Privacy Policy

This policy explains how SigningKiosk collects, uses and shares personal information through our website, admin dashboard and kiosk pages. It covers two groups: customers (people who create workspaces and build documents) and signers (people who complete a document on a kiosk that a customer runs).

If you are a signer, the organization that runs the kiosk decides what to collect and why. Please also read that organization’s privacy notice.

SigningKiosk is a Canadian company. For account and website information about customers, we are the organization responsible for that information (a controller under the GDPR; accountable under PIPEDA).

For information that signers enter on a kiosk, the customer is the controller (or, under CCPA, the business) and SigningKiosk is its processor (service provider). We handle signer information only to provide the Service to that customer.

Privacy inquiries: privacy@signerkiosk.example. General support: support@signerkiosk.example.

Customer account information: name, email address, workspace and organization name, role, and authentication data such as sign-in times. Passwords are handled by our authentication provider and are not visible to us.

Customer content: the PDF documents you upload, field layouts, kiosk and bundle settings, access rules (IP addresses, ranges and countries you configure), and team members’ names, emails and roles.

Signer information: whatever a document asks for, which can include a full name, email address, free-text answers, checkbox choices, a drawn signature and the date, along with the finished signed PDF.

Technical information about signing: when a signature is submitted we record the signer’s IP address, the country our hosting provider infers from it, the browser’s user-agent string, the time, and which kiosk and document were used.

Website and server logs: standard request logs such as IP address, pages requested and error details, used for security and reliability.

We do not ask signers to create accounts and do not collect payment card details through kiosks. Customers choose what their documents ask for, and may collect more than is described above.

• directly from you, when you register, invite teammates, upload documents or sign;
• automatically, from your device and network when you use the website or a kiosk;
• from customers, who enter signer details into documents or ask signers to do so;
• from our infrastructure providers, such as the country inferred from an IP address.

• to provide the Service: create workspaces, publish kiosks, place entries on PDFs and store signed copies;
• to authenticate users, send invitations and enforce roles and kiosk access rules;
• to secure the Service, prevent abuse and investigate incidents;
• to support customers and respond to requests;
• to maintain and improve the Service and fix errors;
• to meet legal obligations and enforce our terms.

We do not sell personal information, and we do not use signer information for advertising.

Where the GDPR applies to our own use of information, we rely on:

• contract: to provide the Service to customers;
• legitimate interests: security, abuse prevention, product reliability and support, balanced against your rights;
• legal obligation: where the law requires us to keep or disclose information;
• consent: where we ask for it, which you can withdraw.

For signer information, the customer is responsible for its own legal basis.

Customers such as clinics, schools and clubs may use documents that collect health, children’s or other sensitive information. The customer decides whether that is appropriate and is responsible for the laws that apply. SigningKiosk makes no claim that the Service meets HIPAA or any other specific regulatory standard. Please do not include information in free-text fields that a document does not need.

With the customer: signers’ entries and signed PDFs are available to the customer’s workspace members.

With service providers: infrastructure and email providers that process data for us, listed below.

For legal reasons: where required by law, court order or to protect rights, safety and security.

In a business transfer: in a merger, acquisition or sale of assets, with notice where required.

We do not share signer information with other customers. A kiosk never displays previous signers.

We use Amazon Web Services (AWS) to run the Service: Cognito for sign-in and invitation emails, DynamoDB for records, S3 for private storage of PDFs, Lambda and API Gateway for processing and hosting, and CloudFront or similar edge services for delivery. Our website host may also process requests and forward the visitor’s IP address and country to our systems.

We require providers to protect information and use it only for services to us. We will update this list when it changes materially.

We use cookies and browser storage that are necessary to sign you in and keep your session secure. Kiosk pages do not need an account and do not set advertising or cross-site tracking cookies.

We do not currently use third-party analytics or advertising trackers on the website. If that changes, we will update this policy and ask for consent where required.

We keep customer content and signed copies until the customer deletes them or closes the workspace, and for a short period afterwards in backups. Server and security logs are kept for a limited period.

Customers decide how long to retain signed documents. Signers who want a signed copy removed should ask the organization that ran the kiosk. Customers can also contact support@signerkiosk.example for deletion of signed copies or of a workspace.

• PDFs are stored in private storage, not publicly accessible, and separated by workspace;
• every dashboard request is authenticated and checked against the workspace and role;
• kiosk pages can only add signatures and never list or open earlier ones;
• traffic uses HTTPS, and the cloud services we use encrypt stored data at rest by default;
• customers can restrict a kiosk by IP address or country, and kiosks clear themselves after inactivity.

No system is perfectly secure, and we cannot guarantee absolute security.

If we become aware of a breach affecting personal information we handle, we will notify affected customers without undue delay and as the law requires, and give the information they need to meet their own notification duties.

Depending on where you live, you may have rights to access, correct, delete, export or restrict use of your personal information, to object to processing, and to withdraw consent.

If you signed a document on a kiosk, please contact the organization that ran it first, since it controls that information. If you send us a request about signer information, we will pass it to the relevant customer, and will help them respond.

If you are a customer, you can update your details in the dashboard or write to privacy@signerkiosk.example. We may need to verify your identity, and will reply within the time the law requires.

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent, and to complain to your supervisory authority. Our Service is aimed at organizations in Canada and the United States. We do not target people in the EU, EEA or UK, but will honour these rights if the GDPR applies to our processing.

Contact privacy@signerkiosk.example to exercise them.

California residents may request to know, delete or correct personal information, and may opt out of its sale or sharing. We do not sell or share personal information for cross-context behavioural advertising, and we will not discriminate against you for exercising your rights.

For signer information, we act as a service provider to the customer. Please contact that customer, or email privacy@signerkiosk.example and we will forward your request. Other U.S. states give similar rights, which we honour in the same way.

We handle personal information in line with Canada’s Personal Information Protection and Electronic Documents Act and applicable provincial laws. You may ask for access to or correction of your information and may challenge our compliance by contacting privacy@signerkiosk.example. You may also complain to the Office of the Privacy Commissioner of Canada or your provincial regulator.

Information is processed and stored in the cloud region where we host the Service, and may be accessed by us and our providers from Canada and other countries. These countries may have different privacy laws. Where the law requires it, we use appropriate safeguards for transfers.

The Service is not directed to children under 13 (or under 16 where the law sets that age), and we do not knowingly create accounts for them.

A parent or guardian may sign a document that names a child. In that case the customer decides what information about the child to collect and is responsible for doing so lawfully. If you believe a child’s information was collected unlawfully, contact the customer or privacy@signerkiosk.example.

The Service may link to other sites or to documents hosted by customers. We are not responsible for their privacy practices, so please read their notices.

We may update this policy. If the changes are material we will notify customers by email or in the product and update the date above. Continuing to use the Service after that means you accept the updated policy.

Privacy and data requests: privacy@signerkiosk.example

General support: support@signerkiosk.example

If we cannot resolve a concern, you may contact your data protection or privacy regulator, such as the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta.