Privacy Policy | Verdocs

1. Introduction

Verdocs, Inc., a Delaware Corporation (the "Company" or "We" or "Our" or "Us") respects your privacy and is committed to protecting it through Our compliance with this Privacy Policy.

This Privacy Policy describes the types of information we may collect from you or that you may provide when you visit the website verdocs.com (Our "Website") or use Our eSignature platform, API, embedded components, or other products and services (collectively, the "Platform"), and Our practices for collecting, using, maintaining, protecting, and disclosing that information.

This Privacy Policy applies to the information we collect:

On Our Website and Platform.
In email, text, and other electronic messages between you and Us.
When you interact with Our embedded components or API-based services within third-party applications.
When you interact with document signing workflows delivered via Our Platform on behalf of Our clients.

It does not apply to information collected by Us offline or through any other means, including on any other website operated by the Company.

Customers whose use of the Platform is governed by the Verdocs Subscription Terms and Conditions or another agreement with Verdocs should note that the applicable agreement and any incorporated or executed addenda, including the Verdocs Data Processing Addendum (“DPA”), Business Associate Addendum, or Service Level Addendum, will govern to the extent of any conflict with this Privacy Policy.

Please read this Privacy Policy carefully to understand Our practices regarding your information. This Privacy Policy is intended to describe how Verdocs collects, uses, maintains, protects, and discloses Personal Information. Your use of the Platform is also subject to the Verdocs Subscription Terms and Conditions and any applicable Order Form, Data Processing Addendum, Business Associate Addendum, or other agreement.

We may provide communications, notices, disclosures, policy updates, and other information relating to Our services electronically, including by email, in-product notification, or dashboard posting. You agree that such electronic communications satisfy any legal requirement that such communications be in writing, to the extent permitted by law.

2. Our Role: Data Controller and Data Processor

Data Controller. When We collect and use information about visitors to Our Website, individuals who create Verdocs accounts, and users who interact directly with Our products and services, We act as a data controller. In this role, We determine the purposes and means of processing your Personal Information, and this Privacy Policy governs that processing.

Data Processor. When Our customers use the Platform to process Personal Information on behalf of their own users, customers, signers, or other individuals, Verdocs acts as a processor or subprocessor, as applicable. In this role, Verdocs processes Personal Information on the customer’s documented instructions and in accordance with the Verdocs Data Processing Addendum available at verdocs.com/dpa. The DPA is incorporated into the Verdocs Subscription Terms and Conditions and automatically applies where Verdocs processes Personal Data on behalf of a customer. No separate signature or Order Form is required for the DPA to apply.

Customer Data ownership. As between Verdocs and its customers, customers retain all right, title, and interest in and to their Customer Data. Where Verdocs acts as a processor or subprocessor, Verdocs processes Customer Data solely as necessary to provide, maintain, support, secure, and make available the Services, comply with law, and otherwise act on the customer’s documented instructions in accordance with the applicable agreement and DPA.

Subprocessors: Verdocs uses third-party Subprocessors to help provide the Services and maintains appropriate contractual data protection obligations with those Subprocessors. Where the DPA applies, Verdocs maintains a current list of Subprocessors that process Customer Personal Data and will provide that list to the applicable customer upon request. Verdocs will provide customers subject to the DPA with at least thirty (30) days’ prior written notice of any intended addition or replacement of a Subprocessor that processes Customer Personal Data, as further described in the DPA.

If you are an end user who received a document for signing through a third-party application powered by Verdocs and have questions about how your Personal Information is handled, please contact the organization that sent you the document. That organization is the data controller responsible for your information. You may also contact Us at hello@verdocs.com and We will direct your inquiry appropriately.

3. Children Under the Age of 16

Our Website is not intended for children under 16 years of age. No one under the age of 16 may provide any Personal Information to, or on, Our Website. We do not knowingly collect Personal Information from children under 16. If you are under 16, do not provide any information about yourself to Us, including your name, address, telephone number, email address, or any screen name or username you may use. If we learn we have collected or received Personal Information from a child under 16 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 16, please contact Us at hello@verdocs.com.

California residents under 16 years of age may have additional rights regarding the collection and sale of their Personal Information. See Section 9 (U.S. State Privacy Rights) for details.

4. Information We Collect About You and How We Collect It

We collect several types of information from and about users of Our Website and Platform, including:

Information by which you may be personally identified, such as first name, last name, email address, phone number, address, password, company name, country, state, ZIP/Postal Code, city, User ID, and billing address (collectively "Personal Information");
For document signers: name, email address, IP address at the time of signing, device information, signature image, signing timestamp, and audit trail data necessary to create a legally valid electronic signature record;
Usage data, cookies, and similar tracking data as described in Section 6 (Cookies and Similar Technologies).

We collect this information:

Directly from you when you provide it to Us.
Automatically as you navigate through Our Website or use Our Platform, including through cookies and other tracking technologies.
From third parties, such as identity verification services or Our clients (when they provide signer information to initiate a signing workflow).

Information You Provide to Us

The information we collect on or through Our Website or Platform may include:

Information that you provide by filling in forms on Our Website, including at registration, subscription, or when requesting services or support.
Records and copies of your correspondence (including email addresses), if you contact Us.
Your responses to surveys that we might ask you to complete for research purposes.
Details of transactions you carry out through Our Website or Platform.
Your search queries on Our Website.
Electronic signature data, including your typed, drawn, or adopted signature, and any fields you complete in a document signing workflow.

Information We Collect Through Automatic Data Collection Technologies

As you navigate through and interact with Our Website or Platform, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

Details of your visits to Our Website, including traffic data, location data, logs, and the resources that you access and use.
Information about your computer and internet connection, including your IP address, operating system, and browser type.

The technologies we use for this automatic data collection may include:

Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. See Section 6 (Cookies and Similar Technologies) for full details on the cookies We use and your choices.
Web Beacons. Pages of Our Website and Our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company to count users who have visited those pages or opened an email and for related website statistics.

5. How We Use Your Information

We use information that we collect about you or that you provide to Us, including any Personal Information:

To present Our Website and Platform and their contents to you.
To provide you with information, products, or services that you request from Us.
To fulfill any other purpose for which you provide it.
To provide you with notices about your account, including expiration and renewal notices.
To carry out Our obligations and enforce Our rights arising from any contracts entered into between you and Us, including for billing and collection.
To notify you about changes to Our Website, Platform, or any products or services we offer or provide through them.
To allow you to participate in interactive features on Our Website or Platform.
To send you SMS/text messages for transactional, operational, or service-related communications when you have provided your mobile phone number and consented to receive such messages.
To create and maintain legally valid electronic signature records, including audit trails, as required under applicable electronic signature laws (including the U.S. ESIGN Act and UETA).
To analyze usage patterns and improve Our Platform, using aggregated and de-identified data where possible.
To detect, prevent, and respond to fraud, security incidents, or violations of Our terms of service.
In any other way we may describe when you provide the information.
For any other purpose with your consent.

Lawful Bases for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, We process your Personal Information on the following lawful bases:

Performance of a contract (Art. 6(1)(b)): Processing necessary to provide Our Platform and services to you, including account management, document signing, and billing.
Legitimate interests (Art. 6(1)(f)): Processing for fraud prevention, security, improving Our Platform, and direct marketing to existing customers, where Our interests are not overridden by your rights.
Consent (Art. 6(1)(a)): Processing based on your affirmative consent, including non-essential cookies, SMS communications, and certain marketing activities. You may withdraw consent at any time without affecting the lawfulness of prior processing.
Legal obligation (Art. 6(1)(c)): Processing necessary to comply with applicable laws, such as retaining electronic signature audit records as required by law.

SMS/Text Messaging and Mobile Communications

We may offer you the option to receive text messages (SMS/MMS) from Verdocs for purposes such as account notifications, document signing alerts, and other transactional or service-related communications. The following terms govern our mobile messaging program:

Consent. By providing your mobile phone number and opting in to receive SMS communications from Us, you expressly consent to receive text messages from Verdocs at the mobile number provided. Consent to receive SMS messages is not a condition of purchasing any product or service.
No Sharing of Mobile Opt-In Data. We do not sell, rent, share, or otherwise disclose your mobile phone number or SMS opt-in consent data to third parties or affiliates for their marketing purposes. Mobile opt-in data will not be shared with any third party or affiliate except as required to operate Our SMS messaging program.
Message Frequency. Message frequency will vary based on your activity and preferences. Standard message and data rates may apply.
How to Opt Out. You may opt out of receiving SMS messages from Us at any time by replying STOP to any text message you receive from Us or by contacting hello@verdocs.com.
Help. For help with SMS communications, reply HELP to any text message you receive from Us or contact Us at hello@verdocs.com.

6. Cookies and Similar Technologies

Our Website uses only a minimal set of cookies and similar technologies, and does not use advertising or targeting cookies.

Strictly necessary technologies. Our Website and Platform use cookies and similar technologies that are essential to function, such as those used for authentication, session management, security, and abuse prevention (including anti-bot verification on forms). These do not require consent.
Preferences. Our Website stores limited preferences, such as your light or dark theme choice, in your browser’s local storage. This information stays on your device and is not used to identify or track you.
Analytics. We measure Website traffic using a self-hosted, first-party analytics system that does not use cookies, does not follow you across other websites, and produces aggregate statistics rather than profiles of identified individuals.

Because Our Website does not use advertising, targeting, or cross-site tracking technologies, no cookie consent banner is presented. You can control or delete cookies and local storage through your browser settings; doing so may affect features that depend on them, such as staying signed in to the Platform.

Do Not Track Signals

Our Website does not engage in cross-site tracking. Because no such tracking occurs, Our Website does not respond differently to Do Not Track (DNT) signals.

7. Disclosure of Your Information

We may disclose aggregated and anonymized information about Our users, and information that does not identify any individual, without restriction.

We may disclose Personal Information that we collect or you provide as described in this Privacy Policy:

To Our subsidiaries and affiliates, provided that mobile opt-in data (including mobile phone numbers and SMS consent) will never be shared with subsidiaries or affiliates for marketing or any other purpose not directly necessary to provide Our services to you.
To contractors, service providers, and other third parties we use to support Our business (including cloud infrastructure providers, analytics providers, and payment processors). Where required by applicable law, We enter into data processing agreements with these service providers to ensure they protect your Personal Information.
To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Verdocs' assets.
To third parties to market their products or services to you only if you have affirmatively consented to such disclosure. For the avoidance of doubt, your mobile phone number and mobile opt-in consent data will never be shared with third parties for marketing purposes, regardless of any other consent you may have provided.
To fulfill the purpose for which you provide it.
For any other purpose disclosed by Us when you provide the information.
With your consent.

We may also disclose your Personal Information:

To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
To enforce or apply Our terms of use and other agreements, including for billing and collection purposes.
If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Verdocs, Our customers, or others.
International Data Transfers. If Personal Information subject to the GDPR, UK GDPR, Swiss data protection law, or other applicable transfer restrictions is transferred to a country that does not provide an adequate level of protection, Verdocs will use an applicable lawful transfer mechanism. Where applicable, such safeguards include the European Commission’s Standard Contractual Clauses and, for transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, as further described in the DPA. You may request additional information regarding applicable transfer safeguards by contacting hello@verdocs.com.

8. Choices About How We Use and Disclose Your Information

We strive to provide you with choices regarding the Personal Information you provide to Us:

Tracking Technologies / Cookies. Our Website does not use advertising or targeting cookies, so no cookie preference center is required. You can control or delete cookies and local storage at any time through your browser settings, as described in Section 6 (Cookies and Similar Technologies).
Promotional Offers from the Company. If you do not wish to have your contact information used by the Company to promote Our own products or services, you can opt-out by emailing hello@verdocs.com. We do not use your mobile phone number to promote third-party products or services, and we do not share your mobile phone number with third parties for their marketing purposes.
SMS/Text Messages. To opt out of SMS/text messages from Verdocs, reply STOP to any message you receive from Us, or contact Us at hello@verdocs.com. Standard message and data rates may apply.
Withdrawal of Consent (GDPR). Where We process your Personal Information based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing. To withdraw consent, please contact Us at hello@verdocs.com or use the relevant opt-out mechanism.

Residents of certain states may have additional Personal Information rights and choices. See Sections 9 and 10 below.

9. U.S. State Privacy Rights

Several U.S. states have enacted comprehensive privacy laws that grant their residents specific rights regarding their Personal Information. Depending on your state of residence, you may have some or all of the rights described below.

California Residents (CCPA/CPRA)

California residents have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). These include:

Right to Know. You have the right to request that We disclose the categories and specific pieces of Personal Information We have collected about you, the categories of sources, the business purpose, and the categories of third parties with whom We share it.
Right to Delete. You have the right to request that We delete Personal Information We have collected from you, subject to certain exceptions.
Right to Correct. You have the right to request that We correct inaccurate Personal Information about you.
Right to Opt Out of Sale or Sharing. We do not sell Personal Information, and Our Website does not use cookies or similar technologies for cross-context behavioral advertising, so no cookie-based opt-out mechanism is required. If you have questions or wish to submit a request regarding sale or sharing, contact Us at hello@verdocs.com.
Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA/CPRA rights.

Requests Relating to Customer-Controlled Data. If Verdocs processes your Personal Information on behalf of a customer as a processor or subprocessor, the applicable customer is responsible for responding to your privacy rights request. In that circumstance, please direct your request to the organization that provided the applicable document, workflow, or service. If you submit such a request directly to Verdocs, We will direct you to the applicable customer or otherwise handle the request in accordance with Our obligations under the DPA and applicable law.

To exercise your California rights, contact Us at hello@verdocs.com with the subject line "California Privacy Request." We will respond within 45 days as required by law.

Other U.S. State Residents

Residents of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and other states with active comprehensive privacy laws may have rights including: right to access, right to correct, right to delete, right to data portability, and right to opt out of targeted advertising or profiling.

To exercise your state privacy rights, contact Us at hello@verdocs.com with the subject line "State Privacy Request." If We deny your request, you may appeal by contacting Us at the same address.

10. Rights Under GDPR (EEA, UK, and Switzerland)

If you are located in the EEA, United Kingdom, or Switzerland, GDPR or applicable national implementing legislation grants you the following rights:

Right of Access (Art. 15). You have the right to obtain confirmation of whether We process your Personal Information and, if so, a copy of it.
Right to Rectification (Art. 16). You have the right to request correction of inaccurate or incomplete Personal Information.
Right to Erasure (Art. 17). You have the right to request deletion of your Personal Information in certain circumstances.
Right to Restriction of Processing (Art. 18). You have the right to request that We restrict the processing of your Personal Information in certain circumstances.
Right to Data Portability (Art. 20). Where processing is based on consent or contract and carried out by automated means, you have the right to receive your Personal Information in a portable format.
Right to Object (Art. 21). You have the right to object to processing where We rely on legitimate interests, including for direct marketing purposes.
Right to Withdraw Consent (Art. 7(3)). Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
Right to Lodge a Complaint. You have the right to lodge a complaint with your local supervisory authority. In the EU: edpb.europa.eu. In the UK: ico.org.uk.

If Verdocs processes your Personal Information on behalf of a customer as a processor or subprocessor, the applicable customer is responsible for responding to your request. Please direct your request to the organization that provided the applicable document, workflow, or service. If you submit such a request directly to Verdocs, We will direct you to the applicable customer or otherwise handle the request in accordance with Our obligations under the DPA and applicable law.

To exercise these rights, contact Us at hello@verdocs.com. We will respond within 30 days, extendable by 60 days for complex requests with notice to you.

11. Data Retention

We retain Personal Information for as long as necessary to fulfill the purposes for which it was collected, comply with Our legal obligations, resolve disputes, and enforce Our agreements.

Customer Data. The retention periods below generally apply to Verdocs’ own operational, compliance, and administrative records. Customer Data submitted by customers or their end users through the Services is governed by the applicable customer agreement and, where Verdocs acts as a processor or subprocessor, the DPA. Under Verdocs’ standard Subscription Terms and Conditions, Customer Data is generally made available for export during any applicable wind-down period and may be deleted ninety (90) days after the end of that period, or, if no wind-down period applies, ninety (90) days after termination or expiration, unless retention is required by law. Where the DPA applies, return, export, retention, and deletion of Customer Personal Data are also governed by the DPA, and the DPA will control in the event of a conflict regarding such Personal Data.

Verdocs account and administrative records. Retained for the duration of your active account and for a period of up to 3 years after account closure, to allow for dispute resolution and compliance with Our legal obligations.
Electronic signature and audit trail data. Retained for a minimum of 7 years after the date of signing, as required to support the legal validity of signed documents under applicable electronic signature laws (including the U.S. ESIGN Act). Clients may configure longer retention periods.
Usage and analytics data. Retained in identifiable form for up to 2 years, after which it is aggregated or deleted.
Marketing communications data. Retained until you opt out or for up to 3 years from your last interaction with Us, whichever is earlier.
Legal and compliance records. Retained for the period required by applicable law, which may exceed the periods above.

At the end of the applicable retention period, We securely delete or anonymize your Personal Information.

12. Accessing and Correcting Your Information

You can review and change your Personal Information by logging into Our Website and visiting your account profile page.

You may also send Us an email at hello@verdocs.com to request access to, correct or delete any Personal Information that you have provided to Us. We cannot delete your Personal Information except by also deleting your user account.

For requests under applicable state privacy laws or GDPR, see Sections 9 and 10 above for the applicable procedures and response timeframes.

13. AI and Automated Processing

Verdocs does not use Customer Data or Personal Information submitted through the Services to train, fine-tune, test, or otherwise improve any artificial intelligence or machine learning model, whether operated by Verdocs or any third party, without explicit prior consent. Aggregated, de-identified, and system-generated usage and performance data, which does not identify any customer, end user, or individual, may be used to improve service quality, reliability, and performance.

To the extent that Verdocs introduces AI-assisted features (such as document field detection, template suggestions, or workflow automation), We will describe such processing in this Privacy Policy as those features are made available.

We do not currently make solely automated decisions that produce legal or similarly significant effects about individuals. If this changes, We will update this Privacy Policy and, where required by applicable law (including GDPR Art. 22), provide you with the right to obtain human review of such decisions.

14. Data Security

We have implemented measures designed to secure your Personal Information from accidental loss and from unauthorized access, use, alteration, and disclosure. All information you provide to Us is stored on Our secure servers. Any payment transactions and certain other information will be encrypted using TLS (Transport Layer Security) encryption.

Our security program includes the following controls:

Encryption. Encryption of data in transit and at rest.
Access Controls. Logical access controls and least-privilege practices to limit access to Personal Information to authorized personnel.
Logging and Monitoring. Logging and monitoring of privileged and production system access.
Secure Development. Secure development practices, vulnerability management, and patching processes.
Incident Response. Documented incident response procedures.
Backup and Recovery. Backup and disaster recovery practices designed to ensure availability of Customer Data.
Workforce Controls. Workforce confidentiality and access management controls.

The safety and security of your information also depends on you. You are responsible for keeping your account credentials confidential.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do Our best to protect your Personal Information, we cannot guarantee the security of your Personal Information transmitted to Our Website.

Security Incident Notification. In the event of a security incident affecting Personal Information, Verdocs will provide notifications as required by applicable law. Where Verdocs processes Customer Personal Data as a processor or subprocessor, Personal Data Breach notification obligations to the applicable customer are governed by the DPA.

15. Changes to Our Privacy Policy

It is Our Privacy Policy to post any changes we make to Our Privacy Policy on this page with a notice that the Privacy Policy has been updated on Our Website home page. If we make material changes to how we treat Our users' Personal Information, we will notify you through a notice on Our Website home page. The date the Privacy Policy was last revised is identified at the top of the page.

Customers whose use of the Services is governed by the Verdocs Subscription Terms and Conditions or another applicable agreement will receive notice of material changes as required by that agreement.

16. Contact Information

To ask questions or comment about this Privacy Policy and Our privacy practices, contact Us at:

Verdocs, Inc.

hello@verdocs.com

For GDPR-related inquiries or to exercise your data subject rights, please include "GDPR Request" in the subject line of your email. For U.S. state privacy requests, please include "State Privacy Request" in the subject line.

17. HIPAA and Regulated Data

Customers must not use the Services to create, receive, maintain, transmit, or otherwise process Protected Health Information (“PHI”), including electronic protected health information (“ePHI”), as those terms are defined under HIPAA, unless and until Customer and Verdocs have executed an applicable Business Associate Addendum. If an executed Business Associate Addendum applies, it will control solely with respect to PHI and ePHI.

Similarly, if your use of the Services involves other categories of regulated data, including financial data subject to the Gramm-Leach-Bliley Act (GLBA), consumer report information subject to the Fair Credit Reporting Act (FCRA), or other industry-regulated data, additional terms or addenda may apply. Please contact hello@verdocs.com to discuss the appropriate addendum for your use case.

Contractual disputes relating to use of the Services are governed by the applicable Verdocs Subscription Terms and Conditions or other agreement between Verdocs and the applicable customer. Nothing in this Privacy Policy limits privacy rights or remedies that cannot lawfully be waived.