Privacy policy

We collect the minimum needed to make the product work:

• Your email (sign-in) and optional display name
• Your business profile (name, address, license, insurance) — used to fill contracts
• Documents you create or upload, plus their audit-trail metadata
• Counterparty contact info you save in your CRM
• Phone numbers you provide for a recipient (yours or a signer's) when you choose to deliver a document by text
• Basic analytics: page views, feature usage (no third-party trackers)

• We do not sell your data.
• We do not share your data with third parties for advertising.
• We do not use your contracts to train any AI model.
• We do not read your contracts except as part of fulfilling the AI features you explicitly invoke.

When you use Photo-to-Contract, Contract Upgrade, or any other AI-assisted feature, document content is sent to Anthropic (our model provider) over an authenticated API call. Per Anthropic's commercial terms, your content is not used to train their models. The output is stored in your account, gated by RLS to your account only. We will update this section if our provider list changes.

When you choose to deliver a document by text, we send the recipient a transactional SMS — a short notice that a document is waiting and a link to open it. We use Telnyx as our messaging provider to send and receive these texts on our behalf; the phone number and message content are processed by Telnyx solely to deliver the message.

You can also opt in to receive your own account and document notifications by text (signing reminders, completed-signature confirmations, and security codes) by adding your mobile number and checking the SMS opt-in box at sign-up or in Settings. This is optional, and you can opt out anytime by replying STOP. We collect the mobile number you provide and a record of your consent (the time and the disclosure you agreed to) to operate and document this.

• Texts are transactional only — signature requests and document links. We never send marketing texts.
• We do not sell, rent, or share phone numbers with third parties for advertising. Mobile information is not shared with third parties for their marketing purposes.
• You can opt out at any time by replying STOP to any message; reply HELP for help. Message frequency varies; message and data rates may apply.

Audit-trail records are retained for the life of the account for legal-record purposes. Other records persist until you delete the account, at which point a 30-day grace period precedes full erasure (you can cancel during the grace). Signed counterparties retain their copies independently, with audit trails intact.

You can export every document and audit log from Settings → Account as a JSON download. Account deletion is one click away on the same page and fully erases your records after the 30-day grace period, subject to legal retention obligations (e.g. completed signed documents retained for audit-trail integrity by the counterparties who received them).

For anything outside the self-service surfaces — a specific question, a deletion that needs to happen faster, or a data-portability request our endpoints don't cover — email privacy@xosign.ai from the address on your account.

Questions, exercising rights, or complaints: privacy@xosign.ai.