Privacy policy
What eSignBoss collects, why, who it is shared with, and the choices you have. It covers account holders and the people who sign documents sent through eSignBoss.
Who is responsible
For account information, the company that operates eSignBoss decides how it is used. For documents and signer details, the team that sent the document decides; eSignBoss handles them on that team's behalf. If you signed a document and have a question about it, contact the sender first; we will help them answer.
What we collect
- Account details: name, email address, team name and market, and, if you turn it on, your two-step verification setting.
- Documents: the files you upload, the fields you place, and what signers enter, including their signatures.
- Signer details: name, and the email address or phone number the sender gives us.
- Evidence of signing: for each step (opening, agreeing to sign electronically, signing, declining) the time, IP address, device and browser type, and the signer's time zone. This audit trail is what makes a signature reliable as evidence.
- Billing: your plan, balance and payment history. Card and bank details go straight to Stripe or Paystack; we never receive them.
- Technical: server logs kept for security and fault finding, for a limited time.
Why we use it
- to run eSignBoss: deliver links and reminders, collect signatures, seal and send signed copies;
- to keep legal evidence of who signed what, and when;
- to keep accounts secure and prevent abuse;
- to bill for what you use;
- to meet legal duties, such as tax and record keeping.
We do not sell personal information, show advertising, or use documents to train AI models.
Who we share it with
Only service providers that help run eSignBoss, under contracts that protect the data:
- DigitalOcean: servers and file storage;
- the email service that delivers our emails;
- SMS providers (such as BulkSMSNigeria, Termii and Twilio) and WhatsApp (Meta), for messages sent on those channels;
- Stripe and Paystack, for payments.
We also share information when the law requires it, for example a valid court order. Some providers process data outside your country; where that happens we rely on their contractual safeguards.
How long we keep it
- Signed documents and their audit trails are legal records: kept while the sender's account is open, and afterwards for as long as the law requires.
- Sign-in codes expire after 10 minutes. Sign-in sessions expire after a set time, or when you sign out.
- Account details are deleted when an account is closed, except what we must keep by law.
Security
Data travels over encrypted connections. Sign-in sessions are stored only as fingerprints (hashes). Signing links are stored as a fingerprint plus an encrypted copy, so the sender can send a link again. Every signed copy carries a digital seal, so any change to it can be detected.
Cookies
eSignBoss sets one cookie to keep you signed in. There are no advertising or tracking cookies.
Your rights
Depending on where you live (for example under Nigeria's Data Protection Act 2023 or Canada's PIPEDA), you can ask to see, correct or delete your information, object to some uses, or complain to your data protection regulator. Information inside signed documents may have to be kept as a legal record even after a request to delete it. Write to privacy@esignboss.com; we answer within 30 days.
Children
eSignBoss is not meant for people under 18.
Changes
We update this policy when what we do changes, and tell account owners by email about important changes.