Clear handling for the information behind every agreement.

Who operates SignaCore

SignaCore is operated by Se7en Inc. References to "SignaCore," "we," or "us" mean Se7en Inc. in this policy.

Privacy questions and requests can be sent to info@mysignacore.com. We reply as soon as we can, usually within 24 hours.

Information we process

• Account information: email address, display name, account type, password hash, verification status, and account timestamps.
• Social sign-in information: a provider identifier and email or name returned by Google or Apple when you use those services. Provider identifiers and emails are encrypted or hashed for storage and account matching.
• Workspace information: organization name, membership, role, invitations, subscription status, and administrator activity.
• Document and signing information: uploaded PDFs, document metadata, configured fields, signer email addresses and names, entered values, signature images, signing status, timestamps, IP addresses, user agents, and the completed PDF.
• Billing information: Stripe customer, price, subscription, and webhook identifiers and billing status. SignaCore does not receive or store full payment-card numbers.
• Connected storage information: the connected provider, account identifier, encrypted OAuth tokens, and folder or file metadata needed to browse the account. We briefly download PDF content only after a workspace administrator selects it for import, and write completed copies to the provider's SignaCore folder.
• Technical information: session cookies, request metadata, security events, and information needed to operate and protect the service.

Why we use it

• To create accounts, authenticate users, verify email ownership, and provide signer OTP access.
• To detect PDF fields, show authorized previews, collect signatures, flatten completed PDFs, and maintain document history.
• To send account, invitation, signing, OTP, correction, and completion notifications that users request through the service.
• To manage organizations, permissions, plan limits, subscriptions, invoices, and support requests.
• To prevent abuse, investigate security events, enforce these terms, and comply with legal obligations.
• When a workspace administrator connects cloud storage, to browse folders and PDF metadata, import the specific PDF they choose, and archive completed copies back to that provider.

Protection and access

Persistent PDFs, signature images, and selected sensitive values are protected with authenticated Fernet encryption. Email hashes are used where the service needs to match an address without querying encrypted text directly. Passwords and OTPs are stored as one-way hashes. HTTPS/TLS protects data in transit.

Access is limited by account, organization membership, signer verification, and administrator permissions. Workspace administrators can retrieve documents belonging to their authorized workspace. A signer receives only the assigned signing context after verifying the email link with an OTP.

Temporary plaintext files can exist inside the private service runtime while an operation is being completed and are removed after the operation. No online service can guarantee that every transmission, endpoint, or device is risk-free.

Service providers

We share only what is needed with providers that help us operate SignaCore, including configured email delivery, Stripe for billing, Google or Apple when you choose social sign-in, connected cloud-storage providers when a workspace administrator authorizes one, and the self-hosted infrastructure used to run the application and database. A connected storage provider receives the requests needed to browse folders, retrieve a selected PDF, and create a completed copy; it processes information under its own terms and privacy policy.

SignaCore does not sell document contents or signer information for advertising. The current service does not use document contents to train AI models. Any future AI feature must disclose its provider, data flow, retention, and controls before document content is sent to a model.

Retention and deletion

How long documents are kept. A signed document and its signing record are kept for as long as the workspace that sent it exists. There is no automatic expiry, and that is deliberate rather than an omission: a signed agreement is evidence, and a contract disputed three years after signing is of no use to anybody if the record was deleted in year two. The same reasoning covers the audit trail, the timestamps and IP addresses recorded at signing, and the certificate of completion.

Deleting a document. A workspace administrator can delete any document they sent, at any time, and deletion removes the stored files as well as the record. The one exception is a document placed under legal hold, which cannot be deleted until the hold is released — a hold exists precisely because the document is evidence in a live dispute, and releasing it is a separate, deliberate and recorded act.

Things that are removed automatically. A signer’s one-time code is short-lived and is cleared once it expires. Files left on storage that no longer belong to any document are removed nightly. Neither of these deletes a document.

Your rights. To request access to, correction of, or deletion of personal information, contact info@mysignacore.com. We reply as soon as we can, usually within 24 hours. We may need to verify who is asking before acting. We may also need to keep information we are required to retain for security, legal, accounting, or dispute records — and where a document is evidence in a dispute involving the person asking, we will say so rather than delete it quietly.

If you signed a document through SignaCore but have no account with us, the organization that sent it to you is the one that decides how long it is kept. We hold it on their behalf. Write to us at info@mysignacore.com and we will tell you who they are and pass the request on.

Cookies and communications

SignaCore uses necessary session and security cookies to keep authenticated flows working. It does not use document contents for behavioral advertising. Transactional email delivery may generate provider-level delivery, bounce, and complaint records.

Analytics. The public marketing pages use Google Analytics to count visits and a short list of actions — an account being created, a document being uploaded or sent, a plan being bought. This sets cookies in your browser and sends Google the page you are on and a randomly generated identifier for your browser. It never runs on the signing pages, so reading or signing a document is not measured and a signer is not counted.

We send Google no document content, no file names, no signer names and no email addresses, and advertising features are switched off: the tag is loaded with advertising storage, advertising user data and ad personalization all denied, so the data is not used to build an advertising profile of you. You can opt out entirely with Google’s browser add-on, or by using any content blocker — the site works identically either way, because nothing on it depends on the counter loading.

Updates

We may update this policy when the service, providers, or legal requirements change. The effective date will be updated on this page. Material changes should be communicated through the service or email where appropriate.

Last updated: October 13, 2026