Privacy Policy

1. Introduction

Filesign ("we", "us", or "our") is a product of Bluemoon Innovations, a company registered in India. This Privacy Policy describes how we collect, use, store, and protect information when you use our electronic document signing platform at filesign.ink (the "Service"). By using the Service, you agree to the collection and use of information in accordance with this policy. This policy applies to all users — document owners who upload and manage documents, and signers who are invited to sign documents.

2. Information We Collect

3. How We Use Your Information

We use the information we collect to: • Provide, operate, and maintain the Service • Authenticate your identity when signing in or signing a document • Generate legally binding audit trails for signed documents • Send you signing invitations, reminders, and completed document notifications via email • Ensure the integrity and enforceability of electronic signatures • Comply with applicable laws and legal obligations • Prevent fraud and unauthorised access We do not use your information for advertising or sell it to third parties.

4. Legal Basis for Processing

Our processing of your personal data is based on the following grounds under the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable Indian law: • Consent — you provide consent when you create an account or agree to sign a document • Contractual necessity — processing is required to deliver the Service you have requested • Legal obligation — audit trail data is retained to comply with the Information Technology Act, 2000 and to support the legal enforceability of electronic signatures under the IT Act and Indian Evidence Act • Legitimate interests — fraud prevention and security of the platform

5. How We Share Your Information

We share your information only in the following limited circumstances: • With other signers on the same document — your name and signed status are visible to the document owner and co-signers • With service providers — we use Supabase (database and file storage), Resend (email delivery), and Vercel (hosting). These providers process data on our behalf under appropriate data processing agreements • As required by law — we may disclose information if required by a court order, government authority, or applicable law in India or another jurisdiction • With your consent — for any other purpose, only with your explicit consent We do not sell, rent, or trade your personal information to third parties.

6. Data Storage and Security

Your data is stored on servers provided by Supabase and Vercel, which may be located outside India. We take appropriate contractual and technical measures to ensure that such transfers comply with applicable Indian data protection law. We implement industry-standard security measures including: • Encryption in transit (TLS/HTTPS) for all data • Encryption at rest for stored documents and signatures • Row-level security policies on our database • Access controls limiting who can view your documents • SHA-256 signature hashing for tamper detection No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Data Retention

• Signed documents and audit trails — retained for as long as your account is active, and for a minimum of 7 years after completion to support legal enforceability under Indian law • Biometric facial images — deleted automatically once all signers have completed signing a document • Account data — retained until you request deletion • Email logs — retained for 90 days You may request deletion of your account and associated data by contacting us at privacy@filesign.ink. Note that we may be required to retain certain records to comply with legal obligations.

8. Your Rights

Under the Digital Personal Data Protection Act, 2023 and applicable Indian law, you have the right to: • Access — request a copy of the personal data we hold about you • Correction — request correction of inaccurate or incomplete personal data • Erasure — request deletion of your personal data, subject to legal retention requirements • Grievance redressal — raise a complaint with our Data Protection Officer • Nominate — nominate another individual to exercise your rights on your behalf in the event of death or incapacity To exercise any of these rights, email us at privacy@filesign.ink. We will respond within 30 days.

9. Cookies

We use strictly necessary cookies to maintain your authenticated session. We do not use advertising, tracking, or analytics cookies. No third-party cookies are set on our platform.

10. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately at privacy@filesign.ink and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the effective date. For significant changes, we will send an email notification to registered users. Continued use of the Service after changes constitutes acceptance of the updated policy.

12. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of India, including the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and related rules. Any disputes arising under this policy shall be subject to the exclusive jurisdiction of the courts in India.

13. Contact Us

For any privacy-related questions, requests, or grievances, please contact: Bluemoon Innovations Email: privacy@filesign.ink Website: https://filesign.ink We aim to respond to all privacy enquiries within 30 days.