MyESign · Legal
Personal Data Declaration
Draft v1 — 2026-10-17 — pending legal review
Version 1 · Applies to MyESign at myesign.app, the MyESign app and the MyESign API
This declaration lists every kind of personal data MyESign handles, for senders and for signers: what it is, where it comes from, why we use it, where it is kept, for how long and who else receives it. It complements the Privacy Policy; if they ever differ, the Privacy Policy prevails.
1. At a glance
Sale of data · ads · AI training
None
Who decides about a sent document
The sending business (we process it for them)
Where it lives
United States — Google Cloud, MongoDB Atlas
Printed on the certificate — seen by every party of the envelope
- Each signer's name and email or phone
- When each signer opened and signed, in UTC
- Each signer's IP address and method (typed, drawn or voice)
- The drawn signature image or the typed name
- The identity check result, when the sender required one
- The last lines of the phone-call transcript, for voice signatures
- The document fingerprint, the seal and the timestamp
2. Inventory of personal data
Each line is one kind of data. Where it is stored: grey = our cloud in the United States; blue = held by a provider; green = your own browser. The legal bases are in section 4 of the Privacy Policy.
| Data | Examples | Source | Purpose | Where it is stored | Retention | Shared with |
|---|---|---|---|---|---|---|
| Sender account | Name, email, password (held by Firebase, never readable by us), company or team name | You, at sign-up | Sign in, protect the account, account emails | Firebase Authentication (Google) and our database (US) | While the account exists; on deletion sign-in stops at once, 30-day trash, then erased or anonymized except what the law requires | Google (Firebase), MongoDB Atlas, Microsoft 365 (emails) |
| Team and role | Team, your role (owner, manager, member…), who belongs to it | You or your team's owner | Decide who may send envelopes and who may manage keys and webhooks | Our database (US) | While the team exists | People of your team; MongoDB Atlas |
| Acceptance of terms | Terms version, time, IP address, browser | You, at sign-up | Prove what you accepted and when | Our database (US) | Not set yet (lawyer decision) | MongoDB Atlas |
| Documents | The PDF (up to 25 MB), page count, SHA-256 fingerprint; the source URL if sent by API | The sender (app or API) | Show the document and collect signatures | Private Google Cloud Storage bucket, us-central1 (Iowa, US) | While the sending team's account is active; period after closure not set yet | The signers of the envelope; Google Cloud |
| Envelope details | Title, number, message to signers, order, expiry, field map, options, the sender's reference, timeline of events | The sender; the system adds the timeline | Run the envelope | Our database (US) | Same as the document | The sending team; MongoDB Atlas; the sender's webhooks |
| Signer contact details | Name, email, mobile number, chosen channel, pre-filled field values | The sender | Invite and identify each signer | Our database (US) | Same as the document | The sending team; other signers see the name and status; Microsoft 365, Twilio or Meta to deliver the invitation |
| Invitation deliveries | Channel, destination, time, delivered or failed, provider message ID (last 20 per signer) | The system | Prove the invitation was sent; troubleshoot | Our database (US) | Same as the document | The sending team; MongoDB Atlas |
| Signing link secret | A random secret in the link — we keep only its SHA-256 fingerprint | The system | Let only the person with the link open it | Our database (US), as a fingerprint | Replaced by a reminder; stops with void or expiry | No one |
| Signing evidence | Time opened, time signed or declined, IP address, browser user agent, consent = yes, method (typed, drawn, voice), typed full name, drawn signature image, initials and initialed pages, field values, decline reason | The signer and the signer's browser | Prove that, how and when the signature was made | Our database (US) and the certificate page of the sealed PDF | Same as the document | The sending team; every party receives the certificate; the sender's webhooks (names, times, method) |
| Sealed PDF and certificate | Final PDF, certificate page, document and final SHA-256, seal SHA-256, RFC 3161 timestamp token | The system | Integrity, time and proof of the signatures | Google Cloud Storage (US) and the sending team's DOCZ | Same as the document | All parties of the envelope; FreeTSA receives only the seal fingerprint |
| Phone-call signature | Phone number, call times and status, live transcript of both sides, two-channel recording, transcript excerpt on the certificate | The signer and the system | Make and prove a voice signature | Transcript: our database (US). Recording: Twilio | With the envelope; period not set yet | The sending team; Twilio; Deepgram (speech-to-text and voice, model-improvement opt-out); Anthropic (Claude) and Google (Gemini, backup) receive the conversation text, names, title and the sender's message — never the PDF |
| Identity verification result (optional) | Verification number, level, time, summary (document type, selfie-to-ID match score, face engine result — not certified, sanctions-list check, approver) | socialDNA ID, when the sender requires it | Unlock signing; print the result on the certificate | Our database (US) and the certificate | Same as the document; ID images follow socialDNA ID's own notice | The sending team; every party through the certificate |
| API keys | Key name, first 12 characters, SHA-256 of the key, permissions, last use, number of uses | A team owner or manager | Let the team's systems use the API | Our database (US) | Until revoked; the revoked record stays for the audit trail | No one |
| Webhooks | Endpoint URL, events, signing secret, last 20 deliveries (event, status, time) | A team owner or manager | Notify the team's own systems | Our database (US) | Until removed | The team's endpoint receives envelope data |
| Billing and usage | Billing account, invoice email, a US$1 line per signature with envelope number, short title and signer name | The system, from each signature | Charge US$1 per signature; the team's statement | Our database (US) | As tax and accounting laws require | The team's owners and managers; Stripe for payments |
| Card payment | Card details typed on Stripe's page; Stripe returns a result and a reference | You, on Stripe's page | Pay | Stripe — we never receive the full card number | Stripe's own policy; our references follow billing | Stripe |
| Audit and security logs | Audit record of every change (who, what, when); server logs with IP address, time, request and errors | The system | Security, accountability, troubleshooting | Our database and Google Cloud logs (US) | Audit records stay with their item; server logs follow Google Cloud's retention | Google Cloud |
| Browser storage and fonts | Sign-in session (Firebase), language choice (sdna.lang cookie and local storage); fonts loaded from Google Fonts | Your browser | Keep you signed in; remember your language; show the pages | Your browser; Google Fonts sees your IP address | Session until you sign out; language cookie 1 year | Google (Firebase, Fonts) |
| Support requests | Your message, email, screenshots | You | Answer you | Our database (US) and email | While needed to answer and keep a record | Microsoft 365, MongoDB Atlas |
Sender account
Name, email, password (held by Firebase, never readable by us), company or team name
Firebase Authentication (Google) and our database (US)- Source
- You, at sign-up
- Purpose
- Sign in, protect the account, account emails
- Retention
- While the account exists; on deletion sign-in stops at once, 30-day trash, then erased or anonymized except what the law requires
- Shared with
- Google (Firebase), MongoDB Atlas, Microsoft 365 (emails)
Team and role
Team, your role (owner, manager, member…), who belongs to it
Our database (US)- Source
- You or your team's owner
- Purpose
- Decide who may send envelopes and who may manage keys and webhooks
- Retention
- While the team exists
- Shared with
- People of your team; MongoDB Atlas
Acceptance of terms
Terms version, time, IP address, browser
Our database (US)- Source
- You, at sign-up
- Purpose
- Prove what you accepted and when
- Retention
- Not set yet (lawyer decision)
- Shared with
- MongoDB Atlas
Documents
The PDF (up to 25 MB), page count, SHA-256 fingerprint; the source URL if sent by API
Private Google Cloud Storage bucket, us-central1 (Iowa, US)- Source
- The sender (app or API)
- Purpose
- Show the document and collect signatures
- Retention
- While the sending team's account is active; period after closure not set yet
- Shared with
- The signers of the envelope; Google Cloud
Envelope details
Title, number, message to signers, order, expiry, field map, options, the sender's reference, timeline of events
Our database (US)- Source
- The sender; the system adds the timeline
- Purpose
- Run the envelope
- Retention
- Same as the document
- Shared with
- The sending team; MongoDB Atlas; the sender's webhooks
Signer contact details
Name, email, mobile number, chosen channel, pre-filled field values
Our database (US)- Source
- The sender
- Purpose
- Invite and identify each signer
- Retention
- Same as the document
- Shared with
- The sending team; other signers see the name and status; Microsoft 365, Twilio or Meta to deliver the invitation
Invitation deliveries
Channel, destination, time, delivered or failed, provider message ID (last 20 per signer)
Our database (US)- Source
- The system
- Purpose
- Prove the invitation was sent; troubleshoot
- Retention
- Same as the document
- Shared with
- The sending team; MongoDB Atlas
Signing link secret
A random secret in the link — we keep only its SHA-256 fingerprint
Our database (US), as a fingerprint- Source
- The system
- Purpose
- Let only the person with the link open it
- Retention
- Replaced by a reminder; stops with void or expiry
- Shared with
- No one
Signing evidence
Time opened, time signed or declined, IP address, browser user agent, consent = yes, method (typed, drawn, voice), typed full name, drawn signature image, initials and initialed pages, field values, decline reason
Our database (US) and the certificate page of the sealed PDF- Source
- The signer and the signer's browser
- Purpose
- Prove that, how and when the signature was made
- Retention
- Same as the document
- Shared with
- The sending team; every party receives the certificate; the sender's webhooks (names, times, method)
Sealed PDF and certificate
Final PDF, certificate page, document and final SHA-256, seal SHA-256, RFC 3161 timestamp token
Google Cloud Storage (US) and the sending team's DOCZ- Source
- The system
- Purpose
- Integrity, time and proof of the signatures
- Retention
- Same as the document
- Shared with
- All parties of the envelope; FreeTSA receives only the seal fingerprint
Phone-call signature
Phone number, call times and status, live transcript of both sides, two-channel recording, transcript excerpt on the certificate
Transcript: our database (US). Recording: Twilio- Source
- The signer and the system
- Purpose
- Make and prove a voice signature
- Retention
- With the envelope; period not set yet
- Shared with
- The sending team; Twilio; Deepgram (speech-to-text and voice, model-improvement opt-out); Anthropic (Claude) and Google (Gemini, backup) receive the conversation text, names, title and the sender's message — never the PDF
Identity verification result (optional)
Verification number, level, time, summary (document type, selfie-to-ID match score, face engine result — not certified, sanctions-list check, approver)
Our database (US) and the certificate- Source
- socialDNA ID, when the sender requires it
- Purpose
- Unlock signing; print the result on the certificate
- Retention
- Same as the document; ID images follow socialDNA ID's own notice
- Shared with
- The sending team; every party through the certificate
API keys
Key name, first 12 characters, SHA-256 of the key, permissions, last use, number of uses
Our database (US)- Source
- A team owner or manager
- Purpose
- Let the team's systems use the API
- Retention
- Until revoked; the revoked record stays for the audit trail
- Shared with
- No one
Webhooks
Endpoint URL, events, signing secret, last 20 deliveries (event, status, time)
Our database (US)- Source
- A team owner or manager
- Purpose
- Notify the team's own systems
- Retention
- Until removed
- Shared with
- The team's endpoint receives envelope data
Billing and usage
Billing account, invoice email, a US$1 line per signature with envelope number, short title and signer name
Our database (US)- Source
- The system, from each signature
- Purpose
- Charge US$1 per signature; the team's statement
- Retention
- As tax and accounting laws require
- Shared with
- The team's owners and managers; Stripe for payments
Card payment
Card details typed on Stripe's page; Stripe returns a result and a reference
Stripe — we never receive the full card number- Source
- You, on Stripe's page
- Purpose
- Pay
- Retention
- Stripe's own policy; our references follow billing
- Shared with
- Stripe
Audit and security logs
Audit record of every change (who, what, when); server logs with IP address, time, request and errors
Our database and Google Cloud logs (US)- Source
- The system
- Purpose
- Security, accountability, troubleshooting
- Retention
- Audit records stay with their item; server logs follow Google Cloud's retention
- Shared with
- Google Cloud
Browser storage and fonts
Sign-in session (Firebase), language choice (
sdna.langcookie and local storage); fonts loaded from Google FontsYour browser; Google Fonts sees your IP address- Source
- Your browser
- Purpose
- Keep you signed in; remember your language; show the pages
- Retention
- Session until you sign out; language cookie 1 year
- Shared with
- Google (Firebase, Fonts)
Support requests
Your message, email, screenshots
Our database (US) and email- Source
- You
- Purpose
- Answer you
- Retention
- While needed to answer and keep a record
- Shared with
- Microsoft 365, MongoDB Atlas
3. Special topics
| Topic | Laws we designed for | What MyESign does |
|---|---|---|
| Electronic records consent | US ESIGN Act (15 U.S.C. 7001), UETA | Signers tick the consent (or say "I agree" on a call); the disclosure of their rights is in section 6 of the Terms |
| Recording of calls | US federal and state wiretap laws, all-party consent states, GDPR, LGPD | Every signing call says first that it is recorded; nothing is signed without "I agree" and the full name |
| Calls and texts with an AI voice | Telephone Consumer Protection Act and state laws | The sender must hold the signer's prior permission; texts need recorded consent and are not active yet; STOP is honoured |
| Identity verification | Biometric and privacy laws (handled by socialDNA ID) | Optional, by the sender; MyESign keeps only the result; the face engine is not certified |
| AI | AI transparency rules | The call assistant says it is an AI; documents never go to AI providers and are never used to train models |
4. Your choices and requests
- Signers: to decline, tap Decline to sign; for a paper copy, to withdraw consent or to change your contact details, contact the sender (Terms §6).
- Senders: download sealed PDFs from the app or the API; revoke API keys and remove webhooks in Developers.
- Delete a sender account: how to delete your account.
- Anything else: privacy@socialdna.app. Your rights and deadlines are in section 12 of the Privacy Policy.
Controller of account, billing, security and signing-evidence data: SocialDNA Systems LLC, Virginia, USA.