Privacy Policy

Last updated: October 10, 2026

1. Data Controller

eContract.online ("Company", "we", "us", or "our") is the data controller for the eContract platform. We are committed to protecting your privacy and handling your data in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and the Singapore Personal Data Protection Act (PDPA).

2. Data We Collect

Account Information

Name, email address, password (hashed), and organization name. We do not collect payment card details.

Contract Content

Documents you upload, signature data, signer information, and contract metadata.

Usage Data

Log data, IP addresses, browser type, pages visited, and feature usage statistics.

Cookies

Essential cookies for authentication and session management. We do not use tracking or advertising cookies.

3. How We Use Your Data

  • Service Delivery: To provide, maintain, and improve the eContract platform
  • Authentication: To verify your identity and secure your account
  • Communication: To send service-related notifications, security alerts, and support responses
  • Analytics: To understand usage patterns and improve the Service (aggregated, non-personal data)
  • Security: To detect and prevent fraud, abuse, and security incidents
  • Legal Compliance: To comply with applicable laws and regulations

4. Data Storage & Security

We implement industry-standard security measures to protect your data:

  • Documents are kept in access-controlled storage; only your workspace and the signers you invite can open them
  • HTTPS (TLS) encryption for data in transit
  • Private signing keys are stored encrypted and are only used by the signing service
  • X.509 digital certificates for signing operations
  • Regular security reviews of the code and infrastructure
  • Multi-tenant isolation — each workspace’s data is logically separated

5. Third-Party Services

We share data with the following third-party services only as necessary to operate the Service:

  • Email Service Providers: For transactional emails (e.g., signing invitations, account notifications)
  • Cloud Infrastructure: For hosting and data storage
  • AI provider (Google Gemini): When you use the AI assistant, the document or text you choose is sent to Google's Gemini API to produce suggestions. Contracts are not sent unless you use an AI feature

We do not sell your personal data to any third party.

6. Data Retention

  • Active accounts: Data is retained for as long as your account is active
  • Cancelled accounts: Data is retained for 30 days after cancellation, then permanently deleted
  • Signed contracts: Retained according to your workspace settings or applicable legal requirements
  • Usage logs: Retained for up to 12 months for security and analytics purposes

7. Your Rights (GDPR & PDPA)

You have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you
  • Rectification: Request correction of inaccurate or incomplete data
  • Deletion: Request deletion of your personal data ("right to be forgotten")
  • Portability: Request your data in a structured, machine-readable format
  • Restriction: Request restriction of processing in certain circumstances
  • Objection: Object to processing based on legitimate interests
  • Withdraw Consent: Where processing is based on consent, you may withdraw it at any time

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

8. International Data Transfers

Your data may be processed in countries outside your country of residence. Where we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

9. Children’s Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email at least 30 days before the changes take effect. The updated policy will be posted on this page with a revised "Last updated" date.

11. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us at [email protected].