
• Your explicit consent where appropriate

14Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify you via email or through the Service
• Where required by law, obtain your consent before making changes

We encourage you to review this policy periodically to stay informed about how we protect your information.

15Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us: