Privacy policy
1. Who we are
netsign.io is operated by Pierre-Paul TACHER, sole trader (entrepreneur individuel, micro-entreprise), SIREN 752188789, at 102 rue Diderot, 94300 Vincennes, France ("netsign", "we").
We act in two roles, depending on the data:
As controller (GDPR art. 4(7)) for account data, sign-in and security records, the identity checks we perform, and the evidence we keep to prove that a signature was made.
As processor (GDPR art. 28) for the documents a sender uploads and the signer details they enter. The sender, or the organisation they act for, decides why the document is signed and who signs it. Our processing terms for senders are in our Terms of use and sale document.
Contact for privacy questions: privacy@netsign.io. Data protection officer: Pierre-Paul TACHER.
Our supervisory authority is the French CNIL (Commission nationale de l'informatique et des libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.
2. Scope and definitions
This policy covers the netsign.io website, the dashboard, the signing pages, and the netsign apps for iOS, macOS and Android, plus the netsign bridge used with YubiKeys.
| Term | Meaning |
|---|---|
| Sender | The person who uploads a document and asks others to sign it (also "owner"). |
| Signer | A person invited to sign or decline a document. A signer does not need an account to receive an invitation. |
| Account holder | Anyone who created a netsign account. |
| Signing device | The device holding a signer's private signing key: a phone or computer secure element (Apple Secure Enclave, Android hardware-backed keystore / StrongBox) or a security key (YubiKey). |
| Evidence file | The records that prove who signed what and when: the signed document's fingerprint (SHA-256), the consent given, the checks passed, timestamps, and a tamper-evident audit log. |
| Intermediary archival | Storage of data we no longer use day to day, kept apart and with restricted access, only because the law or the defence of legal claims requires it (CNIL "archivage intermédiaire"). |
Signatures made with netsign aim to be advanced electronic signatures under eIDAS art. 26: uniquely linked to the signer, capable of identifying them, created with signature-creation data under their sole control, and linked to the signed data so that any later change is detectable. netsign is not a qualified trust service provider, and does not issue qualified electronic signatures.
3. Personal data we process
We collect only what the signature, its proof, or the checks the sender asked for require. Optional checks are off unless the sender turns them on for a signer.
| Category | Whose | Examples | Source |
|---|---|---|---|
| Account data | Account holders | Email, username, display name, first and last name, password hash (Argon2id), sign-in passkey public keys | You |
| Invitation data | Signers | Name, email, and — if the sender asks for an SMS check — mobile number | The sender |
| Document data | Senders, signers, anyone named in the document | The PDF and its contents, signature field positions, the signed output | The sender |
| Signing credentials | Signers with an account | Public keys and attestation certificates of your signing device or YubiKey (serial number, firmware, key policy); never the private key | Your device |
| Verification results | Signers asked for a check | Email confirmed, SMS code passed (masked number), identity-document check passed or failed, name and date of birth read from the document's chip | You, your ID document, our identity provider |
| Evidence file | Signers, senders | Consent text and its version, document fingerprint, timestamps, IP address, browser user agent, tamper-evident audit log | Generated by the service |
| Technical and security logs | All visitors | IP address, user agent, sign-in and sign-out events, rate-limit records | Generated by the service |
We do not use your data for advertising and do not sell it. We do not make decisions about you based solely on automated processing that produce legal effects (GDPR art. 22); an identity check that fails can be retried or handled by the sender another way.
4. Why we process it, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Provide the account and the signing service | Account, invitation, document, signing credentials | Performance of a contract (GDPR art. 6(1)(b)) with the account holder; for signers without an account, the sender's and our legitimate interest in completing the signature they were invited to (art. 6(1)(f)) |
| Verify a signer's email or mobile number when the sender asks | Email, mobile number, SMS code records | Legitimate interest of the sender and of netsign in linking the signature to the intended person (art. 6(1)(f); eIDAS art. 26(a)–(b)) |
| Verify a signer's identity document when the sender asks | Data read from the ID chip, face comparison result | Explicit consent (art. 9(2)(a)) for the face comparison, which uses biometric data; consent or legitimate interest (art. 6(1)(a) or (f)) for the rest |
| Keep proof that a signature was made, and defend or exercise legal claims | Evidence file | Legitimate interest (art. 6(1)(f)) and, for the claims, art. 17(3)(e); legal obligations where they apply (art. 6(1)(c)) |
| Keep the service secure and prevent abuse | Logs, rate-limit records | Legitimate interest (art. 6(1)(f)) |
| Invoicing and accounting | Billing data of paying senders | Legal obligation (art. 6(1)(c); French Commercial Code art. L123-22) |
| Answer your requests and run our legal obligations | Correspondence, request records | Legal obligation (art. 6(1)(c)) |
Where we rely on legitimate interest, you can object (section 11). Where we rely on consent, you can withdraw it at any time; withdrawal does not affect a signature already made.
5. Signing on your own device
Your private signing key is created inside your device and never leaves it. It is generated and kept in the Apple Secure Enclave (iOS, macOS), the Android hardware-backed keystore, or the signature slot of your YubiKey, and every signature needs your confirmation on that device: Face ID, Touch ID, device PIN, or YubiKey PIN and touch.
We receive and keep only what is needed to recognise your key and check its signatures:
the public key and the device's attestation certificate chain;
for a YubiKey, its serial number, firmware version and PIN and touch policy;
for Apple App Attest, the key identifier and attestation result.
We never receive your biometric data from Face ID or Touch ID: the device only tells us that the check passed. Revoking a device or key in your account stops it from signing; signatures it already made stay valid and stay in the evidence file.
6. Checks the sender can ask for
The sender chooses, per signer, how strongly the signer must be linked to the invitation. You see which checks apply before you sign.
Email. We send the invitation link to the address the sender gave. We keep the address and whether, and when, it was confirmed.
SMS code (optional). If the sender gave your mobile number, you must enter a 6-digit code we send to that number before signing or declining. You never type a number yourself. The code is valid 10 minutes; we store only a hash of it. The evidence file records that a code was sent to and confirmed from the sender-provided number, shown masked (for example +33 • •• •• •• 78). The SMS is sent by Twilio.
Identity document (optional). If the sender asks for it, you verify your identity with the netsign app by holding your passport or electronic ID card against your phone. The app reads the document's chip over NFC and checks that the data was signed by the issuing State and that the chip is genuine. It then compares the photo stored in the chip with a live selfie.
What we keep: the result of each check (passed / failed), the document type and issuing country, your name and date of birth as read from the chip, and the date of the check.
What we do not keep after the check: the chip photo, the selfie, and the face templates computed from them. They are deleted immediately of the result.
The document number is not kept.
We never collect your French social security number (NIR).
The face comparison uses biometric data, a special category under GDPR art. 9. We perform it only with your explicit consent, asked for in the app just before the selfie. If you refuse, the check is not done and the sender is told it was not completed, not that it failed.
7. How long we keep it, and intermediary archival
Data moves through three stages: active (used to run the service), intermediary archive (kept only as proof or because the law requires it), then deleted or anonymised. The intermediary archive is a separate store, encrypted, readable only by [named roles] and only to answer a legal claim, an authority, or your own request; every access is logged.
| Data | Active | Intermediary archive | Then |
|---|---|---|---|
| Account data | While the account is open | [30 days] after closure, to undo an accidental closure | Deleted, except what an evidence file needs |
| Sent document (PDF) | Until the workflow ends + [90 days], or as long as the sender keeps it in their account | Not archived by default; the sender keeps their own copy | Deleted |
| Evidence file (incl. invitation details, check results) | Until the workflow ends + [1 year] | Until 5 years after the last signature (French Civil Code art. 2224 limitation period) | Deleted, or anonymised for statistics |
| Face photo, selfie, face templates | During the check only | Never | Deleted at once |
| SMS code hashes | [30 days] | Never; the evidence file keeps only the masked number | Deleted |
| Security and sign-in logs | [6 months to 1 year] | Never | Deleted |
| Billing records | Current year | 10 years (French Commercial Code art. L123-22) | Deleted |
| Records of your privacy requests | Until answered | [3 years] | Deleted |
When you ask us to delete your data (section 11), we delete what we can at once and move the rest into the intermediary archive. Typically we erase your account and profile, and keep only the evidence files of documents you signed or sent, so that those signatures stay provable for their limitation period. Your name stays readable in a signed PDF, because removing it would alter the signed document.
8. Who receives it
The sender and the other signers of a document see what the workflow needs: your name, your status (signed, declined, waiting) and the signed document. Other signers do not see your email or phone number.
We use these processors, each bound by a contract under GDPR art. 28:
| Processor | Role | Location |
|---|---|---|
| Hostinger | Servers and database | Paris, France |
| Twilio | Sending SMS codes | Dublin, Ireland for EU users, US otherwise |
| Digicert | Trusted timestamps on signed PDFs (fingerprint only, no personal data) | N/A |
| Zoho Mail | Sending invitations | Amsterdam, Netherlands and Dublin, Ireland |
| Stripe Payments Europe, Ltd. | Card payments for credit; we never see your card number. Stripe also acts as an independent controller for its own legal obligations (fraud prevention, payment regulation) | Ireland (EU) |
We disclose data to authorities or courts only when the law requires it, and to a successor company if netsign is sold, under this same policy.
9. Transfers outside the EEA
We store data in the European Economic Area. When a processor handles data outside it (for example to deliver an SMS to a non-EU number, or a provider based in the US), the transfer relies on an adequacy decision (GDPR art. 45, such as the EU–US Data Privacy Framework for certified US companies) or on the European Commission's standard contractual clauses (art. 46(2)(c)) with additional safeguards where needed. You can ask us for a copy of those safeguards.
10. Security
We protect data as GDPR art. 32 requires, with measures matched to the risk:
private signing keys never leave your device, so we cannot sign in your name;
encryption in transit (TLS);
passwords hashed with Argon2id; sign-in passkeys; codes and link tokens stored only as hashes;
a hash-chained, append-only audit log, so any change to an evidence record is detectable;
access to production and to the archive restricted to named people and logged;
breach handling: notification to the CNIL within 72 hours where required (art. 33) and to you without undue delay when the risk to you is high (art. 34).
11. Your rights
Under GDPR arts. 15 to 22 you can ask us to:
access your data and get a copy (art. 15);
correct it (art. 16) — a mistake in a signer's name or email can be corrected by the sender only until that signer has signed or declined;
delete it (art. 17) — see the limit below;
restrict its use (art. 18);
receive the data you gave us in a portable format (art. 20);
object to processing based on legitimate interest (art. 21);
withdraw consent at any time, for checks based on consent.
Under the French Data Protection Act (art. 85), you can also give us instructions on what happens to your data after your death.
The limit that matters most here. A signature is only useful if it can be proven later. When an evidence file is needed to establish, exercise or defend legal claims, we may keep it despite a deletion request or an objection (art. 17(3)(e), art. 21(1)). In that case we move it to the intermediary archive (section 7), stop all other use, and tell you which records we kept and until when.
Where we are only a processor (document contents, signer details entered by a sender), we pass your request to the sender, who decides, and help them answer it.
How to ask. Write to privacy@netsign.io or directly from your account after when signed in (https://netsign.io/dashboard/account). We may ask you to prove your identity, with no more data than needed. We answer within one month, extendable by two months for complex requests (art. 12(3)). If you are not satisfied, you can complain to the CNIL (cnil.fr/plaintes) or to the authority of your EU country of residence (art. 77).
12. Cookies
We use only cookies that the service cannot work without, which need no consent under the French Data Protection Act (art. 82):
| Cookie | Purpose | Lifetime |
|---|---|---|
| session_id | Keeps you signed in | 12 hours idle, 72 hours at most |
The dashboard remembers your colour theme (light, dark, system) in your browser's local storage; it is never sent to us. We use no analytics, advertising or third-party tracking. If that changes, we will ask for your consent first.
13. Changes and contact
We may update this policy. We show the date of the last change at the top, and we tell account holders by email at least [30 days] before a change that affects them. Signatures already made stay under the policy in force when they were made, for the data collected then.
Questions: privacy@netsign.io, or by post to Netsign.io—Pierre-Paul TACHER, 102 rue Diderot, 94300 Vincennes, France.