Privacy Policy
How SignFlow collects, uses, and protects your data — account information, document content, and signature data — and your rights under GDPR and CCPA.
Introduction
LeonAI Ltd. ("we", "us", "our") operates the SignFlow electronic document signing platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.
By using SignFlow, you agree to the collection and use of information in accordance with this policy.
Data We Collect
We collect the following types of information:
Account Information: Names, email addresses, and profile pictures provided through Google OAuth sign-in.
Document Content: Documents uploaded for signing, including PDF files, form field data, and electronic signatures.
Usage Data: IP addresses, browser type, device information, pages visited, and interaction timestamps.
Signature Data: Electronic signatures, signing timestamps, IP addresses of signers, and audit trail information.
How We Use Your Data
We use your information to:
- Provide and maintain the SignFlow signing service
- Process and store electronic signatures
- Generate audit trails for legal compliance
- Send transactional emails (signing requests, completions)
- Improve our service and user experience
- Comply with legal obligations
Infrastructure & Storage
SignFlow is built on Cloudflare's global infrastructure:
- Cloudflare Workers for serverless compute at 300+ edge locations
- Cloudflare D1 (SQLite) for structured data storage
- Cloudflare R2 for document and file storage
- Cloudflare KV for session management
All data is encrypted in transit using TLS 1.3 and encrypted at rest.
Third-Party Services
We share data with the following third-party services:
Cloudflare: Infrastructure provider for hosting, storage, and content delivery.
Google: OAuth authentication provider for user sign-in.
Resend: Email delivery service for sending signing requests and notifications.
We do not sell your personal data to any third party.
Cookies
We use essential cookies for authentication and session management. You can manage your cookie preferences through the cookie settings in our application footer.
Partner referrals: only if you allow Analytics cookies, and only when you arrive through a LeonAI partner link, we store a random click id in the leonai_via cookie (on leonai.io and its subdomains, for up to 90 days) so that your organization's sign-up and purchases are credited to the partner who referred you. It is deleted once your sign-up is recorded. Your sign-in email and purchase amounts are then shared with LeonAI's own partner programme ledger (hosted on Cloudflare) so the partner can be paid; see https://dash.leonai.io/legal/privacy.
For more details, see the cookie categories in our cookie consent dialog.
Data Retention
Documents and signatures: Retained according to your organization's policy settings.
Audit logs: Retained for 90 days.
IP addresses: Anonymized after 30 days.
Account data: Retained until account deletion is requested.
Your Rights
Under GDPR and CCPA, you have the right to:
- Access your personal data
- Correct inaccurate data
- Request deletion of your data
- Export your data in a portable format
- Opt out of marketing communications
- Withdraw consent at any time
To exercise these rights, contact us at care@leonai.io.
Children's Privacy
SignFlow is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date.
Contact Us
If you have questions about this Privacy Policy, please contact us:
Email: care@leonai.io
LeonAI Ltd.