Privacy

SavvySign is designed with the UK GDPR in mind. For documents sent by a workspace, that organisation is the data controller. SavvySign stores the document and the audit trail for the organisation.

We store names, email addresses, signatures, the PDF, and audit events. An audit event can include the time in UTC and in Europe/London, the IP address, the browser or device, and the email address.

Documents are stored in London (eu-west-2). You can change the storage region with the server configuration. The default is London (eu-west-2).

Each workspace has a retention period. You can also delete a document. Deletion removes the file, fields, recipients and audit events. A short note is kept, with the title, reference, date and the email of the person who deleted it, and without the document itself.

People who only sign a document do not need an account. Their signing link is a long random value and it expires.

You can complain to the Information Commissioner's Office (ICO) at ico.org.uk.