Legal
Effective date: July 18, 2026
Signauf is operated by ITNN Cloud. This Privacy Policy explains what data we collect when you use signauf.com, how we use it, and your rights in relation to it. Questions? Email [email protected].
Account data — name, email address, and organisation information collected when you sign up via Google OAuth or email. Managed by Clerk.
Request data — the content of approval requests you submit, including field values, file references, and free-text justifications.
Decision data — who approved or denied a request, when, and any comments left.
Audit logs — a record of actions taken in your organisation (request created, approved, denied, expired, etc.).
Email content — if you use inbound email submission, the body of emails sent to your inbound address is processed to extract request fields.
Usage data — page views, API calls, and error logs collected for operational purposes.
Billing data — payment method and transaction history managed by Stripe. We do not store card numbers.
We do not use your request content for advertising or sell it to third parties.
We use the following sub-processors to deliver the Service:
| Service | Purpose | Data shared |
|---|---|---|
| Clerk | Authentication & user management | Name, email, org membership |
| Vercel | Hosting & edge network | All web traffic |
| Neon | PostgreSQL database | All stored data |
| Resend | Outbound email notifications | Name, email, request content |
| Mailgun | Inbound email processing | Email content |
| Stripe | Payment processing | Billing info |
| Anthropic | AI request assessment | Request field values |
| Cloudflare | Bot protection (public forms) | IP address |
When AI assessment is enabled on a form, request field values are sent to Anthropic's API to produce a recommendation. This data is subject to Anthropic's Privacy Policy.
Do not submit data you are not authorised to share with third-party AI providers. If you handle sensitive personal data (health, financial, legal), disable AI assessment on those forms or review Anthropic's data handling policies first.
We use session cookies set by Clerk to keep you signed in. We do not use tracking or advertising cookies. Public pages may set a Cloudflare cookie for bot protection on public forms.
We retain your data for as long as your account is active. When you delete your account, your data is retained for 30 days then permanently deleted, unless we are legally required to keep it longer.
Audit logs and billing records may be retained for up to 7 years to comply with financial regulations.
We use industry-standard measures to protect your data including TLS encryption in transit, encrypted database storage, HMAC-signed webhook payloads, and scoped API keys. No system is completely secure — if you discover a vulnerability, please contact us immediately at [email protected].
Depending on your location, you may have the right to:
To exercise any of these rights, email [email protected]. We will respond within 30 days.
The Service is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice in the app. The effective date at the top of this page reflects the date of the last update.
For privacy questions or to exercise your rights, contact us at [email protected].