Privacy policy

We collect the minimum needed to make the product work:

• Your email (sign-in) and optional display name
• Your business profile (name, address, license, insurance) — used to fill contracts
• Documents you create or upload, plus their audit-trail metadata
• Delivery and access records for documents you send or share (see “Document delivery and access records” below)
• Counterparty contact info you save in your CRM
• Phone numbers you provide for a recipient (yours or a signer's) when you choose to deliver a document by text
• Your phone number and a record of your consent, if you opt in to text messages
• If you turn on two-step sign-in, the setup record for your authenticator app (never the codes themselves)
• Billing details held by Stripe — name, email, and what you bought. Card numbers never reach us
• Support messages you send us, including anything you attach, and how you use our help pages
• Basic usage measurement: which pages get opened and which features get used. No advertising trackers, and no one buys this from us

We do not ask for a Social Security number, a date of birth, or a bank account. If a document you upload happens to contain something like that, it is treated like the rest of the document's content — stored for you, and readable by nobody outside your account.

• We do not sell your data.
• We do not share your data with third parties for advertising.
• We do not use your contracts to train any AI model — ours or anyone else's.
• We do not let one customer see another customer's documents. Every record is walled off to the account that owns it, in the database itself.
• No human at XOsign reads your documents as a matter of course. We open one when you ask us to — a support request you file about it, or a bug we cannot reproduce without it — and we say so when we do.

What we do do, which the rest of this page explains: send document content to our AI providers when a feature needs it, including automatically when you upload a document; keep records of who opened what you sent; and measure how well XOsign reproduces the documents it unlocks.

When you send a document for signature, share it by link, or serve it through a tracked viewer, we record how that copy was delivered and accessed: the time, the network (IP) address and browser information of the person opening it, the approximate location derived from that network address, and — for tracked viewing — which pages were viewed, for how long, and any email address the viewer provides at an access step. These records exist to give the document’s sender a reliable account of who received and opened their document — the same purpose the signature audit trail serves — and they are shown to the sender as part of the document’s activity record. They are kept with the sender’s account and deleted with it.

When you use an AI-assisted feature — Photo-to-Contract, Contract Upgrade, a summary, a translation, a review — the content it needs is sent to one of our two model providers, Anthropic or OpenAI, over an authenticated connection. Which provider handles which feature is a setting we control and it changes as we tune quality and cost; both are listed on our subprocessors page, which records the current split. Under both providers' commercial API terms, your content is not used to train their models. The output is stored in your account and is readable only by your account.

One of these can run without you asking. When you upload a document, XO reads it once and writes down what it found — what kind of document it is, who the parties are, the key dates and amounts — so it is filed and searchable without anyone pressing a button. In XOsign the account owner can turn this off (“Reading new files”, in Settings under Plan & usage); a file uploaded or imported in XOfiles is always read. When you unlock a document, XO reads it in full and makes it an XOdoc, so what you do with it afterwards uses what was written down instead of re-reading the whole file. Summary, Clauses, Risks and Suggest edits come from a deeper read that runs only when you ask for one. We call what these reads write down the document's Brain. It is stored with the document, deleted with it, and it is the reason a document you upload can reach a model even if you never press an AI button. The same no-training terms cover it.

Separately from any AI model training, we check how well XOsign reproduces a page when it unlocks a document, so we can fix it where it gets things wrong. Three things are true about that, and we would rather state all three than the flattering one:

• Nothing here trains a model. No model weights are trained on your documents, by us or by anyone else. This is a quality check on our own unlocking, nothing more.
• The reference documents are our own. The documents we check against are ones processed through XOsign's own team accounts, not from customer accounts.
• Keeping the text of your edits is off unless we switch it on, and we cannot switch it on for you. When someone corrects an unlocked page, the correction is useful evidence — but recording the words involved is turned off for every account by default and stays off unless it is deliberately enabled for that account. There is no setting in the product for this yet, so there is no consent record either. We are telling you that instead of implying a choice you were never offered. If you want to be certain your account is excluded, write to us and we will confirm it in writing.

We keep full copies of the documents used for these checks, and those copies are not linked back to an account — which means we could not find and remove yours on request even if it were there. That is a gap we know about, and it is the reason customer documents are kept out of it.

You can try XOsign without signing up. When you do, we create an anonymous guest account for you behind the scenes and put a sample document in it — that way you are using the real product, not a picture of it. We do not know who you are: there is no email address, no name, and nothing you type is connected to a person.

Guest accounts and everything in them are deleted automatically seven days after they are created. If you decide to sign up, the account stops being a guest at that moment and becomes yours, with the ordinary retention below.

Public demo wizards let you upload a file or paste text to create a preview without creating a document in your account or sending anything for signature. If you choose the sign-up handoff, some workflows keep it in this browser until the matching signed-in wizard claims it or you clear browser data; others use a server-side draft that expires after seven days if it is not claimed.

On paid plans, we keep a register of every copy of a document that leaves XOsign into someone's possession — a download, a print, an emailed attachment, a piece of mail. Each entry records which document, when, by whom, and the network address and browser it went out through, and it gets a short serial number. Viewing a document inside the app is not a copy and is not registered.

On plans that include it, the PDF copy itself also carries that serial number, marked into the file in a way that is not meant to be visible when you read it. It exists for one purpose: if a document turns up somewhere it should not have, its owner can find out which copy it was. It identifies the copy, not the reader, and it carries no personal information.

Free accounts get neither — nothing is registered and nothing is marked.

If the Google Drive connection is available and you choose to connect it, you grant XOsign read-only access to the files your Google account can access. This can include My Drive, files shared with you, and Shared drives. We also read your Google account email to identify the connection. Signing in to XOsign with Google alone does not grant this Drive access.

When you start a scan, XOfiles lists and stores file metadata such as names, identifiers, types, sizes, folder paths, modified dates and content hashes, together with classification results and your keep-or-skip choices. This includes records for files you do not import. To classify supported documents that these details cannot identify, we may download document content and send a limited text excerpt to OpenAI before you approve the final import. Scanning therefore processes some document content before import confirmation.

You review the scan report and choose what to import. Imported documents and their source details are stored in your XOsign account and handled by the document features described above. If you turn on live sync, XOfiles checks for changes about every fifteen minutes and imports new or changed documents that match your saved rules. Recent edits wait for fifteen minutes of quiet. The connection does not edit or delete your files in Google Drive. Deleting a source file in Drive does not delete the copy already stored in XOfiles.

We retain encrypted access and refresh tokens to maintain the connection. Disconnecting stops sync and removes our stored tokens. It does not delete documents already imported, scan records or connection history. You can also revoke XOsign's access in your Google account. Account deletion follows the retention and deletion terms below.

The no-sale, no-advertising and no-model-training commitments above also apply to Google Drive data. Hosting, storage and AI processors handle the data needed to provide these features; see our subprocessors page.

XOsign's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Where the Google Drive or Dropbox file picker is available, you choose the files to import. Those files are stored and processed like other uploads. Using a file picker does not itself establish the ongoing Google Drive connection described above.

You can sign in with an email address and password, or with your Google account. If you use Google, Google tells us your email address and name and nothing else; we never see your Google password.

You can add two-step sign-in with an authenticator app, and the owner of a team can require it of everyone on that team. We store the setup record that lets us check your codes — never the codes.

We record how our help pages and help chat are used — which articles get opened, what people search for, and the conversations held with the help assistant — so we can fix the answers that are not working. Our own staff can read those records, including chat transcripts. Please do not put anything in the help chat you would not want us to read.

Support requests and anything you attach to them are kept with your account so we can follow the thread, and are deleted with it.

Some cookies are needed for the site to work, and they are always on: keeping you signed in, remembering your language, and remembering your cookie choice (for 12 months). When XOsign's own staff or test accounts sign in, one more marks their browser so we never count our own visits.

The rest are optional:

• Analytics. A cookie that remembers which ad, link or audience page brought you here, so the account you create can be credited to it (90 days); our own count of different visitors, a random id that is never linked to your account (13 months); and Google Analytics, when it is switched on.
• Advertising. Meta, LinkedIn and Google Ads tags, when switched on. They tell those platforms when one of our ads led to a sign-up or a purchase.

Where you are sets the starting point. In the European Union and the rest of the EEA, the United Kingdom, Switzerland and Canada, and anywhere we cannot tell, nothing optional runs until you say yes. Elsewhere the optional cookies start on, and you can turn them off. If your browser sends Global Privacy Control, advertising stays off whatever else you choose. None of these ever run on a signing link, and inside your account they never record which pages you open; the only thing they can report from there is that a purchase was completed.

Right now there is nothing to choose: no optional tool beyond the visit-source cookie is switched on. When one is, a banner asks first, and Cookie settings appears at the bottom of every page. Switched on today: none of the tools above. What each one sees is listed on our subprocessors page.

XOsign also keeps small preferences in your browser's own storage — which panel you had open, your zoom level, tips you have dismissed. Those never leave your device and we cannot read them.

Paid plans are billed through Stripe, which handles the payment and holds the card. Card numbers never touch XOsign's systems; we see your billing name and email, what you bought, and whether it succeeded.

What the AI does is paid for in credits, charged per page of document (1 credit a page to read and file or to unlock, 6 for a Deeper read, 3 to translate), so we count the pages read and the credits used against your account and keep a record of what was charged and why. That record is how you can check a bill, so it stays as long as the billing ledger does.

When you choose to deliver a document by text, we send the recipient a transactional SMS — a short notice that a document is waiting and a link to open it. We use Telnyx as our messaging provider to send and receive these texts on our behalf; the phone number and message content are processed by Telnyx solely to deliver the message.

You can also opt in to receive your own account and document notifications by text (signing reminders, completed-signature confirmations, and security codes) by adding your mobile number and checking the SMS opt-in box at sign-up or in Settings. This is optional, and you can opt out anytime by replying STOP. We collect the mobile number you provide and a record of your consent (the time and the disclosure you agreed to) to operate and document this.

• Texts are transactional only — signature requests and document links. We never send marketing texts.
• We do not sell, rent, or share phone numbers with third parties for advertising. Mobile information is not shared with third parties for their marketing purposes.
• You can opt out at any time by replying STOP to any message; reply HELP for help. Message frequency varies; message and data rates may apply.

When you send a document by fax, the document and its cover page go to the fax number you enter through Telnyx, our fax provider, which processes the document and both fax numbers solely to deliver it. We keep a record of each fax (the numbers, the page count and whether it went through) and email you a confirmation with a copy of what was sent.

If your business has its own fax number, faxes sent to it are received by Telnyx, filed in your XOfiles and emailed to the account owner.

Without a number of your own, faxes go out from and can reach you at XOsign's shared fax number. To deliver a fax sent to the shared number, we read its first page with Google Document AI to find your fax code, or match it as a reply to a number only your business faxed recently. A fax we can't match with certainty is never guessed: XOsign staff may open it to find who it is for, and it is deleted after 30 days if nobody claims it. A fax waiting for your account's credits is kept for up to 7 days.

Your documents, uploads, profile and support history are kept until you delete them, or until 30 days after you close your account. Three things outlive the account, because they belong to more people than you: signed PDFs and their audit trails (7 years), notarial journal records where notarization was used (10 years, per Florida §117.245), and the billing ledger (7 years, for tax records). Someone who signed your agreement is entitled to prove what they signed.

Data-export zips are deleted after 24 hours. Server logs are kept for 90 days. Guest demo accounts and everything in them are deleted seven days after they are created. The register of copies that left the system outlives the document it describes, on purpose — a leak is usually investigated after the original is gone — and it holds the copy's serial number, not its contents. Signed counterparties retain their own copies independently, with audit trails intact.

You can take everything with you from Settings → Privacy. One button downloads every record we hold on you as a JSON file straight away; the other emails you a link to a zip holding the same records, your audit timeline, and every file you own — the originals you uploaded and the PDFs. The link works for 24 hours, and you can ask for one full export per day.

Deleting your account is on the same page. You confirm twice — the second step is typing your own email address — and then your account is scheduled for erasure 30 days out, with a banner on every page offering to cancel. After the 30 days, your files and records are erased, subject to the legal retention windows above (signed documents and their audit trails stay, with your personal details stripped out wherever they can be).

For anything outside the self-service surfaces — a specific question, a deletion that needs to happen faster, or a data-portability request our endpoints don't cover — write to us from our contact page, using the address on your account so we can match the request to it. Put “privacy” in the message and it goes straight to the right person.

Questions, exercising your rights, or a complaint: use our contact page, or write to support@xosign.ai and say it is about privacy. The form is the surer route — every message it sends is recorded on our side, so it cannot get lost on the way to a mailbox.