Privacy Policy

Version 1.1, approved 2026-09-27. Version 1.1 adds Google Analytics on the public marketing pages (see Public website measurement); nothing else changed from version 1.0, approved 2026-09-21. This policy is written from the engineering data map (an internal inventory, available on request) so that every statement below can be checked against the code. It covers what signup and the trial record, and what the trial's recreation control keeps after deletion (decisions D17–D19).

Who we are

eScryber is operated by Hyper Chimp Solutions LLC, a California limited liability company, 2108 N Street #9804, Sacramento, CA 95816, United States. For anything in this policy, write to privacy@escryber.com.

Two kinds of people use eScryber, and this policy is for both:

• Senders — people at an organisation that has an eScryber account and sends documents for signature.
• Recipients — people asked to sign, approve or fill in a document. Recipients do not need an account; they receive a link.

If you are a recipient, the organisation that sent you the document decided what the document contains and who receives it. eScryber processes your information on that organisation's behalf: the organisation is the controller of what is in the document and who receives it, and eScryber is its processor. For the account and billing information of senders, eScryber is the controller.

What we collect

From senders

• Your name, email address and password. The password is stored only as a one-way hash; we cannot read it.
• If you turn on two-factor authentication, the secret and backup codes needed to verify it.
• Sign-in sessions: when you signed in, from which IP address and browser, and which organisation you were working in.
• The organisation's name, logo, members and their roles, and settings.
• What kind of organisation you said it was at signup — a business or a nonprofit. It is a description used to choose what the product explains first; it is not verified and grants nothing.
• The trial: when it started, when it ends and how many envelopes it allows. To keep to one trial per organisation, we also keep a keyed hash of the mailbox that started it and, when known, a keyed hash of the network (IP) address it started from — never the address itself — with the outcome. The trial itself is deleted with the organisation; that hashed redemption record outlives it (see below).
• If you buy a plan, which price column it was bought at (standard or nonprofit) and any switch you have confirmed for the next renewal. Card details are never held here; Stripe holds them.
• The documents you upload, the fields you place on them, the people you send them to, and every action taken on them.

From recipients

• Your name and email address, as entered by the sender.
• The document sent to you and anything you enter into it, including any file a form asks you to attach.
• Your signature as you draw or type it.
• Your consent to sign electronically, which is recorded before any signature is accepted.
• When you open, sign, decline or forward a document: the time, your IP address and browser, and — when the operator has enabled it — the city, region and country the IP address maps to. This is looked up against a database on our own server; no lookup service is contacted.

From everyone

• Emails we send you, whether they were delivered, and whether you reported them as unwanted. An address that reports our mail as unwanted is not sent to again.
• Operational records: rate-limit counters (as hashes), request identifiers, and error logs. Logs are redacted before they are written: credentials, signing links and document content are removed.

What we do not collect

• Card or bank details. Payment details are entered on pages hosted by Stripe and never pass through our servers.
• Document and signing information for advertising. We do not send document contents, signatures, recipient details or account information to Google Ads.
• Document text for machine learning. The optional mobile-layout feature sends paragraph positions and short anchor phrases to a layout model; it never sends the body of a document, and it is off unless the operator enables it.

Why we use it

Public website measurement — updated September 27, 2026

Our public marketing pages (the home, pricing, founding offer, pilot, comparison and use-case pages) load a Google tag. It is not loaded on sign-in, account, workspace, document-signing or form pages, and it stops sending anything if you move from a marketing page to one of those.

Analytics. We use Google Analytics to count visits to those pages and to see which pages and which websites bring people to them. Google Analytics stores two first-party cookies (_ga and _ga_ followed by our measurement ID) in your browser for up to 13 months so a returning browser is counted once. It receives the page's path, any utm_ campaign labels in the page address, the address of the website that linked to the page without its path or query, and technical information about your browser, device and network, from which Google estimates an approximate location. All other parts of the page address, including other query strings and fragments, are removed first. Google signals and advertising personalization are turned off, and we do not link this information to your eScryber account.

Advertising. The same tag verifies our Google Ads measurement setup. Advertising storage, advertising user data and personalized advertising are disabled, and we do not configure conversion events.

You can block these cookies in your browser settings or with Google's opt-out browser add-on at https://tools.google.com/dlpage/gaoptout. Google describes its handling of information at https://policies.google.com/privacy.

Purpose	Basis
Delivering, signing and returning documents; building the audit trail and certificate of completion	Performing the service the sending organisation asked for
Keeping senders signed in and their organisation's data separate from every other organisation's	Performing the service; security
Billing subscriptions	Performing the contract with the organisation
Running the trial and keeping it to one per organisation	Performing the contract; legitimate interest in an offer that cannot be recreated by re-registering
Verifying nonprofit status for nonprofit pricing and Community — optional, only when the organisation applies	Performing the contract; the organisation asked for it
Detecting abuse, enforcing limits, and keeping the service running	Legitimate interest in a working, safe service
Counting visits to the public marketing pages and where they come from	Legitimate interest in knowing which pages help organisations find eScryber
Answering your requests about your data	Legal obligation

We do not sell personal information and do not use it for advertising.

Who can see it

• Members of the sending organisation, according to their role: owners and admins can see everything in their organisation; members see the documents they have access to.
• Recipients see their own document, their own signing status and the certificate of completion.
• Platform operators at eScryber can access data to run the service, investigate a problem or answer a request. Every privileged operator action is written to a tamper-evident audit log with the operator's identity and stated reason.
• Subprocessors listed in the subprocessor list, each only for the purpose stated there.
• Nobody else, unless the law requires it — a subpoena, court order, warrant or other legally binding demand. When that happens we disclose only what the demand requires, record it in the operator audit log, and tell the affected organisation before disclosing unless the law prevents it.

How long we keep it

The full schedule is the retention policy. In summary:

• Documents, signatures and audit trails are kept while the organisation keeps them. Automatic deletion is currently off while the deletion safeguards are being verified against production data; when a retention window is set, it will be published there first.
• Sign-in sessions last up to 30 days.
• Nonprofit verification letters are deleted 90 days after the decision. A record that the verification happened — the EIN, decision, date and reviewer — is kept so that one-per-entity offers cannot be claimed twice, and it is kept even if the account is deleted.
• The trial's recreation record — the keyed hashes of the mailbox and network address that started a trial, with the outcome — is kept after the organisation is deleted, for the same reason: one trial per organisation, not one per registration. The address and the mailbox cannot be recovered from it.
• Data export archives are deleted 24 hours after they are produced.

We do not claim to keep anything indefinitely, and we do not claim that anything is kept longer than the retention policy says.

Your rights and how to use them

• Access and portability. An organisation's owner or admin can export everything the organisation holds from Settings → Your data. The export is a zip with a manifest listing every file and its checksum; credentials and signing tokens are excluded. The deletion and export policy describes it.
• Correction. Senders can correct their own account details in Settings. Recipients should ask the sender, who controls the document.
• Deletion. Write to privacy@escryber.com. Deletion follows the deletion and export policy, including what is kept for legal reasons and why.
• Objection and complaint. Write to the same address. If you are not satisfied with our answer, you may also complain to the privacy or consumer-protection regulator where you live.

If you are a recipient and your request concerns a document, we will usually need to involve the organisation that sent it, because they decide what happens to the document.

Security

The security policy describes what we do. In short: TLS in transit; passwords hashed; integration tokens encrypted with a key held outside the database; per-document and operator audit trails that are hash-chained so tampering is detectable; and limits on what any one request, user or organisation can do.

Children

eScryber is a business service for organisations and is not directed at children. A sender account may be opened only by a person aged 18 or over, and we do not knowingly collect information from anyone younger as a sender. Recipients are named by the sending organisation, which is responsible for having the right to send a document to them.

Changes

This policy carries a version number and an approval date. When it changes, the new version is published with a new date, and senders are told by email when the change is material.

Contact

privacy@escryber.com