Privacy Policy
What personal data SimpleSign365 handles, where it is stored (EU or US), how long we keep it, and the choices you have.
Last updated 22 October 2026
The short version
- You sign in with your Microsoft 365 work account. We do not sell personal data or use it for advertising.
- Each organisation's documents are stored in one place, the EU or the US, chosen once at first sign-in. Everything we store for it stays there and is never moved.
- For the people your office sends documents to, your office decides why their data is used, and we process it on its behalf.
- On the Free plan nothing is stored: the signed PDF is emailed to everyone and the documents are deleted within 24 hours. Paid plans keep documents until you delete them.
- Signers need no account. They confirm their email address with a one-time code.
1. Who we are
The controller for the data described here is Alexander Duggleby, a sole proprietor trading as SimpleSoftware365, of Marxergasse 24/2, 1030 Vienna, Austria ("we", "us"). You can reach us at [email protected].
2. What this policy covers
This policy covers the SimpleSign365 website, the web app, the signing pages, the check page and the API. The role we play depends on whose data it is:
- Users of an office. For the data of the people who sign in and send documents, we are the controller. This policy mainly describes that.
- Signers and recipients. For the personal data of the people an office sends documents to, such as clients and employees who sign, and for the content of the documents, the office (the account holder) is the controller and we are its processor. The office decides whom to send documents to and why, and we handle that data only on its instructions to provide the service. A data processing agreement under Article 28 GDPR is available on request at [email protected]. See also the DPA page.
If you received a document to sign, please contact the office that sent it first, since it is responsible for why your data is used. You are also welcome to contact us, and we will help you reach the right person or deal with your request ourselves.
3. Data we collect
Sign-in and account data
You sign in with Microsoft. We receive your name, work email address and the identifiers Microsoft gives us for your account and your Microsoft 365 organisation. We also record the organisation's name, its storage choice (EU or US), plan, invoice details and settings, and the API keys an administrator issues, of which we store only a hash.
The permission to send email as you
To send signing emails from your own mailbox, you give SimpleSign365 one Microsoft permission: to send email as you (Mail.Send). We keep the access token Microsoft issues for this, and use it only to send the signing emails you start. We do not read your mail, your contacts or your calendar. You can remove the permission at any time in your Microsoft account.
Documents and signed PDFs
You upload PDF or Word files. We convert them to PDF, store them while they are in use, and keep the signed PDF as described in section 8. Documents may contain personal data, depending on what the office puts in them.
Signer data and signing history
For each signer we process their name and email address, the one-time code we send to confirm the address, and the unique signing link. When a signer accepts, we record their name, confirmed email address, IP address, the time of each step and the wording they agreed to. This signing history is added to the finished PDF as a page and is part of the evidence of the signature.
Emails we send
Signing requests, reminders and the signed copy go out from the sender's Microsoft 365 mailbox, so a copy of each stays in the sender's Sent Items. On paid plans our own address can act as a backup sender if the mailbox is unavailable. For emails we send ourselves, we keep a delivery record with the recipient, the type of email and its delivery status.
Audit log and technical logs
We keep a log of what happens in each account: who did what and when, such as sign-ins, sends, signatures and settings changes. Our servers also keep technical logs, such as requests, errors and security events, which can include IP addresses and user agents.
Website
The website sets no cookies and uses no analytics. The web app and the signing pages use only strictly necessary cookies to keep you signed in and secure your session.
4. How and why we use it
We only use personal data when we have a legal basis under Article 6 GDPR.
| Purpose | Data | Legal basis |
|---|---|---|
| Run your account, sign you in, send signing emails as you and provide the service | Account data, mailbox permission, documents | Contract, Art. 6(1)(b) |
| Collect signatures, send reminders and deliver signed PDFs on an office's behalf | Signer data, signing history, documents | As the office's processor, on its instructions. The office's own basis as controller applies to these people. |
| Keep the service secure, prevent abuse, and improve the service | Technical logs, audit log | Legitimate interests, Art. 6(1)(f) |
| Meet legal duties such as accounting and responding to authorities | Account, invoice and billing records | Legal obligation, Art. 6(1)(c) |
Where we rely on legitimate interests, we weigh them against your rights, and you can object as described in section 11.
5. Who we share data with
We do not sell personal data, and we do not use it for advertising. We share it only with:
- The office that sent you a document, which can see its signers, signed documents and signing history.
- The other signers of the same document, who receive the signed PDF with its signing history.
- Service providers (subprocessors) who help us run the service, under contracts that require them to protect the data. They are listed below and on the subprocessors page.
- Authorities and advisers, where the law requires it or where we need to protect our rights.
| Provider | Purpose | Location |
|---|---|---|
| Microsoft (Azure) | Hosting, database, file storage, key vault, logging and monitoring | Your organisation's storage: West Europe (EU) or Central US (US) |
| Microsoft 365 | Sign-in, and sending signing emails from the sender's mailbox | Where your Microsoft 365 is hosted |
| Lettermint | Sending system emails (backup sender, notifications) for EU organisations | EU |
| Resend | Sending system emails (backup sender, notifications) for US organisations | US |
| Timestamp authority (DigiCert) | Trusted timestamp on the signed PDF. It receives only a fingerprint (hash) of the document. | Global service |
| Paddle.com Market Ltd | Payments, invoices and sales tax for paid plans, as reseller (merchant of record), once billing starts | United Kingdom |
6. Where your data is stored
We run two separate deployments: the EU (Microsoft Azure, West Europe) and the US (Microsoft Azure, Central US).
- The organisation chooses once. Each organisation is stored in exactly one of them, EU or US, chosen at its first sign-in. We preselect from your browser time zone. The choice cannot be changed later and the organisation cannot be moved.
- It stays there. The documents, signed PDFs, signing history, audit records, logs and backups of the organisation stay in the place it chose. The EU and US deployments share no customer data, and system emails are sent by the provider for the organisation's storage.
The key that seals finished PDFs is held in a hardware-backed key vault in the EU. To seal a document stored in the US, only a short fingerprint (a SHA-256 hash) of the PDF is sent to that key. It contains no content or names. Signed PDFs are timestamped by a trusted timestamp service, which also receives only that fingerprint.
Signers do not choose anything. A signer's data is stored where the sending office's organisation is stored.
7. International transfers
For organisations that chose the US, data is stored in the US. For organisations that chose the EU, it is stored in the EU. Some of the providers in section 5 may process data elsewhere, and emails you send to signers go through their mail providers. Where personal data is transferred outside the European Economic Area, we rely on an adequacy decision, such as the EU-US Data Privacy Framework for certified US providers, or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for details at [email protected].
8. How long we keep data
- Free plan: nothing is stored. The signed PDF is emailed to everyone, and the documents are deleted within 24 hours.
- Paid plans: documents and signed PDFs are kept until you delete them.
- Signing record: who signed, when and from which email address, without the document content, is kept for 10 years, as evidence of the signature.
- Drafts and unfinished requests: drafts and requests that expired, were declined or were cancelled are deleted after a limited period.
- Email delivery records and technical logs are kept for a limited period, for security and to fix problems.
- Account data is kept while the account exists. When it is closed, we delete it, except where we must keep it by law, such as invoice records.
We may keep some data longer where the law requires it, for example accounting records, or where we need it to handle a legal claim.
9. Security
We use reasonable technical and organisational measures to protect personal data, including encrypted connections, a hardware-backed key for the seal, and limiting access to people who need it. No system is perfectly secure. If a breach affects your personal data in a way the law says we must report, we will tell you and the authorities as required.
10. Electronic signatures and the seal
The signatures collected through SimpleSign365 are simple electronic signatures, supported by a seal and a signing history. The seal is a PDF signature made by SimpleSign365 with a trusted timestamp. It shows whether the PDF changed after it was finished. It is not a qualified signature. Anyone with a sealed PDF can check it on the check page.
11. Your rights
Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent where we rely on it. To use any of these rights, email [email protected]. We will answer within one month. For data we process on an office's behalf, we may refer you to the office.
You can also complain to the supervisory authority. For us that is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40 to 42, 1030 Vienna, www.dsb.gv.at. You may complain to the authority in your own country instead.
12. Children
The service is not for anyone under 16, and we do not knowingly collect personal data from children. If you think a child has given us data, please tell us and we will delete it.
13. Changes to this policy
We may update this policy. If a change is significant, we will tell you by email or in the app before it takes effect. The date at the top shows when it was last updated.
14. Contact
For questions or requests about your data, email [email protected], or write to Alexander Duggleby, Marxergasse 24/2, 1030 Vienna, Austria. See also our imprint and terms.