California Privacy Notice

1. We do not sell or share your personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising — under any definition in the CCPA, and including in the twelve months before this notice. We have never done so. Because there is nothing to opt out of, we do not operate an opt-out mechanism: a button that appears to switch something off while doing nothing would be worse than the plain statement on this page. If that ever changes, this notice changes first, and the mechanism the law requires will exist before any such use begins.

2. What we collect and why

Categories under Cal. Civ. Code §1798.140, and the purpose of each:

• Identifiers — name, email, and account identifiers, to create your account, authenticate you, and identify signers on an envelope.
• Customer records — billing contact and payment status held by our payment processor, to charge for the Service.
• Commercial information — your plan, your usage of signature quota, and transaction history, to operate billing and quotas.
• Internet and device activity — IP address, device and browser data, and timestamps, recorded as evidence of each signing act and to protect against abuse.
• Geolocation, approximate — inferred from IP address only, as part of that signing evidence. We do not collect precise location.
• Sensitive personal information — an account password (held only as an argon2id hash) and, when a customer enables identity verification, government identifier data supplied by the signer. We use it only to perform the service requested and never to infer characteristics about anyone.
• Content you provide — the documents you upload. We do not read them, and we do not use them to train anything.

3. Where it comes from and who receives it

We collect information directly from you, from your use of the Service, and — when you are a signer — from the customer who sent you a document. We disclose it for business purposes only to the subprocessors listed publicly on our Trust Center: hosting, email delivery, SMS and identity verification, and payment processing. Each is contractually restricted to using it only to perform the service we hired them for.

4. How long we keep it

Account data is kept while the account exists. Signed documents, their evidence dossier, signature records and the audit trail are kept for the retention period stated in our Privacy Policy, because they are the proof the signature exists to provide. Deleting them on request would destroy that proof, including proof relied on by the other party to the transaction.

5. Your rights

As a California resident, you have the right to:

• Know what personal information we collect, use and disclose, and access it in a portable format.
• Delete personal information we hold about you, subject to the exceptions in §1798.105(d) — see section 6.
• Correct inaccurate personal information.
• Limit our use of sensitive personal information. We already limit ours to performing the service, which is the standard the law sets.
• Opt out of sale or sharing. There is nothing to opt out of — see section 1.
• Not be discriminated against for exercising any of these rights. We do not offer financial incentives tied to your data, and your price does not change because you made a request.
• Appeal a decision, if we deny your request. Reply to our decision and a different person will review it.

6. What a deletion request cannot reach

Two limits, both stated plainly so no one is surprised. First, if you signed a document sent by one of our customers, that customer — not Quathos Sign — is the business responsible for your data. We are their service provider, and we will direct your request to them rather than destroy their records on our own initiative. Second, a signed document, its evidence dossier, the signature record and the audit trail are retained even after deletion of other data, under the exceptions that permit retention to complete a transaction and to comply with a legal obligation.

7. How to make a request

Account holders can export and delete their data from within the product. Otherwise, email contact@quathos.com from the address on the account, or state which document or envelope your request concerns. We will confirm receipt within 10 business days and respond within 45 calendar days, extending once by another 45 if needed and telling you why. An authorized agent may act for you with written permission, and we may ask you to verify that you granted it.

8. Contact

Quathos LLC, Dallas, Texas, United States — contact@quathos.com. If you need this notice in an alternative format because of a disability, write to the same address and we will provide one.