Privacy Policy

English

SignLucid Privacy Policy

Effective date: October 15, 2026 · Version 2026-10-15.5

This policy explains how SignLucid ("SignLucid", "we") handles personal information.

1. Two roles

• Our own information. For our website and for the accounts of firms and their team members who use SignLucid, we decide how information is used. This policy covers that information directly.
• Information we handle for firms. When a firm (for example, a CPA or tax practice) sends a document through SignLucid, the document and the information about signers in it belong to that firm. We handle it on the firm's behalf and under its instructions, as described in our Terms of Service and Data Processing and Tax Return Information Addendum. If you are a signer, the firm that sent you the document is responsible for it; please contact them first. We will pass your request on to them.

2. What we collect

Firm accounts: firm name, user names, e-mail addresses, password (stored only as a salted scrypt hash), language preference, plan and billing status. Payments are made through PayPal (including Venmo), Zelle through the banks involved, or by check; once card payments launch, card details are handled by our payment processor Stripe. We do not store full card or bank account numbers; for checks, we keep only what our bookkeeping requires. Documents and signing (on the firm's behalf): uploaded PDFs; signer names, e-mail addresses and phone numbers; access codes; field values; signature and initials images; consent, opening, signing, declining and other event times; IP address and device/browser information; the signed copy and its certificate of completion; optional AI summaries; and, when identity verification is used, the verification result (not the questions or your answers). Remembered layouts: the printed words of a form page and where fields were placed. Client names are removed in the browser before anything is stored. Website and security logs: IP address, browser, pages requested and time, used to run and secure the Service. Cookies and similar: one sign-in cookie for the sender application, and your language choice saved in your browser. We do not use advertising or cross-site tracking cookies, and we do not currently use third-party analytics. Invoices and payments (on the firm's behalf): invoices a firm creates for its clients (client name and contact details, services, amounts and due dates), the firm's payment instructions, invoice approvals and signatures, and the screenshots or receipts clients upload to show they paid. Messages: what you send us when you contact support.

3. How we use it

• To provide the Service: send signing requests and notices, show documents, record signatures, and produce the signed copy and certificate.
• To keep the Service secure: prevent abuse, investigate incidents, and limit repeated sign-in or access-code attempts.
• To support firms and communicate with account users about the Service, billing and changes. We may send product news to firm account users, who can opt out at any time.
• To meet legal obligations.
• AI summaries: only when a firm turns them on, the document is sent to our AI provider to create a plain-language summary for signers. Our AI provider, Anthropic, is prohibited by its commercial terms from training models on this content, and under its standard policy deletes API inputs and outputs within 30 days (longer only if its safety systems flag a policy violation).

We do not sell personal information, share it for cross-context behavioral advertising, use documents or signer information to market to signers, or use them to train AI models.

4. Tax return information

Documents sent by tax preparers may contain tax return information protected by 26 U.S.C. §7216. We use and disclose it only to provide the Service to the firm that sent it, as permitted by the Treasury regulations under §7216, and as described in our Addendum.

5. When we share information

• Service providers that help us run SignLucid (hosting, e-mail delivery, payment processing, and, when a firm turns them on, identity verification and AI summaries), under contracts that limit their use of the information. The current list is at signlucid.com/dpa.
• The firm and other signers of the same envelope see the information that is part of that envelope (for example, each signer's name and status, and the certificate of completion).
• Legal reasons: to comply with law or valid legal process, or to protect the rights, safety and security of our users, the public or SignLucid. Where allowed, we will tell the affected firm first.
• Business transfer: if SignLucid is reorganized or sold, information may transfer to the successor, which must honor this policy and the §7216 limits.

6. How long we keep it

• Completed envelopes (signed copy, certificate and audit records): while the firm's account is active; after the account ends, as described in our Terms of Service (30 days to export, then deletion).
• Envelopes that were never completed: while the firm's account is active, unless the firm deletes them sooner.
• Invoices and payment proofs: while the firm's account is active, like completed envelopes.
• Public demo documents: one day.
• Security logs: up to 90 days, except entries included in a certificate of completion, which stay with that envelope.
• Account information: while the account is active and up to 90 days after it ends; billing records as required by tax law.
• Encrypted backups: daily copies kept for up to 90 days and one monthly copy kept for up to 12 months, then deleted. Backups are used only to recover from data loss.

7. Security

We protect information with encryption in transit (HTTPS), hashed passwords, private random signing links, optional access codes, limits on repeated attempts, access controls for our staff, and encrypted backups. No system is perfectly secure. If we confirm a breach affecting your information, we will notify the firm involved and, where required by law, you or the authorities.

8. Your choices

Firm users can update account information in Settings and close their account. Signers can decline to sign electronically and ask the sending firm for a paper copy. To ask about information we hold, e-mail support@signlucid.com.

9. State privacy rights

Depending on where you live, and where those laws apply to us, you may have the right to know, access, correct or delete personal information, and to appeal a decision about your request. For information we hold for a firm, we will refer your request to that firm. We will not discriminate against you for using these rights. We verify requests before acting on them.

10. Children

SignLucid is for businesses. We do not knowingly collect information from children under 13. A firm may send a document naming a minor (for example, a dependent on a tax form); that information is handled for the firm as described above.

11. Where information is stored

We store information in the United States.

12. Changes

We will post changes here with a new effective date, and notify account users by e-mail of material changes.

13. Contact

support@signlucid.com

---

中文译本

中文译本仅供参考；与英文版不一致时，以英文版为准。

SignLucid 隐私政策

生效日期：2026 年 10 月 15 日 · 版本 2026-10-15.5

本政策说明 SignLucid（“SignLucid”“我们”）如何处理个人信息。

1. 两种身份

• 我们自己的信息。 对我们的网站，以及使用 SignLucid 的事务所和其成员的账户，由我们决定信息如何使用，本政策直接适用。
• 代事务所处理的信息。 事务所（例如 CPA 或报税事务所）通过 SignLucid 发送文件时，文件及其中签署人的信息属于该事务所。我们按服务条款和《数据处理与报税资料保密附件》，代事务所并按其指示处理。如果您是签署人，发文件给您的事务所对这些信息负责，请先联系他们；我们也会把您的请求转给他们。

2. 我们收集什么

事务所账户： 事务所名称、用户姓名、邮箱、密码（只保存加盐的 scrypt 哈希）、语言偏好、套餐和付费状态。付款通过 PayPal（含 Venmo）、银行的 Zelle 或支票完成；信用卡付款上线后，卡片信息由收款服务商 Stripe 处理。我们不保存完整的卡号或银行账号；支票只保留记账需要的信息。 文件和签署（代事务所）： 上传的 PDF；签署人姓名、邮箱、手机号；访问码；填写内容；签名和首字母图像；同意、打开、签署、拒签等事件的时间；IP 地址和设备 / 浏览器信息；签署副本和完成证书；可选的 AI 摘要；使用身份验证时的验证结果（不含题目和您的答案）。 记住的布局： 表格页面上的印刷文字和签名框位置。客户姓名在浏览器里就被去掉，不会保存。 网站和安全日志： IP 地址、浏览器、访问的页面和时间，用于运行和保护本服务。 Cookie 等： 发件人系统的一个登录 Cookie，以及保存在您浏览器里的语言选择。我们不使用广告或跨站追踪 Cookie，目前也不使用第三方统计工具。 账单和付款（代事务所）： 事务所给其客户开的账单（客户姓名和联系方式、服务、金额、到期日）、事务所的付款方式、对账单的确认和签名，以及客户上传的付款截图或收据。 往来消息： 您联系客服时发给我们的内容。

3. 我们怎么用

• 提供本服务：发送签署请求和通知、显示文件、记录签名、生成签署副本和完成证书。
• 保护本服务：防止滥用、调查安全事件、限制反复尝试登录或访问码。
• 支持事务所，并就本服务、账单和变更与账户用户沟通。我们可能向事务所账户用户发送产品消息，可以随时退订。
• 履行法律义务。
• AI 摘要：只有事务所开启后，文件才会发给我们的 AI 服务商，为签署人生成通俗摘要。我们的 AI 服务商 Anthropic 按其商业条款不得用这些内容训练模型，并按其标准政策在 30 天内删除 API 输入和输出（只有被其安全系统标记违规时保留更久）。

我们不出售个人信息，不为跨情境行为广告分享个人信息，不用文件或签署人信息向签署人推销，也不用它们训练 AI 模型。

4. 报税资料

报税人发送的文件可能包含受 26 U.S.C. §7216 保护的报税资料。我们只为向发送文件的事务所提供本服务，在 §7216 财政部法规允许的范围内、按附件的约定使用和披露。

5. 什么情况下会共享

• 服务商：帮助我们运行 SignLucid 的服务商（托管、邮件发送、收费，以及事务所开启后的身份验证和 AI 摘要），合同限制其使用范围。现行名单见 signlucid.com/dpa。
• 事务所和同一信封的其他签署人：能看到属于该信封的信息（例如每位签署人的姓名和状态、完成证书）。
• 法律原因：为遵守法律或有效的法律程序，或保护用户、公众或 SignLucid 的权利和安全。在允许的情况下，我们会先告知相关事务所。
• 业务转让：如 SignLucid 重组或被收购，信息可能转给承继方，承继方必须遵守本政策和 §7216 的限制。

6. 保存多久

• 已完成的信封（签署副本、完成证书和审计记录）：账户有效期间保存；账户终止后按服务条款处理（30 天导出，然后删除）。
• 未完成的信封：账户有效期间保存，事务所提前删除的除外。
• 账单和付款凭证：账户有效期间保存，和已完成的信封一样。
• 公开演示文件：一天。
• 安全日志：最多 90 天；写进完成证书的记录随信封保存。
• 账户信息：账户有效期间及终止后最多 90 天；账单记录按税法要求保存。
• 加密备份：每日备份最多保留 90 天，每月一份最多保留 12 个月，到期删除。备份只用于数据丢失后的恢复。

7. 安全

我们用传输加密（HTTPS）、密码哈希、随机私人签署链接、可选访问码、限制反复尝试、员工访问控制和加密备份保护信息。没有绝对安全的系统。如确认发生影响您信息的泄露，我们会通知相关事务所，并在法律要求时通知您或有关机关。

8. 您的选择

事务所用户可以在“设置”里更新账户信息、关闭账户。签署人可以不以电子方式签署，并向发件事务所索取纸质副本。查询我们持有的信息，请发邮件到 support@signlucid.com。

9. 州隐私法权利

视您所在的州，以及这些法律是否适用于我们，您可能有权了解、访问、更正或删除个人信息，并对我们的处理结果提出申诉。对代事务所持有的信息，我们会把请求转给该事务所。您行使这些权利不会受到歧视。我们会先核实请求再处理。

10. 儿童

SignLucid 面向企业，我们不会有意收集 13 岁以下儿童的信息。事务所发送的文件可能写有未成年人（例如报税表上的受抚养人），这些信息按上述方式代事务所处理。

11. 存储地点

信息存储在美国。

12. 变更

变更会发布在这里并更新生效日期；重大变更会通过邮件通知账户用户。

13. 联系方式

support@signlucid.com