Privacy notice
This notice explains how eSora Labs Ltd. handles personal information when you use eSora Sign, eSora PDF and our websites. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Québec's Law 25 where it applies, the EU and UK GDPR for people in those regions, and US state privacy laws such as the CCPA.
On this page · 13 sections
1. Who is responsible
For account, billing and website information, eSora Labs Ltd. is the controller. For the documents and signer details a customer sends through the Service, the customer is the controller and we process that information for them under our Data processing addendum.
Our Privacy Officer can be reached at privacy@esorasign.com or by post at eSora Labs Ltd., Toronto, Ontario, Canada.
2. What we collect
| Who | Information | Where it comes from |
|---|---|---|
| Senders and members | Name, work email, company, role, sign-in events, signature and initials images, preferences | You, your admin, your company sign-in |
| Signers | Name, email, mobile number if codes are sent by text, IP address, device and browser, time of each step, signature, field values, attachments | The sender, and you while signing |
| Signers asked for a photo ID check | The result, the name on the ID, its type and issuing country. The ID images and selfie are collected and kept by Stripe Identity, not by us | Stripe Identity, after you complete its check |
| Billing contacts | Name, billing address, tax number, the last four digits and expiry of the card | You and our payment provider; we never see the full card number |
| Website visitors | Pages viewed, approximate location from IP, device type, and cookie choices | Your browser, only with consent for analytics |
| People who contact us | Name, email, message and anything you attach | You |
| PDF tool users | Files you upload to server tools and AI tools, for the time needed to process them | You |
| Sealed records | A fingerprint (SHA-256) of each sealed record is sent to a timestamp authority. No content or personal information is sent | The Service |
3. Why we use it
- To run the Service: send documents, confirm who is signing, seal documents, produce certificates and keep records.
- To keep the Service and its users secure: detect fraud, abuse and attacks.
- To bill paid plans and meet tax and accounting rules.
- To provide support and tell you about changes to the Service.
- To improve the Service using aggregated usage information. We do not use the content of documents for this.
- To send product news, only if you agree, as Canada's Anti-Spam Legislation requires. You can unsubscribe in any email.
- To send one-time codes by text message, when a sender chooses it. We never use phone numbers for marketing.
Under GDPR, our legal bases are: performing our contract with you, our legitimate interests in running a secure service, complying with the law, and your consent for marketing and optional cookies.
3a. Automated decisions
When a sender asks for a photo ID check, the name on your ID is compared automatically with the name the sender entered. Accents and capital letters are ignored. If the names do not match, you cannot sign until the sender corrects your name and you check again.
You can ask what information was used and how the comparison works, and ask a person to review the result, by writing to privacy@esorasign.com or to the sender. No other decision about you is made by automated means alone.
4. What we never do
- We do not sell personal information or share it for cross-context behavioural advertising.
- We do not use documents or signer information to train AI models.
- We do not read your documents except as described in our Terms of service, section 9.
5. Who we share it with
We share personal information only with: the people in a signing process (for example, other parties see each signer's name, email and the certificate); service providers who help us run the Service, listed on our Sub-processors page and bound by contract; professional advisers; a buyer of our business, under the same protections; and authorities when the law requires. We review government requests and challenge ones that are too broad, as our Government and law enforcement requests policy explains.
6. Where it is stored
We store content in Canada. Some service providers process limited information in other countries, such as the United States. When information leaves Canada, the EU or the UK, we use contracts such as the EU Standard Contractual Clauses and the UK Addendum to protect it.
Before personal information about people in Québec leaves Québec, we assess the privacy risks, as Québec's Law 25 requires.
7. How long we keep it
| Information | How long |
|---|---|
| Completed documents and certificates | While the workspace is open, unless the customer deletes them or a retention rule (Teams and Enterprise) deletes them sooner; then 1 year after the workspace is closed |
| Drafts and cancelled requests | While the workspace is open, unless the customer deletes them or a retention rule deletes them sooner; then 1 year after the workspace is closed |
| Signing evidence (event log, IP, device, phone number, photo ID result) | With the document it belongs to. When a retention rule deletes a document, its evidence summary (names, email addresses, times, IP addresses and file fingerprints, no document content) is kept until the workspace is deleted |
| Photo ID images and selfies | Never stored by us; Stripe Identity keeps them under its own retention policy |
| Mobile numbers and text messages | The number is kept with the document. Twilio keeps delivery records under its own policy. The text of a code is never stored |
| Workspace and member information | While the workspace is open, then 1 year after it is closed |
| Billing records | 7 years, as tax law requires |
| Files uploaded to PDF tools | Deleted as soon as the result is returned to you |
| PDFs shared by link from the PDF tools | Until the link expires (1, 7 or 30 days, as you choose), then deleted |
| Messages to sales and job applications | 2 years, then deleted with any résumé |
| Backups | Up to 35 days |
8. Your rights
- Access: ask for a copy of the personal information we hold about you.
- Correction: ask us to fix information that is wrong.
- Deletion: ask us to delete information, unless we must keep it, for example as evidence of a signature the other parties rely on.
- Portability: get your information in a machine-readable format.
- Objection and restriction: object to processing based on legitimate interests, or ask us to limit it.
- Withdraw consent: for marketing or optional cookies, at any time.
- Review of an automated decision: ask a person to look again at a photo ID name match.
- Opt out of sale or sharing: we do not sell or share, so there is nothing to opt out of; we honour Global Privacy Control signals anyway.
Email privacy@esorasign.com. We reply within 30 days. If a request is about a document someone sent you, we may pass it to that sender, who controls it. We will not treat you differently for using your rights.
If you are not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, your EU or UK data protection authority, or your state attorney general.
9. Security
We encrypt information in transit (TLS 1.2 or later) and at rest (AES-256), limit staff access by role, require multi-factor authentication for staff, log access, test our systems regularly and train our team. If a breach creates a real risk of significant harm, we will tell affected people and the regulators as the law requires.
We keep a register of privacy incidents, as Canadian and Québec law require.
9a. US state privacy disclosures
This table is our notice at collection under the CCPA and similar state laws. We do not sell personal information or share it for cross-context behavioural advertising, and have not done so in the past 12 months.
| Category | Examples | Why |
|---|---|---|
| Identifiers | Name, email, phone number, IP address | To run and secure the Service |
| Commercial information | Plan, invoices, payment history | Billing |
| Internet activity | Signing events, device and browser | Evidence of signing, security |
| Approximate location | Country or region from the IP address | Security, tax |
| Professional information | Company and role | Account administration |
| Sensitive information | Government ID images, processed by Stripe Identity only when a sender asks for a photo ID check | Identity checks; never used to infer characteristics |
Each category is kept as section 7 sets out.
10. Children
The Service is not meant for children, and we do not knowingly collect information from anyone under 16. A parent or guardian may sign on a child's behalf where a document requires it. If you think a child has given us information, write to us and we will delete it.
11. Changes to this notice
We will post changes here and update the date at the top. If a change is significant, we will email account holders before it applies.