The data we hold, and your control over it.

When you create an account we store your email, name, and a password hash, plus the minimum metadata needed to authenticate you. If you sign in with Google, we store your Google account identifier and, if your Google profile has one, your avatar image.

We keep this for as long as your account is active.

Documents you upload, the recipients you add, the signing events, and the hash-chained audit log that proves them. When a recipient draws a signature, we capture the signature stroke data — the path and timing of the drawn signature — as part of the signing evidence.

To make sending faster, we also keep a per-account dictionary of recipient email addresses you've sent to before. You decide how long any of this lives: envelopes and drafts stay until you remove them.

We record IP addresses against your session, against entries in the audit log, and against each recipient's electronic-signature consent — so that a signed envelope can prove who acted, and from where, at the moment of signing.

Basic device and browser metadata and error reports, scoped to keeping the service running and debugging problems. Usage logs are retained for 90 days, then aggregated into anonymous metrics. We don't run analytics and we don't build advertising profiles.

We don't sell personal data. We don't read your document contents to train models. We don't share your data with anyone other than the sub-processors who help us run the service — that list lives in our DPA, available from privacy@docucrm.com.

You can ask us, at any time, to access a copy of your data, correct anything that's wrong, port it to another provider, or erase it. Whatever you choose, the signed PDFs others rely on stay verifiable — that's a deliberate property of the audit trail, not data we've failed to clear.

To request erasure, use the self-service form at app.docucrm.com/privacy/erasure or email privacy@docucrm.com. The fuller privacy policy sets out each of these rights in detail.