Privacy Policy
Last updated 17 August 2026
What we collect
Account details (name, email, business name, password stored as a salted hash); documents you upload and the fields placed on them; signer details provided by senders (name, email, optional access codes); signature images signers draw, type or upload; and technical records kept for the audit trail — IP address, browser user agent and timestamps for events such as opening, consenting and signing.
Why we collect it
To provide the service: routing documents, recording legally meaningful evidence of who signed what and when, sending the emails that make signing work, and operating reminders, expiry and billing. The audit trail exists precisely to evidence signing events, so it is retained with the envelope.
Where it lives
Data is stored with Supabase (database and file storage) and the application runs on Vercel. Payment card details are handled entirely by Stripe and never touch our systems. Email is delivered through Resend.
Who can see it
Documents are visible to the workspace that sent them and to the addressed signers through their private links. We do not sell personal information. Service providers above process data only to run Sign IT.
Retention and deletion
Envelopes and their audit trails are kept while your account holds them, because they form the signed record. Deleting a draft or voided envelope removes its files. To delete an account and its data, contact us.
Security
Signing links use high-entropy private tokens, optional access codes gate sensitive envelopes, passwords are hashed with scrypt, files are held in a private bucket, and every table is protected so that only the application can read it.
Your rights
We handle personal information consistent with the Australian Privacy Principles under the Privacy Act 1988 (Cth). You may request access to or correction of your personal information, or make a complaint, by contacting us; if unresolved you may contact the OAIC.
Contact
Privacy questions and requests: director@kwinnovations.com.au.