Privacy Policy
How OwnSigner collects, uses, and protects information when you visit ownsigner.com or use the OwnSigner platform.
1. Who we are
"OwnSigner", "we", "us", or "our" refers to the OwnSigner product operated by Hany Elmaghrabi. We can be reached at [email protected].
2. What this policy covers
This Privacy Policy describes how we handle personal data in three contexts:
- Marketing website at ownsigner.com (visitors, demo requests, support emails)
- OwnSigner Cloud (our hosted SaaS product) — data we process on your behalf as a Processor
- Self-hosted OwnSigner deployments — we are NOT a processor; the customer is data controller and processor for all signing data
3. Marketing website
3.1 What we collect
- Information you give us directly — name, email, company, message — when you contact sales or support
- Server logs — IP address, browser type, pages visited, referrer, timestamps — retained for 30 days for abuse prevention
- Minimal analytics: page-view counts only, no third-party advertising trackers
3.2 Why we use it
- To respond to your inquiry
- To send service-related communication (e.g. demo follow-ups you requested)
- To prevent abuse of the website
3.3 Legal basis (GDPR)
Legitimate interest (operating and securing the site) and, where required, your consent (e.g. demo requests).
4. OwnSigner Cloud (managed SaaS)
4.1 Roles
When you use OwnSigner Cloud, you are the Data Controller of the documents, signatures, and signer details you upload. OwnSigner is the Data Processor acting on your documented instructions.
4.2 Categories of data processed
| Category | Examples | Retention |
|---|---|---|
| Account data | Email, name, hashed password, role | Until you delete the account |
| Document content | Uploaded PDFs / Office docs | Per your retention settings (default: indefinite until deleted) |
| Signer identity | Signer email, name, phone (if OTP), IP, user agent | For audit-trail purposes — at least 6 years for legal evidence |
| Signature artifacts | Drawn signature images, captured timestamps | Bundled with the signed document |
| Audit logs | Every view, signature, decline event with IP + timestamp | Same as document retention |
4.3 Where data is stored
You choose your region during onboarding. We offer hosting in EU (Frankfurt), US (us-east-1), and KSA (Jeddah). Documents do not leave your selected region.
4.4 Sub-processors
For OwnSigner Cloud we use:
- Oracle Cloud Infrastructure / AWS — compute & storage in your selected region
- Mailjet (Sinch) — transactional email delivery
- Cloudflare — DDoS protection and TLS termination at the edge
A current list of sub-processors is provided in the Data Processing Addendum at /dpa.html. We notify customers of any change 30 days in advance.
5. Self-hosted OwnSigner
If your organization runs OwnSigner on your own infrastructure (private cloud, on-prem, or air-gapped), OwnSigner Inc. processes no document, signer, or signature data on your behalf. We do not have access to your data, and this Privacy Policy does not apply to that data — your own privacy policy does.
We may receive optional, anonymous telemetry (version number, error counts) only if you enable it. Telemetry never includes document content, signer details, or any personal data.
6. Your rights
Subject to applicable law (GDPR, KSA PDPL, UAE PDPL, CCPA, etc.), you have the right to:
- Access personal data we hold about you
- Correct inaccurate data
- Delete your account and associated data
- Object to or restrict certain processing
- Request data portability
- Withdraw consent
- Lodge a complaint with your supervisory authority
For OwnSigner Cloud customers, document-level rights of signers (data subjects) should be exercised through the controlling customer organization in the first instance.
Submit a request: [email protected]. We respond within 30 days.
7. Security
We use industry-standard safeguards including:
- AES-256 encryption at rest, TLS 1.3 in transit
- Bcrypt-hashed passwords with high work factor
- Per-tenant encryption keys for OwnSigner Cloud
- Role-based access control + audit logging for all administrative actions
- SOC 2-aligned operational controls (vendor management, change management, incident response)
- Annual penetration testing by an independent firm
8. International transfers
For OwnSigner Cloud, we host all data in the region you select. We do not transfer personal data outside that region. For incidental support transfers (e.g. support email exchanges), we rely on Standard Contractual Clauses where required by law.
9. Children
OwnSigner is not directed at children under 16. If we learn we have collected personal data of a child without parental consent, we will delete it.
10. Changes to this policy
We will notify registered customers by email at least 30 days before material changes. The current version is always available at this URL.
11. Contact
OwnSigner — Privacy Officer
Email: [email protected]
Website: ownsigner.com