Privacy Policy

Doxufy, Inc. ("Doxufy", "we", "our", "us") operates the electronic signature platform available at doxufy.com. This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our website, products, and services (collectively, the "Service"). For questions about this policy, contact us at [email protected].

Account information: When you create an account, we collect your name, email address, and (for paid plans) billing information processed by Stripe. We do not store full payment card numbers. Document data: When you upload documents or create signing requests, we store the document files and associated metadata (title, size, creation date, status). We do not read the contents of your documents. Signer data: When a signer completes a document, we collect their name, email address, IP address, browser user agent, and the timestamp of each action. This data forms the legally required audit trail. Usage data: We collect de-identified, aggregated information about how you use the Service · such as which features you use, page views, and performance metrics. This data cannot identify you individually and is used solely to improve the Service. Communications: If you contact us for support, we retain those communications to help resolve issues and improve the Service.

We use the information we collect to: • Provide, maintain, and improve the Service; • Send transactional emails (signing requests, completion notifications, account security alerts); • Send product updates and announcements · you can unsubscribe at any time; • Generate audit trails required for e-signature legal validity; • Process payments and manage your subscription; • Detect and prevent fraud, abuse, and security incidents; • Comply with legal obligations; • Analyze de-identified usage patterns to improve the Service. We do not sell your personal information to third parties. We do not use your document content to train machine learning models.

All documents are encrypted at rest using AES-256 encryption and in transit using TLS 1.3. Documents are stored on Cloudflare's global infrastructure with redundant backups. You can delete your documents at any time from the Service. When a document is deleted, it is removed from our primary storage immediately. Backup copies are purged within 30 days. Access controls: Only you and the signers you designate can access your documents through the Service. Our staff may access document metadata (not content) for account management and support purposes. We will not access document content except to resolve a specific support request you initiate or as required by law.

We use the following third-party services to operate Doxufy. Each has its own privacy policy: • Supabase · authentication, database, and user data storage; • Cloudflare R2 · encrypted document file storage; • Resend · transactional email delivery; • Stripe · payment processing and subscription management. We share only the minimum data necessary for each service to function. We do not share your document content with any third-party service.

We use session cookies to keep you logged in and to maintain your session state. We do not use third-party tracking cookies, advertising cookies, or behavioral analytics software (such as Google Analytics or Meta Pixel). You can disable cookies in your browser settings, but doing so will prevent you from logging in to the Service.

We retain your account information and documents for as long as your account is active. If you delete your account, we will delete your personal information and documents within 30 days, except where we are required to retain it for legal compliance (such as financial records required by law, which we retain for 7 years). De-identified, aggregated usage data may be retained indefinitely as it cannot be linked to any individual.

We may disclose your information if we believe in good faith that disclosure is necessary to: comply with a legal obligation or valid legal process (such as a court order or subpoena); protect the rights, property, or safety of Doxufy, our users, or the public; investigate fraud or security incidents; or enforce our Terms of Service. Where permitted by law, we will attempt to notify you before disclosing your information in response to legal process.

Depending on your location, you may have the following rights regarding your personal information: • Access: Request a copy of the personal information we hold about you; • Correction: Request that we correct inaccurate information; • Deletion: Request deletion of your account and associated personal data; • Portability: Request an export of your data in a machine-readable format; • Objection: Object to certain processing of your data; • Unsubscribe: Opt out of marketing emails at any time using the unsubscribe link in any email. To exercise any of these rights, email [email protected]. We will respond within 30 days. We may need to verify your identity before processing requests. EU/UK users: If you are located in the EU or UK, you also have the right to lodge a complaint with your local data protection authority.

Doxufy is based in the United States. If you use the Service from outside the US, your information may be transferred to and processed in the US. We take appropriate steps to ensure such transfers comply with applicable data protection laws, including using standard contractual clauses where required.

The Service is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected information from a minor, please contact us at [email protected] and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email at least 14 days before the changes take effect. The date of the last update is shown at the top of this page. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.