Privacy policy

Sovrasign Privacy Policy. Version pp-1, effective 10 November 2026.

Key points (a summary to help you read; the sections below are the policy):

• We do not sell your personal information, and we do not use it for advertising.
• Your documents are yours. We process them only to run the service for the person who sent them. We never use them to train AI models, and support (people or AI) never sees them.
• If someone sent you a document to sign, that sender decides what happens to it. Your name, your email address and how you confirmed who you are are sealed into the signed PDF, which every party keeps.
• We use only the cookies the service needs to work. No advertising or tracking cookies.
• Today we store data in the United States. Sovrasign is a US company.
• You can see, download, correct and delete your data. Write to privacy@sovrasign.com.

A1. Who we are and what this policy covers

A1.1 Who we are. Sovrasign LLC, a Washington limited liability company ("Sovrasign", "we", "us"), runs the Sovrasign service: the web app, the signing page, the desktop and mobile apps, our websites and our support. Contact details are in section A16.

A1.2 Two roles. For some personal data we decide why and how it is used: we are its controller. For other data we only follow a customer's instructions: we are a processor (in US state laws, a "service provider").

A1.3 Whom it covers. This policy is for:

• account holders: people who sign up for Sovrasign, on any plan (section A3);
• recipients: people who receive a document to sign, approve or keep a copy of (section A4);
• visitors and contacts: people who use our websites or help center, chat with our support assistant, write to us or join the waiting list (section A5).

A1.4 What it does not cover. When a customer sends you a document, the customer decides what happens to the document and to your data in it; their own privacy notice applies, and we act on their behalf (section A4.1). Google, Microsoft and Apple handle your sign-in with them under their own privacy policies. Stripe handles card payments under its own policy (section A9.3). Other websites we link to have their own policies.

A2. Personal data in signed documents

Read this section even if you read nothing else.

A2.1 What a signed document contains. When you sign, the signed PDF records who signed and how they confirmed who they are: your name, your email address, the account or method you used to confirm it (for example "Google" or "email code"), the token that account provider or our email-code service issued (it contains your email address and the provider's identifier for your account, and may contain the name you have with that provider), the time, and which version of the e-sign disclosure you accepted. If the sender added an extra check, the PDF records its result (for example, for a phone code, a fingerprint of your number and its last two digits, never the number itself). The separate certificate of completion also lists the IP address and device used for each step.

A2.2 Why it stays. This is what makes the document prove itself, years later, without us. It is sealed with the signatures: removing it would break them.

A2.3 It travels with the document. Every party receives the signed PDF and can share it. We cannot recall copies that have been delivered, and deleting your account or the envelope in our service does not remove your data from those copies.

A3. If you have an account

A3.1 Account and sign-in. When you sign up and sign in, we process:

• your name and email address, and the region and language you choose;
• the sign-in methods you link: which provider (Google, Microsoft or Apple), the provider's identifier for your account, the email address it confirms and, for Microsoft work accounts, the identifier of your organization's directory. We never receive or keep a password: the service has none;
• passkeys you add: only the public part of the key and details about it (its name, when it was added and last used); the private key stays on your device;
• one-time sign-in codes we email you, kept only as a fingerprint until they expire;
• your sessions: a short device label (for example "Chrome on Windows", made from what your browser sends; we do not keep the full browser string), when you signed in, how, and when the session was last used, so you can see and sign out your devices;
• the browsers and apps you sign in from: a fingerprint of a random code our cookie keeps in your browser (section A13), or the app's device label, with when each was last used, so we can email you when someone signs in from one your account has not used before. We forget one after 400 days without use;
• your confirmation that you are an adult, and which version of our terms and data processing agreement you accepted, with the time, IP address and browser.

We use this to create and run your account and keep it secure (contract; for security, our legitimate interests).

A3.2 Your organization. If you belong to an organization's account, its owner and admins see your name, email address, role, the sign-in methods you use and your activity in that account, as the plan allows.

A3.3 What you put into the service. Documents, recipients, messages, templates, contacts and everything else you add are processed for you, as your processor (section A1.2), under the data processing agreement, which is part of our terms on every plan, Free included. We use it only to provide the service to you: to store it, send it, collect signatures, verify them, and deliver the results. We do not read it or use it for our own purposes, except the safety checks of section A6 (automatic malware and link checks, and review by a person only in the cases of A6.4). We never use it to train AI models.

A3.4 Billing. On paid plans and packs, Stripe collects your card or other payment details; we never see full card numbers. We receive and keep your name or company name, billing address, country, tax or VAT number, the payment method type and its last four digits, your plan and purchases, invoices, refunds and payment status. We use them to charge you, keep tax and accounting records, handle refunds and disputes, and prevent payment fraud (contract; legal obligation for tax records). We also check paying customers' names and countries against sanctions lists (section A6.3).

A3.5 How you use the service. To run and improve the service we record events such as "an envelope was sent" or "a plan limit was reached" with counts and codes, never document content, titles, names or other text. Each event carries a coded identifier for your account and organization (a keyed hash), not your name or email. Raw events are kept 13 months and totals per account 25 months; after that only anonymous totals remain (our legitimate interests). Events from your device that the service does not need to work, such as which screens you open in the editor, are collected only if you opt in, in every country. Crash reports and performance timings the apps need to deliver the service are on by default, cleaned of personal data on your device before they are sent, and you can turn them off in settings.

A3.6 Emails we send you.

Getting-started and news emails count which of their links were clicked, by type of email; they do not track whether you opened them. Service emails, including every invitation and completed copy, contain no tracking. We never send marketing to recipients of documents (section A4.8).

A3.7 The Free allowance and deleted accounts. Free gives 3 envelopes for the life of an account, tied to the person, not to the account. To stop the allowance being reset by deleting an account and signing up again:

• we link accounts that clearly belong to the same person, by sign-in provider identifiers first, then normalized email addresses, payment card fingerprints and device and network signals; linked accounts share one allowance (our legitimate interest in preventing misuse of a free offer);
• when you delete an account, we keep a coded fingerprint of your sign-in identity for 24 months: a keyed hash of your sign-in provider's identifier and your email address, and the number of free envelopes used. It is not readable and contains no other data. We use it only to continue your free count if you sign up again; never to refuse a sign-up, for marketing, or to share. The keys are made per month and destroyed after 24 months, after which those fingerprints can no longer be matched (our legitimate interest in preventing misuse of a free offer; you may object, see A12.1).

A3.8 Closing your account. You can close your account in its settings. You have 14 days to undo; then your account data is deleted and the encryption keys of your documents are destroyed, so the copies of your documents in our backups become unreadable at once. Backups themselves, with everything else in them, expire within 35 days. A deletion receipt lists what was deleted and what we keep and why (section A11).

A4. If someone sent you a document

A4.1 The sender is in charge. When a customer of Sovrasign sends you a document, that customer (the "sender") is the controller of your personal data in the envelope, and we process it on their behalf. For questions about the document, or to exercise your rights over it, contact the sender: their name and verified email address are on the invitation and the signing page. If you write to us instead, we forward your request to the sender within 5 business days and help them answer it. The sender's own privacy notice, when they provide one, is linked on the signing page.

A4.2 What we process for the sender. Your name and email address as the sender entered them; the documents and anything you fill in, attach or sign (including your signature image); your messages to the sender ("Ask a question", "I need help to sign", a reason for declining); the envelope's activity log (delivered, opened, consented, signed, declined, with the time, IP address, browser and device, and an approximate location derived from the IP address, never GPS); and the record of your consent to electronic records (the disclosure version and its fingerprint, the time, IP address, browser and language). If you tell the sender you need help to sign, share only what the sender needs to know.

A4.3 Confirming who you are. To sign, you confirm your identity with Google, Microsoft or Apple, or with a one-time code we email to the invited address. When you choose a provider, you sign in with them under their privacy policy, and they send us a token confirming your email address; we check it and seal it into the document (section A2). We give the provider your email address as a hint only after you tap their button. We never ask a provider whether an account exists for an address.

A4.4 Choosing the first sign-in button. We check the mail host of your address's domain (for example, whether example.com receives its mail at Microsoft or Google) to choose the first sign-in button we offer you. We look up the domain only, never your full address, and we store the result ("probably Microsoft") on your recipient record for the sender. The other ways to sign in are always offered.

A4.5 Remembering how you signed. If you sign more than once for the same sender, the sender's contact record remembers which provider you used last (the provider's name and a keyed hash of its identifier for your account), so that button comes first next time. This memory is kept per sender: another sender never learns how you signed for this one, and there is no memory across all of Sovrasign. The sender sees, as information, that you signed with a different account than last time. Separately, if you tick "Remember my choice on this device" (off by default), we keep an item in your browser's local storage with the provider you used and a coded version of your email address, for 12 months, so the same button comes first on this device. It never reaches our servers and holds no readable email address or token. "Forget this device" on the signing page removes it (section A13, cookie notice).

A4.6 The email-code service. When you confirm your identity with an email code, Sovrasign's own identity service issues the token, and for that service we are the controller (our legitimate interest in providing verifiable identity evidence and defending it). Codes are stored only as fingerprints and deleted when they expire. We keep a log of the tokens we issued, as fingerprints and the domain of the address, with no name or full address in clear, for 10 years as evidence in case a signature is disputed.

A4.7 Your copy. You get the completed PDF by email when everyone has signed, and you can download what you signed. The PDF verifies on its own with our open-source verifier, which runs in your browser or app: when you verify a document there, it is not uploaded to us.

A4.8 No marketing. We never send marketing or newsletters to recipients because they received a document. We use your address only to deliver and sign the document, confirm your identity and protect the service, as A4 and A6 describe. After you sign, the signing page may offer you a free account; nothing happens unless you accept. If you accept, the account is made with the sign-in you just used to confirm who you are, and the documents you signed with that sign-in, for any sender, are listed in it for as long as each sender keeps them. We do not tell the sender that you created an account.

A4.9 Your rights and questions. Your rights over the envelope go to the sender (A4.1). For the data we hold as controller (the email-code records of A4.6, the device storage item of A4.5, safety reports you send us), contact us directly (section A12).

A5. Our websites, support and contacting us

A5.1 Websites and help center. Our marketing site and help center set no cookies and load no third-party scripts. We count page views from our web servers' logs (address requested, time, referring page, browser type, IP address); these logs are kept 30 days, and up to 1 year where needed to investigate attacks (our legitimate interests). We do not build profiles of visitors.

A5.2 The AI support assistant. In the app, the help center and the signer help pages, an AI assistant answers questions. During the private beta it is not in use yet: a person answers support by email. It tells you it is an AI before you start, and labels its messages.

• What it processes: what you type; for signed-in account holders, account details and diagnostics it looks up with read-only tools (plan, limits, envelope ids and status, delivery status, error codes); for recipients, the status of the envelope they hold a link to. Its tools cannot retrieve document contents, titles, field values or messages; it does see what you type, so do not paste document contents into the chat. It cannot change anything without your click. Recipient names and envelope titles are shown on your screen but replaced by codes before anything reaches the model. Please do not paste document text or other people's data into the chat. Where our app can detect them, email addresses, phone numbers and card or bank numbers in your message are masked before the model sees them.
• Which model and where: Claude models made by Anthropic, accessed through Microsoft Foundry and run on Anthropic's infrastructure; Microsoft and Anthropic both process the conversations for us. Every conversation from an account in the EU, EEA, UK or Switzerland is processed in Microsoft's United States Data Zone, never routed elsewhere. Other conversations use the United States Data Zone where the model offers it, and otherwise Microsoft's global deployment, which may process them in any region where Microsoft runs the model; the subprocessor list says which applies today. Both Microsoft and Anthropic process the conversations for us. Transfers to Microsoft rely on its certification under the EU–US Data Privacy Framework (and its UK and Swiss parts); Anthropic is not certified, so transfers to it rely on the European Commission's standard contractual clauses, with our assessment of the transfer (section A10).
• Retention: conversations are kept 90 days, and you can delete one at any time. A conversation attached to a support case is kept for the life of the case plus 2 years. The model providers do not use them to train models. We log every AI action (which tool, when, for whom), without the text, for 13 months.
• Why: to help you use the service (contract) or to answer your question (our legitimate interests).
• People, not AI, handle: privacy requests, reports of illegal content and appeals, consumer rights and billing disputes, security reports, account recovery, accessibility needs the assistant cannot meet, and requests from authorities. The assistant sends you to them as soon as it recognizes the topic, and the contact page lists them.

A5.3 Writing to us. When you write to our privacy, legal, security, abuse or support addresses or forms, we use what you send to answer and to keep a record of the request (section A11 lists how long).

A5.4 The waiting list. Before sign-ups open, and later when Free sign-ups are full for the day, you can join a waiting list on our website. We keep only your email address, your language, the date you joined and, later, the date we invited you. We send invitations in order of arrival and delete the entry 90 days after the invitation, or earlier if you ask (steps you asked us to take before a contract). We use it for nothing else: no newsletter, no marketing and no sharing. Our hosting provider stores it and our email provider sends the invitation, as our processors (A9.1).

A6. Security, abuse prevention and the law

A6.1 Security. We log sign-ins, administrative actions and security events with full IP addresses, kept 3 years in total: 1 year searchable, then 2 years archived. We use them to protect accounts and investigate attacks. Ordinary application logs are kept 30 days and never contain names, document titles or content; email addresses appear in them only in coded form, and IP addresses are shortened. We use a computing challenge from our own website to stop automated sign-ups, not a third-party CAPTCHA. (Our legitimate interests.)

A6.2 Safe sending. E-signature emails are a common phishing lure, so we protect recipients and our senders' reputation: we scan every upload for malware, limit how many new recipients a new account can reach, check links in documents and messages against our own lists and checks (during the private beta no outside link-checking service is used; if we add one, it receives the links only, never the document or message, and is listed as a subprocessor first), and give each sender a risk score from signals such as account age, payment, how they signed in, sending patterns, bounces and reports. A first send that looks risky may be held for review by a person; it is never refused by a machine alone (section A15). (Our legitimate interests in preventing fraud and abuse.)

A6.3 Sanctions. As a US company we must follow US sanctions law. We do not offer the service in comprehensively sanctioned places, nor in Russia or Belarus, and we check paying customers' names, organization names and countries against sanctions lists. To do this we use the country of your IP address, billing address and card. Screening results are kept 10 years. (Legal obligation where EU or UK law requires it; otherwise our legitimate interest in complying with the sanctions laws that bind us.)

A6.4 When a person may look at an envelope. Our staff may open an envelope's contents in three cases only: to review an envelope held or reported as phishing, fraud or illegal content; when a court order or other binding legal process requires it; or when a security incident cannot be handled otherwise. It follows a written procedure: two people approve it or, while the founder runs the service alone, access waits 24 hours and is reported to an independent mailbox reviewed monthly. Every access is logged, and we tell the customer unless the law forbids it. Support, human or AI, never sees document contents, even with the customer's approval. Envelopes encrypted on the sender's device, when offered, cannot be opened by us at all.

A6.5 Requests from authorities. We disclose data only on valid legal process, the narrowest data that answers it, and we tell the customer unless the law forbids it. US legal process can reach data a US company holds, including data stored outside the United States; we challenge requests that conflict with the law where we can.

A6.6 Evidence we keep after deletion. After an envelope is deleted, we keep a record with no names, email addresses or content (the envelope id, the document's fingerprint, dates and the internal id of the person who deleted it; these can still be personal data) for 10 years, so we can confirm whether a file was completed through Sovrasign (our legitimate interest in the integrity of signed documents).

A6.7 Abuse and fraud signals across customers. Some signals that one customer's sending produces also protect every other customer and their recipients, so we use them across customers. For these signals we decide the purpose and act as controller, within the security permissions in our DPA; you can contact us about them and use the rights in A12. They are kept in coded or minimal form, used only to detect and stop phishing, fraud and other abuse, and never hold the contents of documents, the values typed into fields, messages or names:

• Link verdicts: the fingerprint (a hash) and the host name of a web address found in a document or a message, and whether it was found safe, suspicious or malicious; never the full address or where it was found. Kept 1 hour to 7 days.
• Recipient overlap: a fingerprint of each address a customer sends to, so that we notice when several new accounts send to the same people, a pattern of phishing campaigns. No customer sees another customer's recipients. Kept 90 days after the customer last sent to that address; an address not sent to for 90 days counts as new again.
• Addresses that bounced or marked our email as spam: a fingerprint of the address and its domain, so that we stop sending to it whoever the sender is. A hard bounce is reviewed after 12 months and lifted, so that the next email tests the address again (a new bounce stops it again). A spam complaint is kept for as long as the address is on file, until the address's owner asks us to lift it and confirms the address works.
• Request limits by IP address: counters of requests from one IP address, whichever account they come from, kept in memory for at most an hour.

What we learn about one account (its risk score, reports on its envelopes, trust and safety decisions, A6.2) stays with that account; other customers do not see it. We do not use these signals for marketing, for advertising or for product statistics. (Our legitimate interests in security and in preventing fraud and abuse against every customer and recipient.)

Future learning features, such as learning from corrections to AI field placement or benchmarks across customers, are not built; they will only ever be opt-in and anonymous. This is separate from the usage statistics and internal analysis in A3.5 and A7, which already run under the choices and legal bases stated there.

A7. AI and your data

• We never use documents, messages or support conversations to train or improve AI models, and our model providers do not either.
• At launch the service runs AI only on account information and support conversations (A5.2), and for our own operations on statistics that contain no names, email addresses or content. AI features that work on documents will come later, with their own notice and controls before they are switched on.
• Ask, our internal analytics assistant, sends no personal data to the AI model. Our staff use it to ask questions about how the service is used ("how many packs were bought last month, by region?"). It drafts a query, which a person checks before it runs, over the usage statistics of section A3.5, which hold no names, email addresses, document titles, content or other free text. The model receives only the question, the definitions of those statistics and, when asked to explain a result, at most 200 rows of anonymous totals; results by coded account stay with the person who asked. It runs on the same Claude models on Microsoft Foundry as the support assistant.
• Every AI action is recorded in an AI action log, and the strictest rules we follow anywhere, including the EU's, apply to everyone.

A8. Why we use your data: legal bases

For people in the EU, EEA, UK and Switzerland, the laws require a legal basis for each use. For data we process for a customer (A1.2, A4.1), the customer decides the basis.

Where we rely on legitimate interests, we have recorded the balancing test, and you can ask us for it.

A9. Who receives your data

A9.1 Our subprocessors and service providers host the service, send email, process payments, run the support assistant and stamp times, under contracts that limit them to our instructions. Our subprocessor list names each one, what it does, the data it receives and where. We give customers 30 days' notice before adding one.

A9.2 Other people on a document. Signing is shared by nature: the sender and the other recipients of an envelope see your name, email address, status and, in the signed PDF and the certificate of completion, the evidence described in section A2.

A9.3 Sign-in providers and Stripe. When you sign in or confirm your identity with Google, Microsoft or Apple, they process that sign-in as independent controllers. Stripe processes payments for us and, for its own fraud prevention and legal duties, as an independent controller under its own privacy policy.

A9.4 Timestamp authorities. We get trusted timestamps for signed documents from outside authorities. They receive only a fingerprint (hash) of the document, never the document itself or its contents. A fingerprint can still be personal data when someone can link it to a person.

A9.5 Advisers, authorities, and a change of owner. Our lawyers, accountants, auditors and insurers, under confidentiality, as needed; authorities under section A6.5; and a buyer or successor if Sovrasign is sold or merged, which must keep the promises in this policy, with notice to you first.

A9.6 Nothing else. We do not sell personal information or share it for cross-context behavioral advertising, and we never have.

A10. Where your data is stored and international transfers

A10.1 Regions. Sovrasign stores each account's data in one region, chosen at sign-up. Today we offer the United States (Microsoft Azure, East US 2, with backups in Central US). An EU region (Sweden Central, with backups in Germany West Central and Sweden South, all in the EU) will open later; when it does, new accounts can choose it, and existing accounts can ask us to move. A small directory that routes sign-ins to the right region holds only a keyed hash of each email address and the region; billing records are kept with it. Today both are in the United States.

A10.2 Transfers. Sovrasign is a US company. If you are in the EU, EEA, UK or Switzerland, your data is processed in the United States today, our team may access it from the United States, and some of our subprocessors are US companies. We protect these transfers with:

• the EU–US Data Privacy Framework, its UK Extension and the Swiss–US Data Privacy Framework, for recipients certified under them (Sovrasign itself is not certified yet, so transfers to us rely on the clauses below);
• the European Commission's standard contractual clauses, with the UK addendum and the Swiss adjustments, and an assessment of each transfer, where a recipient is not certified (for example, Anthropic for the support assistant, A5.2);
• the same safeguards in every case: encryption, the least data needed, no access without a reason, and the redress mechanisms of US Executive Order 14086.

You can ask us for a copy of the safeguards that apply (section A16).

A10.3 Email leaves our region by nature. An email we send for you goes to the recipient's mail servers, wherever they are.

A11. How long we keep data

A legal hold, or a law that requires us to keep a record, comes before deletion; we tell you which applies when it affects your request.

A12. Your rights

A12.1 Everyone. Whatever the law where you live, you can ask us to:

• tell you what personal data we hold about you and give you a copy, in a format you can reuse (account holders can export everything themselves at any time, free);
• correct it;
• delete it (account holders can close their account themselves, A3.8);
• stop or limit a use of it, or object to a use based on our legitimate interests;
• withdraw a consent you gave, at any time, without affecting what we did before.

Some data cannot be changed: what is sealed into signed documents (A2) cannot be edited without breaking the signatures, and we cannot recall copies others hold, but we can delete our copy or record a correction beside it. We keep records the law makes us keep and what we need to establish or defend legal claims, and we explain which rule applies when we refuse a request. We tell you when that applies. Recipients: see A4.1 and A4.9.

A12.2 How to ask. Write to privacy@sovrasign.com (there is no separate form yet). A person handles every request. Before we disclose or delete anything we confirm it is you, usually by a sign-in or a code sent to your address. You may use an authorized agent where your law allows; we then ask for proof of the authorization. We answer within one month (EU, EEA, UK and Swiss law; extendable by two months for complex requests, with notice) or 45 days (US state laws; extendable once by 45 days). Requests are free unless they are clearly unfounded or excessive.

A12.3 US state privacy rights. If you live in a US state with a privacy law (for example California, Virginia, Colorado, Connecticut, Texas, Oregon or Minnesota), you have the rights in A12.1 as that law gives them, including, where it gives it, a list of the specific third parties we disclosed your personal data to (our subprocessor list names our service providers). We do not sell or share personal information for cross-context behavioral advertising, we do not use sensitive personal information except to provide the service, and we do not profile people in ways that produce legal or similarly significant effects. We will not treat you differently for using your rights. If we refuse a request, you can appeal by replying to our answer; we review it again (a different person where we have one) and answer within the time your law sets (in most states, 45 or 60 days), explaining our decision and how to contact your state's attorney general if you disagree.

A12.4 Complaints. You can complain to a data protection authority. Because Sovrasign has no establishment in the EU, you may go to the authority of any EU or EEA country where you live or work or where the issue arose; in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner. We would like to hear from you first.

A13. Cookies and similar technologies

The web app and the signing page use only the cookies and browser storage they need to work, such as keeping you signed in. The marketing site and help center use none. We do not use advertising, social media or third-party analytics cookies, pixels or fingerprinting. Our cookie notice lists every item. We treat a Global Privacy Control signal from your browser as an opt-out of any sale or sharing, which we do not do anyway.

A14. Children

Accounts are for adults only: 18, or the age of majority where you live if higher. We do not knowingly collect personal data from children for accounts; if we learn that an account belongs to a minor, we close it, offer an export and refund unused prepaid amounts.

Senders must not send documents to children they know are under 13: we do not have the process for a parent's verifiable consent that the US Children's Online Privacy Protection Act (COPPA) requires. If we learn that a recipient is under 13, we may stop the envelope for that recipient or void it, and we delete the personal data about the child that we collected through the signing page, except what the law requires us to keep. A sender may send a document to a recipient aged 13 to 17; the sender is responsible for having the consent of a parent or guardian the law requires.

A15. Automated decisions

Our safety checks may delay a send or pause a signing request for review (A6.2); a person reviews every pause within 24 hours and makes the decision; if a pause affects a deadline, contact support and we review it sooner. You can appeal any decision we take. The support assistant cannot refuse a refund, close an account or change a plan by itself.

A16. Contact, representatives and changes

A16.1 Contact. Sovrasign LLC, 522 W Riverside Ave #10903, Spokane, WA 99201, USA. Privacy: privacy@sovrasign.com. Security: security@sovrasign.com. We have not appointed a data protection officer, because the law does not require one for us today; our privacy contact handles these duties.

A16.2 Representatives. We appoint our representatives in the EU (Article 27 of the GDPR) and in the UK before EU and UK sign-ups open, and name them here then. You will be able to contact them instead of us on any question about this policy.

A16.3 Data Privacy Framework. Sovrasign LLC is not certified under the EU–US Data Privacy Framework, its UK Extension or the Swiss–US Data Privacy Framework. Until it is, transfers of personal data to us from the EU, EEA, UK and Switzerland rely on the standard contractual clauses and the transfer assessments described in A10.2.

A16.4 Security. We protect data with encryption in transit and at rest (each organization's documents under their own key), strict access control with no standing access for our staff, logging of every access to customer data, regular tests and a published security page. If a personal data breach is likely to put you at high risk, we tell you without undue delay; we notify authorities and customers as the law and the data processing agreement require.

A16.5 Changes. When we change this policy we publish the new version with its id and date and keep earlier versions on our legal page. We tell account holders by email or in the app before a significant change takes effect. We never use data already collected for a new purpose that needs your consent without asking for it.

A17. Notice at collection for California residents

This table restates the policy in the categories the California Consumer Privacy Act uses, for data we handle as a business (controller) in the last 12 months. For data we process for a customer, we are its service provider.

We do not sell or share any of these categories, and we have no actual knowledge of selling or sharing personal information of anyone under 16.