Privacy policy

Last updated: 14 September 2026

SignPal is a service for sending and signing agreements electronically. It is operated by Nod88 Ltd, a company registered in England and Wales (company number 17381626) with its registered office at 30 High Street, Chepstow, Wales, NP16 5LJ.

This policy explains what we do with personal data. It is written for two kinds of reader, and the parts that apply to you depend on which you are.

If you have been asked to sign something, you are here because a business used SignPal to send you an agreement. That business decides what the agreement says, who it goes to and what happens to it afterwards. We handle the data on their instructions. Section 2 is the part written for you.

If you use SignPal to send agreements, we handle your account data in our own right, and we handle your customers' data on your behalf. Sections 1 and 3 are written for you.

If you would rather not read all of this: we do not sell data, we do not advertise, we do not track you across the internet, and we keep signed documents for twelve months and the record of who signed them for three years.

1. Who is responsible for what

Data protection law distinguishes between the organisation that decides why data is processed, called the controller, and the organisation that processes it on their instructions, called the processor.

We are the controller for the personal data of people who hold a SignPal account: names, email addresses, sign-in records and billing information.

We are the processor for everything inside an agreement. The business sending it decides who receives it, what it contains and what it is for. If you have been asked to sign something and you want to know why, or you want something changed or removed, the business that sent it is the right place to ask. Their details are in the email you received. We will help them, and we will pass on any request you send us directly.

2. If you have been asked to sign an agreement

What we hold about you

Only what the sender gave us and what you did with it:

• Your name and email address, supplied by the sender
• Anything you typed into the agreement
• Your signature or initials, as you drew or typed them
• The date and time you opened the link and signed
• The IP address and browser you used at the moment you signed

That last item exists for one reason. If a signature is ever disputed, the record of when and from where it was made is the evidence that it happened. It is recorded on the signing certificate, which goes to the business that sent you the agreement.

What we do with it

We use it to show you the agreement, record your signature, produce the signed document and send you a copy. Nothing else. We do not use it to advertise to you, we do not build a profile of you, and we do not sell it to anybody.

You do not need an account

Signing does not create one, and we do not ask you to make one.

How long we keep it

The signed document is kept for twelve months, after which we delete our copy. The business that sent it keeps their own copy for as long as their own rules require, and you were sent a copy by email that is yours to keep.

The record of who signed and when is kept for three years. It is small, it is the only copy in existence, and it is the thing that proves the signature was made if anyone ever asks.

What you can ask for

You have the right to see what we hold about you, to have mistakes corrected, to object to what we are doing with it, and in some cases to have it deleted.

Because we are handling it for the business that sent you the agreement, the quickest route is usually to ask them. If you would rather ask us, write to privacy@signpal.co.uk and we will deal with it, working with them where we need to.

One limit worth stating plainly: once an agreement has been signed by everyone, we cannot alter it. That is the point of it. We can delete a record in some circumstances, but we cannot change what a signed document says.

If you were not expecting the email

Do not sign it. Reply to the person who sent it, or tell us at fraud@signpal.co.uk and we will look into it.

3. If you use SignPal to send agreements

What we hold about you

• Your name, email address and the company you belong to
• When you last signed in
• What you did in the product: agreements created, sent, voided, completed
• Your billing records, if you have bought credits

What we do with it

We use it to run your account, to show you your own activity, to bill you, and to email you about agreements you have sent. We will also email you about the service itself where it matters: a change to these terms, a security issue, or something that affects your account.

How long we keep it

For as long as you have an account, and for twelve months afterwards. Billing records are kept for six years, because tax law requires it.

If you stop using SignPal, the agreements you sent follow the same rule as everything else: documents for twelve months, the record of who signed for three years. Download anything you need before you go.

Your obligations

When you send an agreement through SignPal you are the controller of the data in it. That means it is your job to have a lawful reason for sending it, to tell the recipient what you are doing with their data, and to answer their questions about it. We will help you where we can.

4. Who else touches the data

We use a small number of other companies to run the service. Each of them processes data only on our instructions, and each is bound by a contract that requires it.

We will send you the current list, and what each one does, on request. Ask us at privacy@signpal.co.uk. If we add a new one we will tell our customers before it starts handling anything.

Data is held in the United Kingdom. Some of our suppliers are based outside the UK, and where data reaches them it is protected by the safeguards the law requires. The list says which.

5. Cookies

The SignPal website sets two cookies, both of them technical: one from our hosting provider that tells legitimate visitors apart from automated traffic, and one that routes your request to the right version of the site. Neither identifies you, neither is shared, and neither lasts more than a day.

We use no analytics, no advertising and no tracking of any kind, on the website or in our emails. There is nothing to consent to, which is why we do not ask.

If you sign in, we store a session so you stay signed in. That is necessary for the service to work.

6. Security

Data is encrypted in transit and at rest. Access to production systems is limited to those who need it. Signed documents are held in private storage and reached only through links that expire.

A signed document is sealed when it is completed, so that any later change to it would be detectable. That is a property of the document, not a promise about our systems, and it is what makes the signed copy worth having.

7. Complaints

If you are unhappy with how we have handled your data, tell us first at privacy@signpal.co.uk and we will try to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk or on 0303 123 1113.

8. Changes to this policy

If we change it in a way that matters, we will say so on the website and, for account holders, by email. The date at the top tells you when it last changed.

Contact

Nod88 Ltd 30 High Street, Chepstow, Wales, NP16 5LJ Company number 17381626

Data protection: privacy@signpal.co.uk Suspected fraud: fraud@signpal.co.uk