Privacy Policy
Version US 1.0. Effective date: October 29, 2026. Last updated: October 29, 2026.
This policy explains how SuperSign handles personal data on getsupersign.com, our contact form and the SuperSign service. SuperSign, LLC is a U.S. company. Our affiliate in Brazil, I.P.P.F. Serviços e Tecnologia Ltda., operates the service for us. It also describes rights available to U.S. residents, including California residents.
Summary. We do not sell your personal information. We do not use your documents to train AI. We use your email to tell you about early access and the service, and you can unsubscribe at any time.
1. Who we are
SUPERSIGN, LLC, a New Mexico limited liability company (EIN 37-2165483), mailing address 7345 W Sand Lake Rd Ste 210 Office 6840, Orlando, FL 32819, United States ("SuperSign"). Data Protection Officer: João Augusto Nogueira, [email protected].
2. Our role
For your account, sign-in, support and our own marketing, SuperSign decides how data is used (controller). For the content of documents a customer sends for signature, the customer decides and SuperSign processes it on their behalf (processor). SuperSign alone keeps the signing record and security data.
3. What we collect
| Group | Data |
|---|---|
| Early access list | Email address. |
| Account | Name, email, company, credentials (password stored only as a hash), settings, access and usage logs. We do not ask for a Social Security number on the Free plan. |
| Signers | Name, email, and the signature a signer draws or types. |
| Signing record | IP address, browser and device information, date and time, authentication method, a fingerprint (hash) of the document, and signing events. We do not collect geolocation. |
| Documents | Files and details the customer uploads. The customer controls the content. |
| Website visits | IP address, pages, device and browser, and where you came from (campaign and ad parameters such as utm_source, and click identifiers from Google, Meta and Microsoft). |
| Support | Your messages, attachments and history. |
We do not store full payment card data. Paid plans are not yet available for U.S. accounts.
4. Why we use it
- To run your account and the signing service.
- To keep the signing record, which records who signed, when, and a fingerprint (hash) of the document, and to defend legal claims.
- For security, fraud and abuse prevention.
- For support.
- To measure where sign-ups come from and how our campaigns perform (cookies for this need your consent through the cookie banner).
- To email you about early access, news and offers, with your consent. You can withdraw it at any time.
5. Artificial intelligence
AI features are optional and only run when a customer turns them on. We do not use documents, signing records or content sent to AI features to train AI models, ours or anyone else's, and we do not allow our providers to do so. We make no decisions about you based only on automated processing.
6. Who we share it with
Only as needed, with: the customer who sent a document and the other participants; cloud, hosting, backup and monitoring providers; email and messaging providers; payment and accounting providers; CRM, email marketing and analytics providers such as HubSpot and ActiveCampaign; lawyers and auditors under confidentiality; authorities when the law requires; and a successor in a merger or sale, with the same protections. We do not sell personal information. With your consent through the cookie banner, we use advertising and analytics partners such as Google, Meta and Microsoft to measure our campaigns. You can withdraw that consent at any time in Cookie preferences.
7. International transfers
Our data is hosted in the United States (Google Cloud, Iowa), with backups in the United States. Our affiliate team in Brazil may access that data to operate the service. Providers such as HubSpot and ActiveCampaign also process data in the United States. We use contractual safeguards for transfers between Brazil and the United States.
8. How long we keep it
| Data | Period |
|---|---|
| Early access emails | Until you unsubscribe or ask us to delete them. |
| Account data | While the account exists and up to 5 years after it closes. |
| Access logs (IP, date and time) | At least 6 months, up to 12 months for security. |
| Document files | While the plan is active and 90 days after cancellation, then deleted. |
| Signing record and hashes | 10 years after the document is completed, even after the files are deleted, so a signature can still be proven. |
| Cancelled, declined or expired documents | Files for 90 days, signing record for 5 years. |
| Ad conversion logs | 13 months. |
| Consent records | Up to 5 years. |
9. Your rights
You can ask to access, correct or delete your personal information, to get a copy, to withdraw consent and to object to processing. California and other U.S. state residents can also ask what we collect, use and share, and to opt out of the sale or sharing of personal information. We do not sell it, and you can opt out of sharing for advertising in Cookie preferences. We will not treat you differently for using your rights. Write to [email protected]. We may ask you to confirm your identity and will reply within 15 days. For data inside a customer's documents, we forward your request to that customer.
10. Security
We use encryption in transit and at rest, access control by role, hashed passwords, activity logs, document integrity by hash, backups, monitoring and an incident response plan. No system is risk free, so please protect your credentials. If an incident creates a relevant risk to you, we will notify the affected people and the authorities as the law requires.
11. Cookies
We use necessary cookies, and analytics and marketing cookies only with your consent. You can decline non-essential cookies in the banner and change your choice at any time. Signing pages do not use marketing cookies.
12. Marketing emails
We email you about early access, news and offers only with your consent. Every marketing email has an unsubscribe link and our postal address. Operational and security messages continue because they do not depend on that consent.
13. Children
The service is not for anyone under 18, and we do not knowingly collect their data.
14. Changes
When we change this policy, we post the new version and date here and warn account holders by email at least 30 days before material changes take effect.
15. Contact
João Augusto Nogueira (DPO), [email protected]. I.P.P.F. Serviços e Tecnologia Ltda., Av. Brigadeiro Faria Lima, 1.811, Sala 1.119, Jardim Paulistano, São Paulo/SP, CEP 01452-001, Brazil.
Not legal advice.