Privacy Policy | SignFortress
SignFortress

Privacy Policy

Secure. Transparent. Respected.

Effective: October 13, 2026

Back to Home Privacy Policy
Important Security Notice

SignFortress will never send unsolicited emails or messages asking you to verify your account, provide login details, update billing information, reset passwords, or click on links to access your documents.

If you receive any such communication claiming to be from SignFortress, treat it as fraudulent and do not click any links or provide any information. Always access your account directly at signfortress.com or contact us through official channels.

1. Introduction

Welcome to SignFortress, a service operated by Signfortress Digital Inc. ("SignFortress," "we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website signfortress.com, use our applications, or use our services, including electronic signatures, secure client portals, document management, and optional AI studios (collectively, the "Service"). We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the Personal Information Protection Act (PIPA) of British Columbia, Canada, and other relevant regulations.

By using the Service, you consent to the practices described in this Policy. If you do not agree, please do not use the Service. We may update this Policy from time to time; changes will be posted here with the updated effective date.

2. Information We Collect

We collect information necessary to provide and improve the Service, including:

  • Account Information: Name, email address, phone number, company name, and billing details when you register or update your profile.
  • Document & Signature Data: Uploaded documents, electronic signatures, signer details (names, emails), timestamps, IP addresses, and related metadata.
  • Study and AI workspace content: Notes and files you upload or paste into Study Studio (and similar AI studios), extracted text, generated study artifacts (summaries, flashcards, schedules, quizzes, concepts), and related usage metadata needed to run and bill those features.
  • Public marketing-site engagement: On public pages (including Solo Arena demos, sample AI quizzes, and the public help assistant), we may record event type, approximate time, optional topic text you submit, guest or plan status when known, IP address, a one-way hash of the IP, approximate location derived from IP (country and, when available, city or region), and browser user-agent. This supports security, abuse prevention, product understanding, and lawful requests. It is available only to authorized administrators.
  • Usage Data: How you interact with the Service (pages visited, features used, device type, browser, IP address).
  • Cookies & Similar Technologies: Used for functionality, analytics, and security. You can manage preferences via your browser or our cookie banner.
  • Communication Data: Messages sent through support or in-app features.
  • YouTube / Google Connection Data: When you connect a YouTube channel we store the OAuth access token, refresh token, token expiration time, YouTube channel ID, and channel title associated with your account.

We do not intentionally collect sensitive personal information unless explicitly required for a feature and with your consent.

2.1 Signer Photo (Identity Confirmation)

When a sender requests identity confirmation, you may be asked to capture or upload a photo. This photo is encrypted on your device before it is transmitted using modern cryptographic standards. SignFortress cannot view, access, or decrypt your photo at any time. Only the sender who initiated the request can access the decrypted image. Retention and deletion of the photo are determined solely by the sender.

2.2 YouTube / Google Integration

If you choose to connect your YouTube channel, we use Google OAuth 2.0. The scopes we request are:

  • https://www.googleapis.com/auth/youtube.upload - to upload videos on your behalf
  • https://www.googleapis.com/auth/youtube.readonly - to read basic channel information
  • https://www.googleapis.com/auth/youtube - for related YouTube Data API operations required by the upload flow

We store only the following data:

  • Access token and refresh token
  • Token expiration timestamp
  • YouTube channel ID and channel title

These tokens are used solely to verify the connection, refresh the access token when needed, and upload videos that you explicitly request to be published to your channel. We do not store permanent copies of the videos. A temporary file is created only for the duration of the upload and is deleted immediately afterward.

You may disconnect your YouTube channel at any time from the Video Studio interface. Disconnecting deletes the stored tokens. You can also revoke access at any time via your Google Account permissions page. Your use of YouTube is subject to Google's Privacy Policy and YouTube Terms of Service.

2.3 AI features and local processing

SignFortress offers optional AI-assisted features under your plan and available credits. We process prompts, uploads, and outputs as needed to deliver the feature you request, enforce safety and abuse limits, operate quotas and billing, and maintain security.

We do not use your private content to train foundation AI models, unless a separate written agreement expressly says otherwise. We do not publish internal system design, model inventories, or capacity details; those are operational secrets and are not required for you to use the Service.

Additional rules for acceptable use of AI features are described in our AI Use & Safety page, which should be read together with this Policy and the Terms of Service.

3. How We Use Your Information

We use your information to:

  • Provide, operate, and maintain the Service (e.g., process signatures, send notifications, generate audit trails).
  • Process User Content you submit to AI features under the license described in our Terms of Service: extract text, index content, generate requested materials, answer questions from your notes, store plans in your account, and operate billing and security controls.
  • Manage subscriptions, process payments, and send receipts.
  • Communicate with you (e.g., signature requests, reminders, support responses; marketing opt-out available).
  • Improve the Service through usage analysis and product development.
  • Ensure security, prevent fraud, detect abuse of public demos and AI features, and comply with legal obligations.
  • Operate public engagement logging described in Section 2 (marketing-site Arena, demos, and help assistant).

4. Data Sharing and Disclosure

We do not sell your personal data. We share information only when necessary:

  • AI processing infrastructure: Relevant excerpts of User Content may be processed by our AI engines and hosting providers solely to fulfill your request. We do not sell your study notes.
  • Service Providers: With trusted partners (e.g., hosting, payment processors, email delivery) under strict confidentiality agreements.
  • Cloud Storage (Pro & Premium): When you choose to store documents in your personal Microsoft OneDrive, Google Drive, or Dropbox account, files are uploaded directly to your account. These providers act under their own privacy policies and security controls. We only interact transiently to upload content and do not retain copies.
  • YouTube (via Google): When you connect a YouTube channel and request an upload, we transmit the video file and the metadata you provide (title, description, tags, privacy setting, category) to YouTube using the OAuth tokens you authorized. Google/YouTube process this data under their own privacy policy. We do not sell or share the tokens with any other party.
  • Legal Requirements: To comply with law, respond to legal requests, or protect rights and safety.
  • Business Transfers: In the event of merger, acquisition, or sale of assets.

5. Data Security

We implement multiple layers of technical and organizational safeguards to protect your information. These include encryption, access controls, monitoring, and secure development practices. Key protections include:

5.0 Study uploads and permission to process

When you upload or paste materials into Study Studio, you instruct us to process that content to provide the feature. Processing may include text extraction, indexing, retrieval, and generation of study aids. Details of the license you grant are in the Terms of Service. You should only submit content you are allowed to process.

5.1 End to End Encryption (E2EE)

Certain features of the Service, including secure portal messaging, group chat, and all related file attachments, use true end to end encryption. With E2EE:

  • Messages and attachments are encrypted on the sender's device before transmission using modern cryptographic standards such as AES GCM.
  • Only the intended recipients' devices hold the cryptographic keys required to decrypt the content.
  • We cannot view, access, or decrypt E2EE protected content stored on our servers.
  • Encrypted data is stored only in ciphertext form while at rest.
  • Decryption occurs solely within the user's browser or device. Keys are never transmitted to or stored by Signfortress.

5.2 Encryption at Rest

All documents and data stored on our infrastructure are encrypted at rest. This includes:

  • E2EE content: Portal chat messages, group chat messages, and all associated attachments are stored exactly as encrypted binary data generated on the user's device. We do not possess the keys required to decrypt this content.
  • Server processed documents: Documents used in signing workflows, including uploaded PDFs, generated audit files, and final signed documents, are encrypted server side using AES 256 CBC with a unique per file key.
  • Key protection: Server side encryption keys are themselves encrypted using a site level secret and are accessible only through tightly controlled security mechanisms.

5.3 Temporary File Handling

Files used for signing workflows or validation are processed in memory and automatically purged shortly after completion. Only documents you explicitly save remain stored.

5.4 Signer Photo Encryption & Access Control

Signer photos captured during identity confirmation follow the same end-to-end encryption principles described in Section 5.1. Specifically, the photo is encrypted on the signer’s device before transmission, and SignFortress does not possess the keys required to decrypt it. The encrypted file is stored only in ciphertext form and is accessible exclusively to the sender who initiated the request. SignFortress cannot determine how long the sender retains the photo; retention is governed entirely by the sender’s own data management practices. If the sender deletes the photo, the encrypted file is permanently removed from our systems.

5.5 Cloud Storage (Pro & Premium Plans)

When you choose to store documents in your personal Microsoft OneDrive, Google Drive, or Dropbox account, files are uploaded directly to your account and removed from our servers immediately after processing. You retain full control and may revoke access at any time.

5.6 Study Studio and AI note processing

When you use Study Studio, files or pasted text are processed to extract readable content. Text may be chunked and indexed so the service can retrieve relevant passages for generation and tutoring. Generated materials (for example summaries and flashcards) are stored with your account so you can reopen a plan later. Study Studio chat is designed to answer from your indexed notes rather than from general web knowledge. Do not upload material you are not allowed to process. You remain responsible for the lawfulness of content you submit.

While we strive to maintain a high level of security, no system is completely immune to risk. In the event of a security incident, we will notify affected users as required by applicable law.

6. Data Retention and Deletion

We retain data only as necessary:

  • Account Data: Retained while your account is active; deleted within 30 days of closure request.
  • Documents: Free plan: 90 days post-expiration; Pro/Enterprise: indefinite unless deleted by you.
  • Study plans and note indexes: Retained while your account remains active and the plan is not deleted, subject to product limits and legal holds. You may request deletion of account data as described in this Policy.
  • Usage Logs: 12 months for security; anonymized thereafter.
  • Backup Data: Retained up to 90 days in encrypted backups.
  • YouTube OAuth Tokens & Channel Metadata: Retained only while the YouTube connection remains active. Deleted immediately when you disconnect the channel or when your account is closed.

You can request deletion at any time through Contact (or other official channels we publish). We will comply within legal timelines (e.g., 45 days under CCPA).

6.1 Signer Photo Retention

Signer photos are encrypted end-to-end and accessible only to the sender. SignFortress does not control or determine the retention duration for these files and cannot delete them on your behalf. To request deletion of your photo, please contact the sender directly. When the sender deletes the photo, the encrypted file is permanently removed from our systems.

7. Your Privacy Rights

Depending on your location, you have rights under GDPR, CCPA, PIPA (British Columbia, Canada), and similar laws:

  • Access: Request a copy of your data.
  • Rectification: Correct inaccurate information.
  • Erasure ("Right to be Forgotten"): Delete your data (subject to legal holds).
  • Restriction/Objection: Limit processing or object to certain uses (e.g., marketing).
  • Portability: Receive data in a structured format.
  • Withdraw Consent: For consent-based processing.
  • Non-Discrimination: No retaliation for exercising rights (CCPA).
  • Under PIPA (BC, Canada): Access, correction, and withdrawal of consent; contact us for details.

To exercise rights, contact us via Contact and include enough information for us to verify your request. We will respond within 30 days (or 45 for complex requests). Appeals may be submitted through the same channel.

8. International Data Transfers

SignFortress primarily processes data in Canada via secure Canada-based data centers. When personal data is transferred internationally (for example from the EU/UK/Switzerland, or in connection with service providers), we rely on appropriate safeguards under applicable law, which may include:

  • Standard Contractual Clauses (SCCs) approved by the European Commission, where required;
  • Adequacy decisions where applicable; and
  • Contractual and technical measures with processors that process data on our behalf.

You can request more detail on transfer mechanisms via our privacy contact.

9. Children's Privacy

The Service is not directed to individuals under 13 (or 16 in some jurisdictions, including higher ages under certain Canadian provincial laws like BC's PIPA). We do not knowingly collect personal data from children. If we discover such data, we will delete it promptly. Parents/guardians can contact us to review or remove child data. For verification, provide proof of guardianship.

10. Cookies and Tracking

We use cookies for essential functions (e.g., authentication) and optional analytics/marketing. You can manage preferences via browser settings or our cookie banner. For detailed info, see our Cookie Policy.

11. Changes to This Privacy Policy

We may update this Policy to reflect changes in our practices or laws. Material updates will be notified via email (for registered users), in-app notifications, or prominent website posting at least 30 days in advance. Continued use after changes constitutes acceptance.

12. Contact Us

For questions, rights requests, or concerns about this Privacy Policy, contact Signfortress Digital Inc. via Support.

Scroll to Top
Scroll to Top