SignWren App Privacy Notice
Draft pending legal review. This notice is a draft that a lawyer hasn't reviewed yet. We may change it after that review, and if a change is material we'll email account owners before it takes effect.
This notice covers the SignWren app at app.signwren.com: accounts, the documents sent through it, the signing pages people use to sign, the emails the app sends and the API. The app is run by Vasa Trend AI LLC (dba SignWren), 131 Continental Drive, Suite 305, Newark, DE 19713, United States ("we", "us"). The website at signwren.com has its own Privacy Policy, and the SignWren Terms of Service cover how the app may be used.
Who is responsible for my information?
It depends on whose information it is. For the people who create and use SignWren accounts, we decide how their account information is used, so we're responsible for it. The documents a business sends, and the information about the people it sends them to, belong to that business. We handle them on the business's behalf and only to provide SignWren to it. If you were asked to sign something, the business or person who sent it to you is the one to ask about your information; their name and contact details are on the signing page and in the email you received.
What do you collect about account users?
When you create an account we collect your name, your email address and your password. We never store the password itself, only a scrambled version of it (a scrypt hash). If you choose to sign in with Google, Google confirms your name and email address to us instead of a password. We also keep the name of your workspace, the data region you chose, your role, who invited you, and the settings and templates you create. If the link that brought you to sign up had campaign tags (the utm_source, utm_medium, utm_campaign, utm_content and utm_term parts of the address, which tell us which post, video or email it was), we save them with your account. We use them only to count which of our posts and videos lead to sign-ups.
To keep accounts secure we record sign-ins and security events, such as a password reset, a new API key or a role change, with the time, the IP address and the browser's user agent. If you're on a paid plan, we keep your plan, its status and the customer and subscription IDs that Stripe gives us. We don't receive or store your card number.
What do you collect about the people who sign?
We collect what the sender enters about each signer, and what happens on the signing page. That means the signer's name and email address, a mobile number if the sender asks for a text message code, what they type or draw into the fields, and their signature. For every step, such as opening the link, agreeing to sign electronically, entering a code, signing or declining, the audit trail records the time, the IP address and the browser's user agent. It also records when each email was sent and when the recipient's mail server accepted it.
The audit trail and the certificate of completion exist so the sender can show later how a document was signed. They're part of the sender's records, and the finished PDF goes to everyone who took part. Access codes and verification codes are stored only in scrambled form, and the certificate never shows a full phone number.
How do you use this information?
We use it to run SignWren: to create and secure accounts, send documents and the emails that go with them, seal finished documents, keep the audit trail, bill paid plans, answer support requests, and spot and stop abuse. We also use it where the law requires us to. We don't use the content of anyone's documents for advertising, we don't build marketing profiles of signers, and we don't sell personal information or share it for anyone's advertising.
How do AI suggestions use my documents?
AI suggestions are off by default, and no document text goes to an AI provider unless an account owner turns them on. They aren't available yet. Once they are, and only after the owner turns a feature on in Settings, the text that feature needs, usually the text of the one document being worked on, is sent to the AI provider named on the Settings page. SignWren is set up to use Anthropic's API. We never send signers' email addresses, phone numbers, IP addresses or signature images, and documents made from our health form templates are never sent. A sender can switch AI off for any envelope before it runs.
We don't train AI models on customer documents, and we only send documents to a provider whose terms say it won't train on them either. The AI suggestions article explains exactly what is sent and when.
Who do you share information with?
We share it only with the service providers that run parts of SignWren for us, and each gets only what its job needs:
- Hosting. The app, its database and its file store run on a virtual private server rented from Hostinger. An off-site backup storage provider, if we use one, holds only encrypted copies it can't read.
- Email delivery. Resend sends the app's emails, so it receives the recipient's name and email address and the content of each email, which can include signing links and completed PDFs.
- Payments. Stripe handles subscriptions, card payments, invoices and receipts. It receives the billing details you enter on its pages.
- Sign in with Google. Only if you choose it. Google confirms your name and email address, and learns that you signed in to SignWren.
- Text message codes. Only when text message codes are switched on and a sender requires one, Twilio receives the signer's mobile number and the code to send.
- AI suggestions. Only when an account owner turns them on, as described above.
- Seal timestamps. When a document is sealed, a timestamp service receives a fingerprint (a hash) of it, never the document itself.
If you connect SignWren to another service, such as an HR system or cloud storage, we send it what you set up the connection to send. We may also disclose information when the law requires it, or to a buyer of our business, who would have to keep this notice's promises.
Where is my information stored?
Every SignWren account's data is stored in the United States today. You choose a data region when you create a workspace, and the European Union option isn't available yet. Some of our providers may process information in other countries under their own safeguards.
How do you protect it?
Everything travels over encrypted connections (HTTPS). Uploaded documents and finished PDFs are encrypted on disk (AES-256-GCM) and the keys aren't stored with the files or in backups. Roles are checked on our servers for every request, so one account can't reach another's documents, and the audit trail is hash-chained, so a deleted or edited entry shows up. Repeated failed sign-in attempts lock the account for a while. No system is perfectly secure, but we keep what we collect to what SignWren needs.
If we learn of a security incident that affects your account's information, we'll tell the account owner promptly, in plain words, with what happened and what we're doing about it, so you can meet any duties you have to your own signers.
How long do you keep it?
We keep account information and documents while the account is open, unless you delete them sooner. When you delete a document or close the account, its files and records are removed for good 30 days later, and copies in our encrypted backups age out within about 90 days after that; the delete and close account article explains the steps. Business accounts can also set retention rules that delete documents automatically after a set number of days. A short record that a deletion or closure happened stays in the account's security log. Copies already emailed to signers are theirs and aren't affected.
Do you use cookies or tracking in the app?
The app uses only the cookies it needs to work: ones that keep you signed in, tie a signing session to the browser it started in, and make features such as single sign-on and public signing links work. There are no analytics, advertising or tracking cookies in the app, and no third-party analytics scripts. If the link you arrived by had campaign tags, the sign-up and sign-in pages keep them in your browser tab's session storage (not a cookie) until you close the tab, so they can be saved with your account if you sign up. They aren't sent anywhere else.
What are my choices and rights?
Account users can see and change most of their information in Settings, download finished documents from each document's page, and close the account. You can also ask us to see, correct or delete the information we hold about you by writing to hello@signwren.com. Depending on where you live, including California and the European Economic Area, you may have further rights under local law, and we'll honor requests made under those laws.
If you signed a document, ask the sender first, because the document and its audit trail are their records. If you write to us, we'll pass your request to the sender and help them answer it.
Is SignWren meant for children?
No. SignWren is for businesses and adults, accounts are for people 18 and over, and we don't knowingly collect information from children.
Will this notice change?
If we change it, we'll update the date at the top. If a change is material, we'll email account owners before it takes effect.
How do I contact you about privacy?
Email hello@signwren.com or write to Vasa Trend AI LLC, 131 Continental Drive, Suite 305, Newark, DE 19713, USA.