1. Introduction

SmoothSign ("we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and disclose personal data when you use the SmoothSign platform and related services (the "Service"). By using the Service, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

Bullseye Labs AS (Norway; registered as Kefas AS, name change pending; org. no. 928 769 879), which operates SmoothSign, is the data controller for the personal data processed through the Service. If you have questions about how we process your personal data, please contact us at support@smoothsign.cc.

3. Personal Data We Collect

We collect and process the following categories of personal data:

Account information: First name, last name, email address, and phone number, provided during registration.
Signature data: A digital representation of your handwritten signature, stored in encrypted form.
Payment information: Billing details and payment information, processed securely through our third-party payment processor (Stripe, Inc.). We do not store payment card numbers on our systems; card details are handled exclusively by Stripe.
Communication data: Verification codes sent via email and SMS for identity confirmation purposes.
Usage data: Information about how you interact with the Service, including signing activity and document metadata (e.g., document names, number of signers).
Language preference: Your preferred language for communications.
Referral data: Referral codes used or generated by you.
Signing evidence data: When you sign a document, we record your IP address, user-agent (browser/device string), and a timestamp. This is stored alongside the signature record as legal evidence under the EU eIDAS Regulation.

4. How We Use Your Data

We process your personal data for the following purposes:

Service delivery: To provide the signing service, apply your stored signature to documents, and deliver signed documents to all parties.
Identity verification: To verify your identity through email and SMS verification codes before signing.
Account management: To create and maintain your account, manage your subscription, and process payments.
Communications: To send transactional emails and SMS messages related to your use of the Service (e.g., signing requests, verification codes, payment receipts).
Legal compliance: To comply with applicable legal obligations.
Service improvement: To monitor, analyze, and improve the Service.

5. Legal Basis for Processing

We process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

Contract performance: Processing necessary to provide the Service you have registered for (Article 6(1)(b)).
Legitimate interests: Processing necessary for our legitimate interests in operating and improving the Service, provided these interests are not overridden by your rights (Article 6(1)(f)).
Legal obligation: Processing necessary to comply with legal obligations to which we are subject (Article 6(1)(c)).
Consent: Where required, we will obtain your explicit consent before processing (Article 6(1)(a)). You may withdraw consent at any time.

6. Document Handling and Downloads

Documents are processed by SmoothSign's signing service to collect signatures and produce the signed PDF. The signed PDF is delivered to the parties by email. The web application stores document metadata and signing evidence; its download endpoint retrieves PDF content from the signing service rather than keeping a separate PDF archive.

Save your own copy when you receive the signed PDF. Direct downloads require the signing service to make the signed file available and are currently not connected. A download link expires after 15 minutes; this is the link's validity period, not the document's retention period. We have not yet published a verified retention or automatic-deletion period for PDFs in the signing service, so we do not promise immediate deletion or permanent retrieval. When you use the Fiken integration, copies uploaded to Fiken are subject to your Fiken account's retention settings.

7. Signature Storage and Security

Your digital signature is stored in encrypted form on secure servers. We implement appropriate technical and organizational measures to protect your signature data against unauthorized access, alteration, disclosure, or destruction. Access to signature data is restricted to automated processes necessary for the signing service.

8. Data Sharing and Third Parties

We may share your personal data with the following categories of recipients:

Other signers: When you sign a document with other parties, your name and email address may be visible to other signers of the same document as part of the signing process.
Legal requirements: We may disclose data if required by law, court order, or governmental regulation.

We use the following sub-processors to operate the Service. Each processes personal data on our behalf under a data processing agreement, and only to the extent necessary to deliver their service:

Lovable Cloud (cloud hosting and database) — stores account data, encrypted signatures, and signing evidence. Data is hosted within the EU/EEA.
Stripe, Inc. (payment processing) — processes payments and stores payment card details. Stripe is certified under the EU–US Data Privacy Framework.
Mailgun (EU region) (transactional email) — delivers verification codes, signing requests, and receipts from our domain smoothsign.cc. Email content is processed on Mailgun's EU infrastructure.
Twilio (SMS delivery) — delivers SMS verification codes to signers' phone numbers.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

8a. AI Assistant Connections (Claude, ChatGPT and other MCP clients)

You can connect SmoothSign to an AI assistant such as Claude or ChatGPT (via our MCP server at smoothsign.cc/mcp or our SmoothSign GPT). The connection only starts after you sign in to SmoothSign and explicitly approve access. Once connected, the assistant can, on your instruction: send PDF documents you provide to signers you explicitly name, list your documents, show signing status (signer email addresses and signing times), and request short-lived (15 minute) download links when the signed-PDF source is connected. The assistant receives only this data; it never receives your signature image, verification codes or payment details. Documents sent through an assistant follow the same handling and availability rules described in section 6. Information you share in the conversation is also processed by the assistant provider (e.g. Anthropic or OpenAI) under their own privacy policy. We store only hashed access tokens and a log of which tool was called and when (without document content). Access tokens expire after one hour and refresh tokens after 60 days. You can revoke access at any time under Integrations in your dashboard, or by removing the connector in your assistant.

9. International Data Transfers

Your data may be processed in countries outside the European Economic Area (EEA). Where such transfers occur, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, to protect your data in accordance with applicable data protection laws.

10. Data Retention

We retain your account information and signature data for as long as your account is active or as needed to provide the Service. If you request account deletion, we will delete or anonymize your personal data within a reasonable timeframe, except where retention is required by law or for legitimate business purposes (e.g., resolving disputes, enforcing agreements). PDF availability and retention are described in section 6; the expiry of a download link does not mean the PDF is deleted. Communication logs (e.g., email delivery records) are retained for operational and compliance purposes.

Signing evidence (IP address, user-agent, timestamp): Retained for up to 5 years from the date of signing, in line with the Norwegian Bookkeeping Act (Bokføringsloven) and to preserve the evidentiary value of signed documents under eIDAS. We may retain this data longer where necessary to establish, exercise, or defend legal claims (GDPR Article 17(3)(e)).

10a. Signing Evidence and eIDAS

To support the legal validity of electronic signatures under the EU eIDAS Regulation (No. 910/2014), we collect and store the following evidence each time you sign a document: your verified email address, verified mobile number, IP address at the moment of signing, browser/device user-agent string, and a precise timestamp. This evidence is bound to the signature record and included in the immutable PDF audit trail delivered to all parties.

Legal basis: Legitimate interest under GDPR Article 6(1)(f) — specifically, the legitimate interest of all signing parties in being able to prove who signed, when, and from where, in case of later dispute. This interest is recognised by eIDAS itself as a foundation of trusted electronic signatures. We have assessed that this interest is not overridden by the rights of signers, because (a) the data is strictly limited to evidence necessary for the signature, (b) it is not used for marketing, profiling, or any secondary purpose, and (c) the alternative — signing without identity evidence — would undermine the very service signers have asked us to provide.

You may object to this processing under GDPR Article 21, but we may decline to erase signing-evidence data where retention is necessary for the establishment, exercise, or defence of legal claims (Article 17(3)(e)).

11. Your Rights

Under the GDPR and applicable data protection laws, you have the following rights:

Right of access: You may request a copy of the personal data we hold about you.
Right to rectification: You may request correction of inaccurate or incomplete personal data.
Right to erasure: You may request deletion of your personal data, subject to legal retention requirements. You can also delete your account directly from the dashboard (Profile → "Delete my account"); this immediately removes your account, signature, and personal data from our active systems.
Right to restriction: You may request restriction of processing in certain circumstances.
Right to data portability: You may request to receive your data in a structured, commonly used, machine-readable format. You can download a complete JSON export of your data directly from the dashboard (Profile → "Download my data").
Right to object: You may object to processing based on legitimate interests.
Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at support@smoothsign.cc. We will respond within 30 days as required by law.

12. Cookies and Local Storage

SmoothSign uses only strictly necessary client-side storage. We do not use advertising cookies, tracking pixels, or third-party analytics that profile you. Because we rely solely on strictly necessary storage, no cookie consent banner is required under the ePrivacy Directive (Article 5(3)) and GDPR.

Specifically, we use:

Session token (localStorage): Keeps you signed in between visits. Removed when you log out.
Language preference (localStorage): Remembers your chosen interface language.
Onboarding/UI state (localStorage): Tracks completed setup steps so we don't show them again.
Payment provider cookies (Stripe): Set only on the checkout pages by our payment provider for fraud prevention. Governed by Stripe's own privacy policy.

You can clear this storage at any time through your browser settings. Doing so will sign you out and reset your preferences.

13. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete such data promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service with a revised "Last updated" date. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

15. Supervisory Authority

If you believe that our processing of your personal data infringes data protection laws, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) or another competent supervisory authority.

16. Contact

For any questions or concerns regarding this Privacy Policy or our data processing practices, please contact us at support@smoothsign.cc.