Privacy Policy

Effective date: 21 October 2026

1. Introduction

Welcome to SignToSee, operating under the commercial brand of Penserini & Vankan VOF (hereinafter referred to as "SignToSee", "us", "we", or "our").

Our Privacy Policy governs your visit to https://www.signtosee.eu, and explains how we collect, safeguard, and disclose information that results from your use of our Service. SignToSee is a document workflow and digital access terms tracking platform. Because our core function involves generating access audit logs, we handle data with strict adherence to the European General Data Protection Regulation (GDPR).

By using our Service, you agree to the collection and use of information in accordance with this policy.

2. Definitions

SERVICE means the SignToSee platform and website.

CUSTOMER (DATA CONTROLLER): The business, freelancer, or entity that creates an account with us to protect their links. For the files and links protected by the Service, the Customer is the Data Controller.

SIGNER / RECIPIENT (DATA SUBJECT): The third-party individual who clicks a SignToSee link, signs the confidentiality agreement, and accesses the protected content.

SIGNTOSEE (DATA PROCESSOR / CONTROLLER): We act as a Data Processor when facilitating the signature and access gate on behalf of our Customers. We act as a Data Controller for our Customers' account and billing information.

ACCESS LOG: The tamper-evident cryptographic log generated when a Signer accesses a protected link, containing timestamps, IP addresses, and user-agent data.

3. Information Collection and Use

We collect specific, minimized types of information to provide our Service, process billing, and generate a verifiable access and acceptance record for B2B confidentiality workflows.

4. Types of Data Collected

4.1 Customer Account Data (For Users Who Register)

To operate your account, we may ask you to provide personally identifiable information, including:

Email address

Password (cryptographically hashed)

Company name (required)

Business Name and VAT Number (for B2B billing)

Billing Address (Street & Number, City, ZIP Code, Country)

Company registration number, where you provide one

Branding you upload for use on your gates: logo image, brand text, and colour settings, for your account and for any project you give its own branding; and, if you add them, the name, role and photo on your sender card, the label and address of your own button, a background image, and your choice of font and background

If you use your own domain for your links: its hostname, the verification value we ask you to publish in its DNS, and the results of our checks of its DNS records

If you turn on sign-in protection: for each passkey, its public key, the name you give it, and when it was added and last used; your authenticator app's secret, encrypted under a key we hold; and one-way hashes of your recovery codes. A passkey's private key never leaves your device.

A pending email address or pending company details, held only while a change you requested is awaiting confirmation

The customer and subscription identifiers issued to us by our payment provider, which let us match your account to your payments

If you redeem a promotion code: which code, and when. Some codes belong to a partner who recommends us and receives a commission on what accounts that used their code pay. That partner is told only totals across everyone who used it (how many redeemed it, how many pay, and the commission), never who you are.

The review status of your account, and any notes an administrator of ours records when reviewing it. You may ask us for a copy of those notes.

4.2 Access Log Data (For Signers / Recipients)

When a Signer accesses a protected link, we automatically collect data to generate the access and audit log. This includes:

The Signer's submitted Email Address

IP Address (stored encrypted at rest using envelope encryption)

Browser family, its major version number, and the operating system platform, reduced from the User-Agent header on arrival and stored in that reduced form; the full User-Agent string is not retained

Approximate geographical location, at country level only, looked up from the IP address in a copy of the DB-IP IP-to-country database (https://db-ip.com, licensed CC BY 4.0) kept on our own servers; the IP address is not sent to any lookup service. It is used to enforce region-locked links and to record where an acceptance took place. Where the database has no answer, no location is recorded, and a region-locked link cannot be opened

Exact timestamps of link access, email verification, and digital signature execution

A keyed hash (HMAC-SHA256) of the Signer's email address, used to locate the correct decryption key. It is computed under a secret held only by our servers and kept separate from the encryption keys, so a copy of the database alone cannot be used to test whether a given email address appears in it.

Cryptographic block hashes (previous and current mathematical hashes) verifying the integrity of the audit chain

Hashed representation of what the Signer was shown (SHA-256 hash of the exact NDA or access terms presented at the moment of execution or, for a gate without an agreement, of the notice shown before access)

Where a gate presents NDA-style access terms, the identity details the Signer types into the acceptance form: company or trading name, the name and function of the person accepting, postal address, company registration number, and the place of signing. These are written into the text of the access terms as executed, so that the executed document identifies its parties.

These details are held exactly as the email address and IP address are: encrypted under the Data Encryption Key unique to that Signer and Customer, and destroyed with it. What we store is the frozen text of the Customer's access terms, without the Signer's particulars in it. The executed agreement is assembled from the two whenever it is displayed, emailed or exported, and is not kept in an assembled form anywhere.

To hold the email address and IP address listed above as ciphertext, we generate a Data Encryption Key unique to each Signer and Customer pair. This key is not collected from you. We create it, store it in encrypted form, and destroy it on erasure as described in Section 6.3.

The Signer's IP address (system IP routing data) is logged exclusively for fraud prevention, security, and the generation of the access log. We process user access timestamps and system IP routing data, not invasive tracking data. We do not use signer IP addresses for marketing, profiling, or unrelated analytics. Signer IP addresses remain readable for the period set out in Section 6.2, and longer only while a legal hold described there requires it.

When someone asks for a verification code for a link, we keep the email address they entered, a hash of the code, and when it was sent, so that the code can be checked. A code that is used is deleted at once. If it is never used, the Customer who created the link can see that a code was sent to that address and not used, so they can tell someone who could not find our email from someone who did not try. That address and time are deleted 14 days after the code was sent.

4.3 Hosted File Data

For Customers utilizing our file hosting (10MB on Free; 1GB, 10GB, 15GB and 30GB on Share, Share+, Sign and Sign+ respectively), we store the uploaded files on our servers as ciphertext. Files are encrypted client-side, in the same way as our URL routing gateway: the decryption key remains strictly client-side, is never transmitted to or held by SignToSee, and travels only in the link fragment shared with the recipient. We cannot decrypt, inspect, mine, or otherwise access the contents of these files, and cannot produce them in decrypted form in response to a legal request or a copyright takedown notice, as we do not hold the key. Note: For the Scout tier, we operate strictly as a zero-knowledge URL gateway and do not host or see the underlying destination files (e.g., your Figma or Notion workspaces).

A Customer can also create a file request: a link through which someone else sends files to the Customer. The person sending does not need an account. Their browser encrypts each file, its name and type, and the name, email address and note they enter, to a key held only in the Customer's browser. We store that ciphertext with its size and the time it arrived, and cannot read any of it. Their IP address is used to limit how many files one address can send in an hour; it is not stored with the files. The files count toward the Customer's storage and stay until the Customer deletes them or the account. An upload that was started but never completed is removed after one day.

4.4 Tracking and Cookies

We utilize minimal, privacy-first session cookies necessary to operate the Service (e.g., keeping you logged in). We do not use third-party advertising tracking cookies (such as Meta Pixel or Google Ads trackers) that sell your data to external brokers.

When a Signer opens a gate, we set one strictly necessary cookie for that gate. It lets the same browser reopen the gate for up to 30 days without a new verification code, and it contains no email address: it names the access record the Signer was verified against and is signed so it cannot be forged. The Signer's browser also keeps the email address they verified in its own local storage for that link, so the watermark can show it on return visits; it is not sent to us for that purpose. Clearing site data removes both. The Customer can end access at any time by revoking the recipient, pausing or archiving the gate, and a returning Signer is then refused.

Each time a verified Signer opens a gate, the first time and every time after, by a code or through that cookie, we also record the time, which of the two was used, and a reference to the Signer's first access record, so the Customer can see how often and when the gate was reopened and, if the Customer has turned it on, be told by email when a Signer returns to a gate a day or more after their previous open. Opens within 30 minutes of each other are recorded once. These records are not part of the tamper-evident access record and hold no email address or IP address of their own. They are deleted after 90 days, and earlier when the gate, the recipient or the Customer's account is deleted, or when the Signer's data is erased as described in Section 6.3. For a gate that leads to another website, a recorded open means the gate let the Signer through again; we see nothing after the redirect. We do not record which pages of a document a Signer views or how long they spend on it.

An email we send a Signer on a Customer's behalf (the verification code, the executed agreement, an approved access request) shows the Customer's logo when the Customer has set one. The Signer's mail program loads that image from our servers; the Service does not record who loaded it.

5. Use of Data

SignToSee uses the collected data for various purposes:

To provide and maintain our Service, including URL routing and decryption.

To generate and preserve tamper-evident access logs for our Customers.

To notify you about changes to our Service or infrastructure.

To provide customer support and technical maintenance.

To process payments via Mollie.

To detect, prevent, and address technical fraud or bot abuse.

We do not use Customer or Signer data for advertising, profiling, or sale to third parties. Where a Customer trades under their own name, we identify them publicly as a customer only if they have given us consent under Section 4.6 of the Terms, and only for as long as that consent stands; they may withdraw it at any time.

6. Retention of Data and the Right to Erasure

6.1 Customer Account Data

We retain Customer Personal Data only for as long as is necessary for the purposes set out in this policy, or to comply with European tax and accounting laws (typically 7 years for billing records).

6.2 Access Record Retention

The fundamental purpose of SignToSee is to provide our Customers with a verifiable record that a specific individual accessed protected content and accepted the access terms. The access record itself, meaning the timestamps, the hash chain linkage, and the hash of the terms that were accepted, is append-only and is retained for the establishment, exercise or defence of legal claims, which GDPR Article 17(3)(e) permits. The Signer's personal data inside it is retained for ten years after the most recent access record of that Signer with that Customer. At the end of that period the Signer's encryption key is destroyed as described in Section 6.3, unless SignToSee has placed a legal hold on one of the records concerned because of a specific dispute or legal claim, in which case the key is kept until the hold is released. Cancelling a subscription does not shorten this period. Deleting a Customer account destroys the keys of all of that Customer's Signers immediately; an account with a record under a legal hold cannot be deleted until the hold is released. The fields described in Section 6.4 remain after the key is destroyed.

6.3 Erasure of Personal Data Within an Access Record

The personal data inside that record is handled separately from the record itself. A Signer's email address and IP address are stored only as ciphertext, encrypted under an encryption key unique to that Signer and that Customer. On a valid erasure request we destroy that key. The access record remains and stays cryptographically verifiable, but the email address and IP address within it can no longer be decrypted not by us, not by the Customer, and not by anyone holding a copy of our database. This is irreversible and cannot be undone on request.

6.4 What Key Destruction Does Not Reach

Certain fields are inputs to the record's integrity hash, so they cannot be altered or removed without breaking verification of that record. These are the identifiers of the record and the gate, the timestamp of access, a coarse browser and device descriptor, the fingerprint and size of the file that was accessed, and the hash of the accepted terms. They are deliberately kept coarse for this reason: anything placed inside the hash is permanent.

The frozen text of the access terms is beyond reach, because it is held in a table that rejects updates and deletions and its hash anchors the record. That text contains the Customer's own details and the terms themselves; the Signer's particulars are not in it, and are destroyed with the key as described in Section 6.3. After erasure the agreement still renders, showing the terms that were accepted with the Signer's identity marked as erased.

Other fields are retained simply because the access log is append-only, without forming part of the hash. The location descriptor derived from the IP address is one of these. It is recorded at country level only, for example "NL (approximate, from IP address)", and it is stored in the log as ordinary text, not under the Signer's encryption key. Key destruction therefore does not blind it.

Signature receipts already delivered by email to the Customer or the Signer also cannot be recalled.

7. EU Data Sovereignty and Transfer of Data

SignToSee is built on the principle of European Data Sovereignty.

Your information, including Personal Data and Hosted Files, is processed and maintained on servers located entirely within the European Union (e.g., via Scaleway in France). We actively avoid hyperscalers subject to the US CLOUD Act (AWS, Google Cloud) for our core hosting to protect your intellectual property from foreign extraterritorial jurisdiction.

If we utilize third-party sub-processors located outside the EU, we ensure strict compliance with the GDPR via Standard Contractual Clauses (SCCs).

8. Disclosure of Data

We may disclose personal information under the following circumstances:

To the Customer: Access Log data belonging to a Signer is fully visible and exportable by the Customer who generated the protected link.

To the Signer: when a Signer opens an uploaded file, the watermark on each page shows the email address of the Customer's account beside the Signer's own. It is sent to the Signer's browser only after they have been verified, and is not shown when the Customer turns the watermark off or uses a logo watermark instead of text. When the Customer adds a sender card, the name, role and photo they entered are shown on the link page to anyone holding the link, before any verification.

Law Enforcement: Under certain circumstances, we may be required to disclose data if required by Belgian or EU law, or in response to valid requests by public authorities.

Business Transaction: If SignToSee is involved in a merger or acquisition.

9. Security of Data

Traffic to and from the Service is encrypted with TLS.

Payload data, meaning the destination URL behind a gate and any file you upload, is encrypted in your browser before it reaches us, under a key we never receive. We store and serve only ciphertext.

Access log personal data is encrypted at rest under a key unique to each Signer and Customer pair. Those keys are themselves encrypted under a master key held only in the environment of the running server, and never written into a stored container image or a source repository.

Signer email addresses are indexed using a keyed hash computed under a secret separate from the encryption keys, so a copy of the database alone cannot be used to test whether a given email address appears in it.

No method of transmission or storage is completely secure, and we do not claim otherwise.

10. Your Data Protection Rights Under GDPR

If you are a resident of the European Economic Area (EEA), you have certain data protection rights. We aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data.

If you wish to be informed what Personal Data we hold about you, email us at support@signtosee.eu.

You have the right to:

Access, update, or delete the information we hold about you. For access records specifically, deletion is carried out by destroying the encryption key for your data, and Sections 6.3 and 6.4 set out exactly what that reaches and what it does not.

Rectification of inaccurate information.

Object to or Restrict processing.

Data Portability.

Please note that we will ask you to verify your identity before responding to such requests. If you are a Signer/Recipient requesting erasure of your data from an Access Log, the Customer who created the link is the Data Controller for that record, and we will route your request to them. Where the request is valid, the mechanism is the key destruction described in Section 6.3: your email address and IP address become permanently undecryptable, while the record that an acceptance took place remains.

11. Data Processors and Service Providers

We employ specialized third-party EU-compliant companies to facilitate our Service:

Hosting & Infrastructure: Scaleway (France)

Email Automation: Brevo (France)

Payment Processing: Mollie (Netherlands)

Invoicing & Accounting: Moneybird (Netherlands)

Analytics: Privacy-first analytics (e.g., Plausible or Ghost CMS logs) that do not use invasive tracking cookies.

12. Payments and B2B Invoicing

We use third-party services for payment processing and B2B VAT invoicing. We do not store or collect your payment card details on our servers. That information is provided directly to our payment processing provider, Mollie, and our invoicing platform, Moneybird, whose use of your personal information is governed by their respective Privacy Policies and strict security standards.

13. Children's Privacy

Our Services are strictly for B2B professional use and are not intended for anyone under the age of 18. We do not knowingly collect personally identifiable information from children.

14. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Effective date."

15. Contact Us / Company Information

If you have any questions about this Privacy Policy or your GDPR rights, please contact us:

Commercial Brand: SignToSee

Legal Entity: Penserini & Vankan VOF

Enterprise Number (KBO): BE 1036.515.175

Email: support@signtosee.eu