Privacy Policy

This is a working draft based on how the service actually operates. It needs owner and legal review before launch. [OWNER/LEGAL REVIEW: entity name, contact, privacy officer, BC PIPA and PIPEDA applicability]

OKSigned is operated by [OWNER LEGAL ENTITY — placeholder], based in British Columbia, Canada. Our privacy contact is privacy@oksigned.com [replace placeholder].

• Senders: name, email, a password hash (never the password itself), workspace name, and billing status. Payment card details are collected and held by Stripe. We never receive full card numbers.
• Documents: the PDFs you upload, the fields you place, and the names and email addresses of the signers you add.
• Signers: what they enter into fields, their signature image (typed or drawn), consent and signing timestamps, and a shortened one-way hash of their IP address and browser details, used for the audit trail.
• Email delivery: whether a message was sent, delivered, or bounced, as reported by our email provider.

• To provide the signing service, produce completed documents and audit certificates, and send transactional emails.
• To secure the service (rate limits, abuse prevention) and to meet legal obligations.
• We don't sell personal information, run advertising, or use third-party analytics or tracking scripts. We don't use document contents to train AI models.

For documents a sender sends, the sender decides what's collected and why. We process that information on the sender's behalf. Signers with questions about a document should contact the sender.

See our subprocessor list. Our pilot is designed to use Canadian regions where a provider offers them. Some providers, including our email provider, store data in the United States. [confirm final regions before launch]

Completed documents, certificates, and audit records are kept while the sender's account is active, plus a retention period the sender can configure [retention defaults and deletion schedule not yet implemented; owner to set policy]. Under BC PIPA, information used to make a decision about a person must be kept for at least one year after the decision.

You can ask to access or correct your personal information, or withdraw consent where it applies. Email privacy@oksigned.com. We aim to respond within 30 days. You can also contact the Office of the Information and Privacy Commissioner for British Columbia.

See Security and trust. If a breach is likely to cause significant harm, we will notify affected people and the appropriate regulator. [confirm notification obligations (PIPEDA s.10.1 where applicable)]