GDPR

What is processed

For tools that process without transmission: nothing of your document. It never reaches our infrastructure, so there is no processing of its contents by us in any sense the regulation uses.

For the site itself: ordinary web request data — which page, when, and the technical details every web server receives. One functional cookie for language.

If you create an account: your email address, the identifier your sign-in provider returns, which version of the terms you accepted and when, your plan and when it renews, credits, usage counters and any team you belong to.

If you send a signature request: its title, message and sender name, each signer’s name and email address, where their fields sit, a record of each step, and the document itself in encrypted form until the request is finished.

If you rate the site or a tool: the score, anything you typed, and two technical identifiers that carry no name or email.

Tools that genuinely need a server are labelled, and their page states what happens to the file and for how long.

On what basis

Account data, plan records, credits, usage counters and signature requests: necessary to provide the service you signed up for. Payment records: the tax and accounting law that applies to any business that takes money. Serving pages, keeping the service standing up, ratings and anonymous counts: our legitimate interest, which you can object to. Remembering your language is necessary to provide the service you asked for.

No decision with legal or similarly significant effects is made about you automatically.

We do not rely on consent for anything, because we do nothing that requires it: no advertising, no profiling, no sharing with data brokers.

Your rights

You have the right to know what is held about you, to get a copy, to have it corrected, to have it deleted, to object to processing, and to complain to your data protection authority.

In practice, for someone without an account, the honest answer to “what do you hold about me” is: nothing that identifies you. With an account, ask and we will tell you, send you a copy, or delete it.

Your account page can export everything we hold about you and can close the account, both immediately. For anything else, write to privacy@docugrip.com. There is no form to fill in and you do not need to explain why.

Where the data is

Your documents stay where you are, because they never move — no browser tool sends one anywhere. A document you send for signature is the exception: its encrypted copy is stored with our database provider until the request is finished.

Account data is a different matter and we will not pretend otherwise. Our database, our payment provider and our email provider are all operated from the United States, so if you are in the European Union or the United Kingdom, your email address and billing reference are transferred there.

That transfer runs on the Standard Contractual Clauses, which each of those providers has signed with us and which remain the mechanism the regulation expects for this route. We hold no special category data — no health, no biometrics, no political or religious detail — because the service never asks for any.

Breaches

A breach means someone gets data they should not have. For browser tools there is nothing to breach: your file was never in our possession. A signature request’s document is stored encrypted, and the key that opens it is not stored with it.

For account data, if a breach happened that put you at risk, we would tell you and the relevant authority within the time the regulation requires. We would rather say this plainly than not mention it.

Who is responsible, and who to write to

The data controller is Simulator Arts LLC, which operates DocuGrip. Every decision about what is collected and why is made there.

For any request under the regulation — access, correction, deletion, portability, objection — write to privacy@docugrip.com. You do not need a form, a template or a lawyer, and we answer within thirty days.

If you are not satisfied with the answer, you can complain to the data protection authority where you live. That right exists whatever we say here, and using it costs you nothing.