Privacy Policy

1. Introduction

SignLab is a service operated by Blue Net Box Information Technology, a company licensed in Dubai, United Arab Emirates. In this Privacy Policy, "SignLab," "we," "us," and "our" mean Blue Net Box Information Technology. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the SignLab electronic signature platform at signlab.app (the "Service").

This policy applies to all users of the Service, including account holders, document senders, and document signers (even those without a SignLab account). It complies with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL"), the EU General Data Protection Regulation ("GDPR") where applicable, and the UK GDPR.

2. Data We Collect

2.1 Account Holders (Senders)

When you create an account, we collect:

• Full name and email address
• Password (stored as a cryptographic hash — never in plain text)
• Passkeys, if you choose to add one: the passkey's public key, the name you give it, and when it was added and last used (the private key never leaves your device)
• Company name and billing address (for paid plans)
• Payment information (processed and stored by Stripe; SignLab does not store card details)
• IP address and device information at account creation and login

2.2 Document Signers

When someone signs a document through SignLab (even without an account), we collect:

• Full name (as entered at signing)
• Email address (used to send the signing link)
• Signature image (drawn)
• IP address at each signing event
• Browser user agent
• Timestamp of each action (document viewed, signed, declined)
• Device type and operating system

2.3 Documents and Content

• Documents uploaded by account holders for signing
• Completed signed PDF documents including embedded audit trails
• Template content created by account holders
• Custom field data entered at signing
• When you opt in to and invoke SignLab AI Features (such as AI Smart Prepare, AI Document Summary & Check, or Extended AI Legal Review Briefs): transiently extracted plain text from your document, AI-detected field coordinates, structured risk/summary metadata, and human reviewer approval records and comments.

2.4 Usage and Technical Data

• Log data including pages visited, features used, and errors encountered
• Session data and cookies (see Section 9)
• Customer support communications

3. How We Use Your Data

We process personal data under the following legal bases:

3.1 Contract Performance (Art. 6(1)(b) GDPR / UAE PDPL)

• To provide the Service, process documents, and deliver signed PDFs
• To manage your account and process payments
• To send transactional emails (signing invitations, completion notifications, receipts)

3.2 Legitimate Interests (Art. 6(1)(f) GDPR / UAE PDPL)

• To maintain the security and integrity of the Service
• To detect and prevent fraud, abuse, and unauthorised access
• To improve and develop the Service based on aggregated usage patterns
• To send service-related communications to existing customers

3.3 Legal Obligation (Art. 6(1)(c) GDPR / UAE PDPL)

• To comply with applicable law, court orders, or regulatory requirements
• To maintain audit records as required by applicable legislation

3.4 Consent (Art. 6(1)(a) GDPR / UAE PDPL)

• For marketing communications to non-customers (you may withdraw consent at any time)
• For non-essential cookies and analytics (where applicable)

4. Data Sharing and Third Parties

We do not sell your personal data. We share data only as follows:

4.1 Service Providers (Data Sub-Processors)

We engage the following carefully vetted third-party processors who process data solely on our documented instructions:

• Payment Processing — Stripe, Inc. (United States): Processes payment card details, billing addresses, and subscription invoices under PCI-DSS Level 1 compliance.
• AI Document Analysis (Opt-In SignLab AI Features Only) — OpenAI, L.L.C. (United States): When a Customer explicitly invokes an AI feature (AI Smart Prepare, AI Document Summary & Check, or Extended AI Legal Review Brief), transiently extracted document text wrapped in an isolated <untrusted_document> sandbox is transmitted over TLS 1.3 to the OpenAI Enterprise/Platform API with store: false (Zero Data Retention). OpenAI does not store the document text after generating the structured JSON response and never uses Customer Data to train or improve AI models. If you do not invoke SignLab AI Features on a document, zero document text is transmitted to OpenAI.
• Document & File Object Storage — Backblaze, Inc. (EU/EEA by default; US available on request): Stores AES-256 encrypted PDF documents and signature assets in region-pinned buckets (Amsterdam, Netherlands EU region by default).
• Application Hosting Infrastructure — Hetzner Online GmbH (Finland / Germany, EEA): Provides dedicated European cloud server infrastructure, isolated local PDF text extraction (poppler-utils in a network-isolated --no-env process), and temporary encrypted storage for EU-region signed documents until object-storage upload is verified.
• Content Delivery, DNS & WAF Security — Cloudflare, Inc. (Global Edge Network / US-incorporated): Proxies web traffic, terminates TLS 1.3, mitigates DDoS/bot attacks, and processes connection metadata (such as IP addresses).
• Transactional Email Delivery (EEA Processing Region): Delivers signature invitations, reminders, 2FA verification codes, and completion certificates to the email addresses you supply.

Full sub-processor details and international transfer mechanisms are published in Schedule 2 of our Data Processing Agreement (DPA).

4.2 Legal Disclosure

We may disclose personal data to law enforcement, courts, or regulatory authorities if required by applicable law or a valid legal order. Where permitted, we will notify affected users before disclosing their data.

4.3 Business Transfers

If SignLab is acquired, merged, or undergoes a change of control, personal data may be transferred to the successor entity subject to the same or equivalent privacy protections.

5. International Data Transfers

SignLab is based in the UAE. If you are located in the EU, EEA, or UK, your personal data may be transferred to and processed in countries that do not have an equivalent level of data protection. We ensure appropriate safeguards are in place including:

• Standard Contractual Clauses (SCCs) approved by the European Commission for transfers to US-incorporated processors such as Stripe
• Binding data processing agreements with all third-party processors

By default, SignLab stores documents and uploaded files in the European Economic Area (EEA), so documents belonging to EU/EEA customers remain within the EEA. US-based storage is available on request for customers who prefer it. Our storage provider is US-incorporated, so SCCs remain in place with it as a safeguard. If data residency in a specific region is a requirement for your use case, please contact us before using the Service.

Cross-Border Transfers for Opt-In AI Features (UAE PDPL Arts. 22–23 & GDPR Chapter V): While primary document storage remains pinned to the EEA by default, invoking an optional SignLab AI Feature transmits sanitized document text to OpenAI, L.L.C. in the United States for real-time inference only (with store: false Zero Data Retention). These transfers are governed by European Commission Standard Contractual Clauses (SCCs, Module 2/3) and UAE Federal Decree-Law No. 45 of 2021 (UAE PDPL) cross-border safeguard provisions. Customers who require zero cross-border AI inference may disable SignLab AI Features at the company account level.

6. Data Retention

Temporary encrypted copies of EU-region signed documents are removed from the application server once their upload to object storage is verified. This normally takes about one minute plus upload time; during an outage, a pending copy is retained until upload succeeds or the document is deleted.

We retain personal data only for as long as necessary for the purposes set out in this policy:

• Account data: Retained for the life of your account plus 90 days following account closure
• Signed documents and audit trails: Retained for the duration of your subscription plus 30 days after cancellation
• Signer data (non-account holders): Retained as part of the signed document and audit trail for the document's full retention period
• Payment records: Retained for 7 years as required by UAE financial regulations
• Support communications: Retained for 3 years
• Backup copies: residual copies of deleted documents and files may persist in encrypted, access-restricted off-site backups for up to 92 days after deletion, after which they are purged

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

7.1 Right of Access

You may request a copy of the personal data we hold about you.

7.2 Right to Rectification

You may request correction of inaccurate or incomplete personal data.

7.3 Right to Erasure

You may request deletion of your personal data subject to our legal obligations and the note above regarding signed documents.

7.4 Right to Restriction

You may request that we restrict processing of your personal data in certain circumstances.

7.5 Right to Data Portability

You may request a machine-readable export of personal data you have provided to us.

7.6 Right to Object

You may object to processing of your personal data based on legitimate interests or for direct marketing purposes.

7.7 Right to Withdraw Consent

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

7.8 Exercising Your Rights

Submit requests to privacy@signlab.app. We will respond within 30 days. We may require identity verification before processing requests.

8. Security

SignLab implements appropriate technical and organisational measures to protect personal data including:

• AES-256 encryption for data at rest
• TLS 1.3 encryption for data in transit
• Access controls limiting staff access to personal data
• Regular security assessments and monitoring
• Incident response procedures with GDPR-compliant breach notification (72-hour notification to supervisory authorities where required)

In the event of a personal data breach, we will notify affected users and relevant authorities as required by applicable law.

9. Cookies

SignLab uses strictly necessary cookies required for the operation of the Service (session management, security tokens). We do not use third-party advertising or tracking cookies without your explicit consent. A full cookie notice is available at signlab.app/cookies.

10. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has provided personal data, we will delete it promptly. If you believe a minor has used our Service, contact privacy@signlab.app.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or in-app notification no less than 30 days before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

12. Contact and Complaints

For privacy-related queries, requests, or complaints: