Privacy

BotuSign collects what it needs to run an e-signature service and nothing it sells. This page says what that is.

What we collect

• Your account. When you sign in with Google we receive your name, email address and profile picture. We do not receive your Google password and we ask for no access to your Gmail, Drive or contacts.
• Agreements. The PDFs you upload, the names and email addresses of the people who must sign, the field values they enter, and their signatures.
• The signing record. For every signer: consent, timestamps, IP address, browser, and the steps they took, kept in a tamper-evident log and printed in the audit certificate.
• Billing. Stripe handles cards. We keep a customer id, the plan, and billing dates. We never see full card numbers.
• Technical logs. Requests and errors, to keep the service secure and working.

How it is used

To deliver agreements to signers, record what happened, send you email about your agreements, bill your plan, prevent abuse, and fix problems. We do not sell personal data and we do not use your documents to advertise or to train models.

Who processes it

• Railway: application hosting, database and private file storage.
• Stripe: payments and invoices.
• Cloudflare: DNS and outgoing email from botusign.com.
• Google: sign-in.

Signers receive email from sign@botusign.com on behalf of the sender. Documents are stored in a private bucket and reached only through short-lived signed links or by authenticated members of the sender's organization.

How long we keep it

Completed agreements, their certificates and the audit log are kept while the organization's account exists, because they are the record. Draft and unsigned agreements can be deleted by the sender. When an organization is deleted its documents and records are deleted, except what we must keep for legal or billing reasons.

Your choices

You can ask to see, correct, export or delete your data. A signer can contact the sender, who controls the agreement. Write to support@botusign.com and we will respond.

Security

Signing links are single-purpose and stored only as hashes, files are private, connections use TLS, and every signing step is logged. No online service is perfectly secure, and BotuSign has not had a SOC 2 audit or an outside penetration test. If something goes wrong with your data we will tell you.