Privacy policy

Jahid Laater, sole trader (EI), 21 rue Joseph Leroy, 59115 Leers, France, SIREN 933 808 057. Contact for any question about your data: support@outsigner.com.

For documents sent for signature and signer data, the user who sends the document is the controller; Outsigner acts on their behalf as processor (see section 6).

• Account: email address, password (stored with irreversible hashing), language, sign-up and sign-in dates.
• Subscription: plan, status, invoice history, billing name and address if provided. Card data is collected and stored by Stripe, never by Outsigner.
• Documents and envelopes: uploaded files, titles, fields, signer names and email addresses, messages.
• Signature evidence: IP address, browser (user agent), timestamps, SHA-256 fingerprints, signer consent.
• Contact requests: name, email, company and message sent through the form.
• Technical data: security and error logs.

• Providing the service and managing your account, trial and subscription: performance of the contract.
• Producing and keeping signature evidence: performance of the contract and legitimate interest in the evidential value of signatures.
• Invoicing and accounting: legal obligation.
• Preventing fraud and abuse (including the one-trial-per-person limit) and securing the service: legitimate interest.
• Sending service emails (signature requests, receipts, failed payments): performance of the contract.
• Answering contact requests: legitimate interest or pre-contractual steps.

We do not send marketing without your consent and never sell data.

Your data is only accessible to Outsigner and to the providers strictly needed for the service:

• Vercel Inc. (United States): website and application hosting.
• Supabase Inc.: database, authentication and file storage, on servers in Ireland (EU).
• Stripe Payments Europe, Ltd. (Ireland): payments and invoicing.
• Resend (Plus Five Five, Inc., United States): email delivery.

Signers of an envelope receive the information needed to sign. We may disclose data to authorities when required by law.

Some providers are based in the United States. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, or otherwise on the European Commission’s standard contractual clauses.

When we process documents and signer data on behalf of a user, we commit to: process them only on their instructions and to provide the service; keep them confidential and secure; only use the processors listed above; help them answer data subject requests; notify them without undue delay of any data breach; delete the data at the end of the service according to the periods below.

If you signed a document sent through Outsigner, please address requests to the sender of the document; we will help if needed.

• Account, documents and signature evidence: while the account is active, then 30 days after account deletion. You can delete envelopes at any time.
• Invoices and accounting records: 10 years (article L123-22 of the French Commercial Code).
• Free-trial information (normalised email address): kept to enforce one trial per person, up to 3 years after the account’s last activity.
• Contact requests: 3 years after the last exchange.
• Technical logs: 12 months at most.

You have the right to access, rectify, erase, restrict, object to and port your data, and to set instructions for what happens to it after your death.

To exercise them, write to support@outsigner.com. We reply within one month. Proof of identity may be requested if there is reasonable doubt.

You may lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the authority of your country.

Outsigner only uses strictly necessary cookies, which do not require consent:

• session cookies, to keep you signed in;
• a language cookie, to remember French or English;
• Stripe cookies on payment pages, used for fraud prevention.

We use no advertising cookies and no third-party analytics.

We measure traffic on the public pages (home, pricing, security, contact) with an in-house tool that sets no cookie: page views, referrer, country and device type, tied to an anonymous identifier that changes every day. Your IP address is not stored. Nothing is sent if your browser enables Do Not Track or Global Privacy Control. This data is deleted after 180 days.

Connections are encrypted (HTTPS), files are stored privately, data access is restricted per account, and documents are sealed with a SHA-256 fingerprint to detect any change.

We may update this policy. If there is a material change, we will let you know by email.