Privacy policy
ChatSign is run by Viaggi Limited (company number 15003364), a company registered in England and Wales ("we", "us"). We are the data controller for the information described here. For anything about your data, email viaggilondon@gmail.com.
What we collect
| Information | Where it comes from |
|---|---|
| Your WhatsApp phone number and profile name | WhatsApp, when you message us |
| Documents and photos you send, and the signed versions | You |
| Signers' phone numbers | The person who sends the document |
| Signer's typed name and drawn signature | The signer |
| IP address, browser type, and when a document was opened and signed | The signer's device, when they use the signing link |
| Subscription status, billing email and payment references | Stripe. We never see or store your full card details. |
Why we use it, and our legal basis
- To provide the service: receiving, preparing, sending and signing documents, and delivering signed copies (performance of a contract).
- To keep a signing record: the audit trail and signature certificate exist so a signature can be evidenced later (our legitimate interests, and those of the people relying on the document).
- To take payments and manage your plan (performance of a contract).
- To keep the service secure and prevent misuse (legitimate interests).
- To meet legal obligations, such as keeping financial records.
We don't sell your information, we don't use it for advertising, and we don't use your documents to train AI.
Who we share it with
We use these service providers to run ChatSign. They process data only on our instructions:
- Meta (WhatsApp Business Platform): to send and receive WhatsApp messages.
- Supabase: database and file storage, hosted in London. Files are encrypted by us before they are stored.
- Railway: application hosting.
- Netlify: hosting for this website.
- Stripe: payments.
The person who sent a document can see that it was opened and signed, and both sides receive the signed copy, which includes the signature certificate. We may also disclose information if the law requires it.
Some providers may process data outside the UK. Where that happens, we rely on safeguards approved under UK data protection law, such as the UK International Data Transfer Agreement or adequacy regulations.
How long we keep it
- Documents, signed copies and audit records: up to 6 years after signing, which matches the usual UK time limit for contract claims. You can ask us to delete documents sooner.
- Photos you send for combining into a PDF: deleted once the PDF is created, or if you cancel.
- Payment records: as long as UK tax law requires (normally 6 years).
How we protect it
Every file is encrypted with AES-256 before it leaves our server. Signing links contain a long random code that we store only in scrambled (hashed) form; they expire after 72 hours and can be used once. Audit records can only be added to, never edited, and each one is chained to the last so tampering can be detected.
Your rights
Under UK data protection law you can ask to access, correct or delete your information, to restrict or object to how we use it, and to receive a copy in a portable format. To make a request, email viaggilondon@gmail.com. We'll reply within one month.
Deleting a document does not delete the audit record of its signing where that record is needed to evidence a signature for someone else, but we will remove what we can.
You can also complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to help first.
Cookies
This website and the signing page don't use cookies or tracking.
Children
ChatSign is for people aged 18 and over.
Changes
If we change this policy in a way that matters, we'll update the date above and, where appropriate, tell you on WhatsApp.