EasySign Privacy Policy

1. Who we are

EasySign is provided by Enablr Digital Limited, trading as Webgun, a New Zealand company ("we", "us"). We handle personal information under the Privacy Act 2020.

2. Our two roles

When a business sends a document through EasySign, we hold that document and the signers' information on the business's behalf, as its agent (Privacy Act 2020, section 11). The business that sent you a document is responsible for your information in it; we use it only to provide EasySign to them. You can ask them, or us, about it.

For the businesses that use EasySign, we are responsible for their account details (the names and email addresses of the people who sign in, and how they use EasySign).

3. What is collected

From senders: name, business name, email address, sign-in records, the documents they upload (for signing, or to keep in their business's Document centre, with each version and who added it), the details they fill in, and their saved signature with the record of their consent to use it.

From businesses: the people they invite to their team (email address and role), who has access to which folders, and when invitations were sent and accepted.

From signers: name and email address (supplied by the sender), the answers, initials and signature they add, the IP address and device details they sign from, and the time of each step.

Signing records: the history of each signing request, linked in a tamper-evident chain, and a certificate of completion added to the signed document.

Document centre records: when a business sends a document from its Document centre, a note that it came from there, and the completed copy filed back into the same folder. When someone downloads a sealed copy, a record of its fingerprint, the time, the business, the version number and the person who asked for it. The fingerprint record holds no part of the document.

4. Why

To send documents for signing, confirm signers are the people the sender intended (by a code sent to their email), produce the completed copy and its certificate, and keep a record that can show what happened. We do not sell personal information or use signers' information for marketing.

5. Where it is kept

Signing records are kept in a database in Sydney, Australia (Supabase). Documents are stored on Cloudflare R2, requested in its Oceania region; Cloudflare treats this as best effort, not a guarantee. The service runs in Sydney (Vercel).

Emails are sent through Resend from its Tokyo, Japan region; Resend stores email metadata and logs, such as recipient addresses and delivery records, in the United States.

When a document is sealed, a timestamp service (DigiCert or Sectigo) receives only a fingerprint of the seal, never the document or any personal information.

These providers hold information for us to provide EasySign, and may not use it for their own purposes.

6. Who can see it

The sender and the other signers of a document see the completed copy, including each signer's name, email address, IP address and signing times on the certificate of completion.

Anyone holding a copy can check it at sign.easysign.nz/verify; the result shows the document's title, the sender, when it was completed, and each signer's name, a partly hidden email address and signing time.

Inside a business, its owners and admins see everything in its Document centre, and other members see it unless a folder is limited to chosen people. A document sent from the Document centre, and its completed copy, can be seen only by the people who can see that folder, and by owners and admins.

We do not otherwise share personal information unless the law requires it.

7. How long

Completed documents and their signing records are kept for 7 years after completion, then deleted.

Documents in a business's Document centre are kept while its account is open. Something deleted from the Document centre goes to its trash and is deleted for good 30 days later, and when an account closes its Document centre is deleted 30 days later. A completed copy filed back into the Document centre is kept the same way, while the envelope it came from keeps its own 7 years.

A sealed copy downloaded from the Document centre is made when asked and is not stored. Its fingerprint record is kept while the account is open, including after the document is deleted, and is deleted 30 days after the account closes.

Sign-in codes work for 10 minutes; sign-in records (codes and signed-in sessions) are deleted 30 days after they end. Account details, team members and invitations are kept while an account is open.

8. Security

Documents are sealed so any change can be detected, signing links expire, signers confirm an emailed code, and access is limited to the people who need it. If a privacy breach is likely to cause serious harm, the business responsible (and we, for information we are responsible for) will notify the Privacy Commissioner and the people affected, as the Privacy Act requires.

9. Your rights

You can ask to see or correct personal information about you by emailing hello@easysign.nz. If you signed a document someone sent you, they hold it too, and you can ask them. You can also complain to the Office of the Privacy Commissioner (privacy.org.nz).

10. Changes

We will post any update here with a new version date, and ask account holders to accept material changes when they next sign in.