Privacy policy

1.1 Controller

swipesign GmbH
Elisabethstraße 15, Top 5A, 1010 Vienna, Austria
Company register number: FN 664099 t
Email: office@swipesign.io

More company details are in our imprint.

1.2 Privacy contact

We haven't appointed a data protection officer, because the law doesn't require one for us. For anything about your data, write to support@swipesign.io.

1.3 Scope

This policy applies to:

• our website www.swipesign.io, including our help centre (/support);
• our platform app.swipesign.io: electronic signatures, identity verification and Safe Transfer;
• support requests;
• billing.

Use of the platform is also governed by our terms and conditions.

For account holders and website visitors, we are the controller. We decide why and how your data is processed.

Our customers invite other people to sign or receive documents, and they store contacts in their address book. For these people (signers, recipients, contacts) the customer is the controller. We process their data on the customer's behalf under a data processing agreement (Art. 28 GDPR). If you were invited by one of our customers, contact that customer first about your data.

One exception: the audit trail and the signature evidence. We keep these ourselves, so we can prove that a signature is valid as required by the eIDAS Regulation and by law. Legal basis: our legitimate interest in proving signatures (Art. 6(1)(f) GDPR) and our legal obligations (Art. 6(1)(c) GDPR).

3.1 Hosting and server logs

The website is hosted by OVH (OVH SAS, 2 rue Kellermann, 59100 Roubaix, France) in EU data centres and served as static files via nginx. Each request is logged with IP address, time, requested URL, referrer, user agent and status code. We need these logs for security and operations. Legal basis: Art. 6(1)(f) GDPR. Logs are deleted after 30 days at the latest.

Fonts are hosted on our own server. The website sets no cookies.

3.2 Contact form

If you use the contact form, we receive your name, email address, company (optional), segment (optional) and message. The form is sent to our support mailbox by email through our mail server. We use the data only to answer your request.

Legal basis: Art. 6(1)(b) GDPR if your request relates to a contract or steps before one; otherwise Art. 6(1)(f) GDPR, our interest in answering enquiries. To stop abuse, we keep your IP address in memory for a short time to limit the number of requests.

We keep the data as long as we need it to handle your request. If a contract follows, statutory retention periods apply.

3.3 Notary pricing page

The password for /notaries/pricing is checked by a Google Apps Script web app (Google Ireland Ltd), which receives the password and your IP address. Legal basis: Art. 6(1)(f) GDPR.

3.4 Analytics

We use Plausible Analytics (Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia) to count visits. Plausible sets no cookies and doesn't track you across sites. Your IP address is hashed and not stored. Data is hosted in the EU. Legal basis: Art. 6(1)(f) GDPR, our interest in understanding how the site is used. We may switch Plausible off at times.

3.5 External links

The website links to LinkedIn and YouTube. When you follow these links, you leave our site. The provider's own privacy policy applies there.

3.6 PDF signature check

Our free signature check (/validate) needs no account. When you choose a PDF, your browser uploads it directly to our platform at app.swipesign.io. The file is processed in memory and not stored: the file and its contents are not written to disk or logged, and the report is not kept after it has been sent to your browser. The report shows the data in the file's signatures, such as signers' names, and we do not keep that data either. To check whether a certificate has been revoked, the service may ask the issuer of that certificate (for example by OCSP or a revocation list); this tells the issuer which certificate was asked about, not who asked or which file it came from.

Your IP address is used in the rate limiter that protects this free service, for up to 10 minutes. Separately, your IP address and the request path appear in our server access logs, like any other request; these logs are kept for 30 days. Our web analytics records only the type of result, not the file name, its hash or anything from the file. The hash and the signed-version download on the report are calculated in your browser. Legal basis: Art. 6(1)(f) GDPR (providing the check you asked for and protecting it from abuse).

4.1 Hosting

The platform runs on our own cluster hosted by OVH in ISO 27001-certified data centres in the EU (Germany and France). Our database and cache run on the same infrastructure. We make backups daily.

4.2 Your account

When you register and use your account, we process:

• email address, name and language;
• password (stored only as a hash);
• mobile number, which we verify with an SMS code;
• PIN, if you set one (stored only as a hash);
• organisation name, country and tax ID;
• your answers to the onboarding survey.

We need this data to provide the service. Legal basis: Art. 6(1)(b) GDPR.

4.3 Identity verification

We only verify your identity when you or the sender choose a verified signature or Safe Transfer. Depending on your choice, one of these services is used:

• ID Austria. You log in at eid.oesterreich.gv.at, run by the Republic of Austria (Federal Ministry of the Interior) together with A-Trust. We receive your given name, family name and a sector-specific identifier (bPK). We store the bPK only as a SHA-256 hash.
• WebID. Video identification by WebID Solutions GmbH, Friedrichstraße 88, 10117 Berlin, Germany. We send your first and last name, email address, date of birth, sex, mobile number and postal address. We receive the result of the verification and your identity data. We don't store images of your ID document or the video. WebID keeps those under its own retention rules.
• eID Easy. eID Easy OÜ, Tallinn, Estonia, connects us to national eIDs and trust service providers, for example D-Trust sign-me, Swisscom, Smart-ID, Mobile-ID, itsme, Veriff, BankID, InfoCert and SPID. The privacy policy of the provider you choose applies.

Legal basis: Art. 6(1)(b) GDPR (the signature or transfer you asked for) and Art. 6(1)(c) GDPR (eIDAS and the anti-money-laundering obligations of our customers). We keep the identity data together with the signature evidence (see 4.4).

4.4 Signatures and evidence

Qualified electronic signatures are created by a qualified trust service provider. With ID Austria this is A-Trust GmbH, Landstraßer Hauptstraße 5, 1030 Vienna, Austria. With eID Easy it is the trust service provider you choose (for example D-Trust, Swisscom or InfoCert). Qualified timestamps come from A-Trust. Advanced signatures are created on our platform.

For each signer we store this signature evidence:

• name, email address and phone number;
• signature type and timestamps;
• IP address and user agent;
• certificate data;
• for eID providers, the identity code the provider returns.

For each document we also keep an audit trail: user ID, action, timestamp and IP address.

We keep the evidence and the audit trail as long as needed to prove a signature is valid, and at least 7 years (Austrian statutory retention, § 132 BAO and § 212 UGB). Legal basis: Art. 6(1)(c) and (f) GDPR.

4.5 Documents

We process uploaded documents and signer data only to run the signing workflow. Completed documents can be downloaded for 14 days after completion. After that, we delete the files from our storage. Only a cryptographic checksum, the signer data and the audit trail remain. Cancelled and expired signings are handled the same way. Temporary files from conversions (DOCX to PDF, PDF/A) are deleted within 3 hours. Legal basis: Art. 6(1)(b) GDPR.

4.6 Document AI

A service on our own infrastructure analyses the PDF and the signer roles to suggest signature fields and summaries. We don't use an external AI provider, and nothing is sent to third parties for this. Legal basis: Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR, our interest in making signing faster.

4.7 Safe Transfer

When you receive a document through Safe Transfer, we process your email address and name, the result of your identity verification (hashed bPK or WebID result, and whether the names match), your acceptance of the terms (time and version) and the times you accessed and downloaded the files. Links expire after 14 days. Legal basis: Art. 6(1)(b) GDPR.

4.8 Address book

Customers can store contacts: name, email address and phone number of other people. The customer is the controller for this data (see 2).

4.9 Payments

Payments are handled by Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Dublin 2, Ireland. We pass your email address, organisation name, tax ID and an internal customer ID to Stripe. Card data goes directly to Stripe and never touches our servers. For metered billing we report usage counts to Stripe. Legal basis: Art. 6(1)(b) GDPR. We keep invoices for 7 years (Art. 6(1)(c) GDPR).

4.10 Email

Transactional emails (for example signing invitations and notifications) are sent through Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany). Brevo processes your email address, name and the content of the message. Legal basis: Art. 6(1)(b) GDPR.

4.11 SMS codes

Verification codes are sent by SMS through Twilio Ireland Ltd, 3 Dublin Landings, Dublin 1, Ireland. Its parent company is Twilio Inc. in the USA. Twilio processes your mobile number and the code. Transfers to the USA are covered by EU Standard Contractual Clauses and the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR, our interest in securing your account.

4.12 Error monitoring

We use Sentry (Functional Software Inc., San Francisco, USA) to find and fix errors. Data is stored in Sentry's EU region in Frankfurt. Sentry receives error messages, stack traces, browser and device information and your user ID. We don't use session replay. Legal basis: Art. 6(1)(f) GDPR, our interest in a working platform.

4.13 Analytics

On app.swipesign.io we also use Plausible Analytics, as described in 3.4. No cookies, no cross-site tracking.

4.14 Country detection

When you open the login or registration form, our server derives your country from your IP address using a database on our own infrastructure, to preselect the phone country code. The IP address is not stored for this purpose and no third party is involved. Legal basis: Art. 6(1)(f) GDPR.

4.15 Affiliate tracking

If you arrive through a partner link, a cookie banner asks for your consent. Only if you accept "marketing" cookies do we load Refindie. Refindie stores a referral ID and the time of your visit for up to 90 days, so we can credit the partner who referred you if you subscribe. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the cookie settings.

4.16 Cookies and browser storage

The platform uses:

• cc_cookie: stores your cookie choice for 1 year. Necessary.
• Refindie cookies: affiliate tracking (see 4.15). Marketing, only with your consent.
• Stripe cookies: Stripe Elements may set its own cookies for fraud prevention. Necessary.
• localStorage: login token, cached user profile, language.
• sessionStorage: session token, cached country (24 hours), Safe Transfer unlock state.

Necessary storage is required to run the platform (§ 165(3) TKG 2021, Art. 6(1)(b) and (f) GDPR).

We handle emails to support@swipesign.io ourselves, in our support mailbox. The mailbox runs on Google Workspace (Google Ireland Ltd) and is stored in the EU (Frankfurt). We process your name, email address and the content of your request to answer it. Legal basis: Art. 6(1)(b) GDPR for customers, otherwise Art. 6(1)(f) GDPR, our interest in answering requests.

We use these providers. Each is bound by a contract with us.

• OVH — website and platform hosting, storage — EU (France, Germany)
• Stripe — payments and invoicing — Ireland
• Brevo — transactional email — Germany
• Twilio — SMS codes — Ireland, USA
• Sentry — error monitoring — EU region (Germany), company in USA
• Plausible — cookieless analytics — EU (Estonia)
• WebID — video identification — Germany
• eID Easy — eID and signature aggregator — Estonia
• A-Trust — qualified certificates and timestamps, ID Austria — Austria
• Google — support mailbox (Workspace, stored in Frankfurt) and notary pricing password check (Apps Script) — Ireland, USA
• Refindie — affiliate tracking (with consent) — may process data outside the EU

By default your data stays in the EU. Exceptions: Twilio, Sentry (data in the EU region, company in the USA), Google and Refindie may process data outside the EU. We protect these transfers with EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the recipient is certified, the EU-US Data Privacy Framework.

• Account data: as long as your account exists, and up to 30 days after it is closed.
• Signature evidence and audit trail: at least 7 years.
• Invoices: 7 years.
• Documents: 14 days after completion.
• Server logs: 30 days.
• Support emails: 3 years.

• All connections are encrypted with TLS.
• Stored data is encrypted at rest.
• Safe Transfer files are encrypted with AES-GCM.
• Access to data is restricted to staff who need it.
• Our data centres are ISO 27001 certified.
• Signatures carry qualified timestamps.

You have the right to:

• access your data (Art. 15 GDPR);
• have wrong data corrected (Art. 16 GDPR);
• have your data erased (Art. 17 GDPR);
• restrict processing (Art. 18 GDPR);
• receive your data in a portable format (Art. 20 GDPR);
• object to processing based on legitimate interest (Art. 21 GDPR);
• withdraw your consent at any time, without affecting processing done before (Art. 7(3) GDPR).

To use these rights, email support@swipesign.io. We may ask you to prove your identity first.

There's no self-service account deletion yet. To delete your account, email us. We complete the deletion within 30 days, except for data we must keep by law (see 8).

You can complain to the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, https://www.dsb.gv.at) or to the authority in your own EU member state.

We update this page when our processing changes. The date at the top shows the current version.