DSV (DocSignVault) — Privacy Policy
Last updated: [DATE]. Version: draft 1 (2026-10-08).
This policy explains what personal data DSV handles, why, how it is protected, and what rights people have. [COMPANY LEGAL NAME], [COMPANY ADDRESS] ("DSV", "we") runs the service. Privacy contact: [DPO/PRIVACY CONTACT], [CONTACT EMAIL].
1. Two kinds of people, two roles
- Senders are the businesses and individuals who hold a paid DSV account and send documents. For Sender account and billing data, DSV is the controller.
- Signers are people who receive a document from a Sender. For Signer data, the Sender is the controller (or "business") and DSV is the processor (or "service provider"). The Sender decides what to ask for and why. DSV handles the data only to provide the service. See section 12 and the Data Processing Agreement (
DATA_PROCESSING_AGREEMENT.md).
2. Data we collect from Senders
| Data | Why |
|---|---|
| Name, business name, legal name, address, email, phone (optional) | Create and run the account; appear on signing pages, emails and PDFs |
| Logo, brand colour, reply-to email | Branding of signing pages, emails and PDFs |
| Password (stored only as an argon2id hash), authenticator secret (encrypted), backup codes (stored as hashes) | Sign-in and two-factor security |
| Billing details: plan status, Stripe customer and subscription identifiers, invoices | Take payment. Card data goes directly to Stripe and never touches DSV systems. |
| Team member names and emails | Seats you invite |
| Templates, documents, settings, retention rules | The service itself |
| Usage and security logs: IP address, device/browser, timestamps, admin and support actions | Security, fraud prevention, support, audit |
3. Data we handle for Signers on behalf of Senders
Depending on what the Sender's document asks for:
- name, email address and/or mobile number (to send the link and one-time codes);
- answers to form fields (which may include date of birth, address, ID numbers, and other items the Sender chose);
- ID photos (front and optionally back of identity documents) and, optionally, ID details typed by the Signer such as ID number, issuing country and expiry date;
- a face-with-ID photo (a photo of the Signer's face holding their ID);
- the signature (drawn, typed or uploaded image) and initials;
- audit data: IP address, device and browser, time (UTC), and the email or phone used, for each event (opened, code verified, pages viewed, fields completed, photos uploaded, signed, downloaded);
- the Signer's consent to do business electronically and the text version accepted.
DSV does not verify identity, run OCR, match faces or check liveness. We do not extract or compute any biometric template from photos. Photos are stored and shown to the Sender, who reviews them personally. Uploaded images have embedded metadata (such as GPS location in EXIF) removed before storage.
4. Why we use data and our legal bases
| Purpose | Legal basis (GDPR/UK GDPR wording; counsel to adapt per region) |
|---|---|
| Provide the service to Senders; billing; support | Performance of a contract |
| Operate signing sessions for Signers on a Sender's instructions | Processor on the Sender's instructions; the Sender's own legal basis (often contract or legitimate interest, and consent where required) |
| Security, abuse prevention, rate limiting, audit trail, fraud detection | Legitimate interests (keeping the service and records secure and trustworthy) |
| Legal compliance, tax records, responding to lawful requests | Legal obligation |
| Optional email about product changes sent to Senders | Legitimate interest, or consent where the law requires it |
| Optional error monitoring | Legitimate interest |
Where a Sender relies on consent for sensitive items such as ID images, the Sender is responsible for obtaining it; DSV records the consent and its text version for the signing screen. We do not sell personal data and do not use it for advertising.
5. How data is stored and protected
We describe what is actually implemented. We do not claim any certification.
- Separate private storage for photos. ID photos and face-with-ID photos are held in a separate private bucket that is never public.
- Application-level encryption. Each photo is encrypted in the application with AES-256-GCM using its own per-file key before it is stored. File keys are wrapped by a per-account data key, which is wrapped by a master key held in a cloud key management service in production. The storage bucket also applies server-side encryption.
- Sensitive text fields (date of birth, address, ID numbers) use field-level AES-256-GCM encryption.
- Short-lived signed links. Photos can be opened only through signed links that expire (default 5 minutes). Every issued photo link is logged, so a Sender can see who opened a photo and when.
- In transit. TLS 1.2 or higher.
- Sign-in. Sender accounts require an authenticator-app code. Signers use a random, expiring link plus a one-time code. Tokens and codes are stored only as hashes. Rate limits and bot protection apply.
- Integrity. Completed PDFs are hashed (SHA-256), digitally sealed and timestamped (RFC 3161), so later changes are detectable.
- Logs redact passwords, tokens, codes, ID numbers and dates of birth. Photo contents are never logged.
- Backups. Daily encrypted backups, replicated across regions, with a 35-day restore window.
- Admin access. Platform administrators use a separate login, and every administrator action is logged.
No system is perfectly secure. If a personal data breach affects you, we will notify as the law and the DPA require.
6. Retention
- Sender controls retention. The default is to keep records until the Sender deletes them. A Sender can choose automatic deletion after a number of years, and can set a minimum retention lock on a template so records cannot be deleted early. We warn the Sender before any automatic deletion.
- Signer download window. A Signer can download their completed copy from their link for 30 days.
- Lapsed accounts. If a subscription lapses, the account becomes read-only. Records remain downloadable and are not deleted for non-payment.
- After termination. Records stay available to the Sender for the period in the Terms, then are deleted unless a lock, legal hold or law requires otherwise. [Counsel: confirm period.]
- Backups age out within 35 days of deletion.
- Our own records (billing, tax, security logs) are kept as long as needed for those purposes and legal obligations. [Counsel: specify periods.]
7. Who we share data with
We use a limited set of service providers (sub-processors), listed in SUBPROCESSORS.md: payments, email and SMS delivery, object storage, hosting, optional error monitoring, a public timestamp authority (receives only a hash) and a favicon service (receives only website domains). We do not sell data. We may disclose data if required by law or to protect rights and safety, and will tell the affected Sender where the law allows.
8. International transfers
Our service providers may process data in countries other than where you live. [Counsel: state hosting regions once selected.] Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on Standard Contractual Clauses and the UK and Swiss addenda, plus supplementary measures such as the encryption described above. See the DPA. For Brazilian data we follow LGPD transfer rules. [Counsel: confirm mechanisms and any data-privacy-framework certification, none is claimed here.]
9. Your rights
Depending on where you live, you may have the right to: access your data; correct it; delete it; restrict or object to processing; receive it in a portable format; withdraw consent; and complain to a regulator. Residents of California and some other US states have similar rights, including to know, delete and correct, and not to be discriminated against for exercising them. Brazilian residents have LGPD rights. Australian residents may access and correct data under the Australian Privacy Principles.
- Senders: contact [DPO/PRIVACY CONTACT]. Much of your data is also editable in the account settings, and "Export everything" gives you a copy.
- Signers: your request normally goes to the Sender who sent you the document (section 12). If you contact us, we will forward it to the Sender, and tell you who that is, unless the law requires otherwise.
- Deletion has limits. A request to delete Signer records may be refused or delayed by the Sender where a retention lock or a legal duty to keep records applies (for example record-keeping laws). Signed documents are also kept so that the Certificate of Completion and the seal remain valid. The Sender decides, and must explain to you.
We respond within the time the law requires (for example one month under GDPR, 45 days under CCPA, extendable where permitted).
10. Children
DSV is a business tool and is not directed at children. Sender accounts are for adults. Templates for adult-content contexts must only be sent to people aged 18 or over, and Senders must not use DSV to collect documents or IDs from minors in those contexts. If you believe a child's data has been submitted, tell [DPO/PRIVACY CONTACT]. Senders who deal with minors in other settings (for example guardians' consent forms) are responsible for compliance with children's privacy laws.
11. Cookies and similar technologies
- A session cookie (httpOnly, Secure, SameSite=Lax) keeps Senders signed in. It contains a random token, expires after 30 days of inactivity, and is strictly necessary.
- A locale cookie remembers your chosen interface language.
- Signing pages rely on the secure link token, not on tracking.
- We use no advertising trackers, no cross-site tracking, and no third-party analytics cookies. [Counsel: confirm that no consent banner is needed in the target regions, and update this section if analytics are ever added.]
12. Information for Signers
You are reading this because someone sent you a document to sign through DSV.
- The Sender who sent you the document is responsible for your data. They decided what to ask you for, including any ID photos, and why. Their name appears on the signing page, in the email you received and on the Certificate of Completion. Contact them for questions about how your information is used, kept, corrected or deleted.
- DSV is the processor. We run the signing software on the Sender's instructions and keep your data secure. We do not use it for our own purposes and do not sell it.
- DSV does not check your ID. The photos you upload are stored securely and shown to the Sender. Nothing automated is done to analyse them.
- What is recorded when you sign: your answers, signature, photos, consent, IP address, device, browser, and timestamps, in an audit trail attached to the document.
- Your copy. You can download the completed document from your link for 30 days. Save it.
- Problems. Every signing page has a "Report abuse" link. You can also write to [DPO/PRIVACY CONTACT].
- Your rights are in section 9. If the Sender does not respond, you may contact us and your local data protection authority.
13. Changes
We will post changes here and, for material changes, email Senders at least [30] days ahead. The "Last updated" date shows the current version.
14. Contact
[DPO/PRIVACY CONTACT], [COMPANY LEGAL NAME], [COMPANY ADDRESS], [CONTACT EMAIL]. [Counsel: add EU/UK representative details if required, and the regulator contact.]