Privacy Policy

1. About EzSignoff

EzSignoff is an early-stage electronic signature service based in Calgary, Alberta, Canada. EzSignoff is not currently incorporated.

This Privacy Policy explains how EzSignoff collects, uses, discloses, stores, protects, retains, and deletes personal information when people use the EzSignoff website, application, document-signing pages, and related services.

EzSignoff handles personal information in accordance with applicable Canadian privacy laws, including Alberta’s Personal Information Protection Act when it applies.

2. Information EzSignoff collects

Account information

EzSignoff user accounts are currently created by invitation. When an account is created, EzSignoff may collect name, email address, password in securely hashed form, account and access information, and communications sent to EzSignoff for support or administration.

EzSignoff does not need or intend to store a readable copy of a user’s password.

Signer information

A person invited to sign a document does not need to create an EzSignoff account. When a person reviews or signs a document, EzSignoff may collect name, email address, typed or hand-drawn signature, IP address, date and time information, and document and signing activity.

EzSignoff does not currently collect browser or device details as part of the signing record.

Document information

EzSignoff accepts PDF documents up to 20 MB. The service may temporarily store the original uploaded PDF, the completed or signed PDF, document names and status information, signer details, signing and audit records, and document hashes and digital-signature information.

Original and completed PDFs may both be retained for up to 30 days unless deleted earlier or retained longer where reasonably necessary for security, legal, dispute-resolution, or operational purposes.

Website, application, and cookie information

EzSignoff uses cookies and similar technologies for authentication and session management, security, user preferences, application operation, and analytics and service measurement.

EzSignoff currently uses Google Analytics and Statcounter across the application. These providers may collect technical and usage information through cookies or similar technologies. A cookie notice and consent tool is provided.

EzSignoff avoids including confidential document names, document contents, signatures, signer email addresses, or other sensitive signing details in analytics events or page addresses.

3. How EzSignoff uses information

EzSignoff may use personal information to create and manage invited accounts; authenticate users and protect account access; accept and process PDF documents; send signing invitations; allow recipients to review and sign documents; create completed documents and signing records; record relevant document activity; provide documents to authorized users and signers; respond to support requests; maintain, troubleshoot, and improve the service; detect, prevent, and investigate abuse, fraud, malware, and security incidents; maintain backups and operational logs; comply with applicable legal obligations; and establish, exercise, or defend legal rights.

EzSignoff limits the collection, use, and disclosure of personal information to purposes that are reasonable for operating and protecting the service.

4. Documents, signatures, and customer responsibility

Users may upload documents containing personal information about signers and other individuals. The user or organization uploading a document is responsible for ensuring that the document may lawfully be uploaded to EzSignoff; that the recipient’s information may lawfully be provided to EzSignoff; that the document is sent to the correct recipient; that any required notice or consent has been obtained; that the document is appropriate for electronic signing; and that the user has authority to request the signature.

EzSignoff provides document-signing and record-keeping technology. EzSignoff does not provide legal advice and does not determine whether a particular document, transaction, signature, board action, policy, or agreement is legally valid or suitable for electronic signing.

5. Audit trail and signing records

EzSignoff may create an audit record containing events and information such as document uploaded, signing invitation sent, document opened, document signed, document completed, document downloaded, signer name, signer email address, IP address, and event timestamps.

The audit record is intended to document activity within EzSignoff. It does not independently verify a person’s identity unless EzSignoff explicitly provides a separate identity-verification feature.

Audit records may be deleted by an authorized user using available product features. Deleting an audit record or document may affect the user’s ability to establish what occurred during the signing process.

6. Tamper-evident documents

EzSignoff may use PAdES-compatible PDF digital-signature technology and SHA-256 document hashing to help make later changes to a completed document detectable.

Tamper-evident technology does not guarantee that a document is legally enforceable, that the signer is the person claimed, or that every PDF reader will display validation information in the same way.

7. When EzSignoff shares information

EzSignoff does not sell personal information. EzSignoff may disclose personal information to the people and organizations involved in a signing transaction; to service providers that help operate the website and application; when a user directs or authorizes EzSignoff to disclose it; when required or permitted by law; when reasonably necessary to investigate misuse, fraud, malware, or a security incident; to protect the rights, safety, property, and integrity of EzSignoff, its users, and others; and in connection with a future financing, sale, merger, reorganization, or transfer of the service, subject to applicable privacy requirements.

Service providers receive information only as reasonably necessary to perform their services and are expected to handle it under applicable contractual, confidentiality, security, and privacy obligations.

8. Service providers

EzSignoff currently relies on third-party providers that include:

• Cloudflare — network, content-delivery, domain, and security services
• DigitalOcean — application hosting, database infrastructure, document storage, and backups
• Mailjet — transactional email delivery
• Google Analytics — website analytics
• Statcounter — website analytics

EzSignoff may replace, remove, or add providers as the service develops. This policy will be updated when a change materially affects how personal information is handled.

Provider privacy information: Cloudflare, DigitalOcean, Mailjet, Google, Statcounter.

Third-party privacy policies describe each provider’s own practices. EzSignoff remains responsible for selecting providers and configuring the service in a manner appropriate to the information being processed.

9. Storage and processing outside Canada

EzSignoff is based in Calgary, Alberta, Canada. However, its current application hosting, database, document storage, audit records, logs, and backups are located in the United States through DigitalOcean and other service providers.

Cloudflare, Mailjet, Google, Statcounter, and other providers may also process information in jurisdictions outside Canada.

Personal information processed outside Canada may be subject to the laws of the jurisdiction where it is stored or processed and may be accessible to courts, law-enforcement bodies, or government authorities in that jurisdiction under applicable law.

Questions about EzSignoff’s use of service providers outside Canada may be sent to the Privacy Officer using the contact information below.

10. Security

EzSignoff uses administrative and technical safeguards intended to protect personal information against unauthorized access, use, disclosure, alteration, loss, and destruction. Current safeguards include HTTPS and TLS for information transmitted between users and the service; password hashing; firewall protections; rate limiting; access controls; automated backups; security logging; malware scanning; multi-factor authentication for administrator access; and development and security practices informed by common web-application risks, including the OWASP Top 10.

Authorized EzSignoff administrators may access customer documents when reasonably necessary to provide customer or technical support; investigate security or operational issues; maintain, repair, or protect the service; and respond to a valid legal requirement.

No Internet-based service can guarantee absolute security. Users are responsible for protecting account credentials, using secure devices, and notifying EzSignoff promptly about suspected unauthorized access.

11. Retention and deletion

EzSignoff normally retains the following information for up to 30 days: original uploaded documents, completed or signed documents, incomplete documents, audit records, application and security logs, and backup copies.

A user may delete documents or close an account using available product features. Deletion from active systems may occur before the end of the normal retention period.

Deleted information may remain temporarily in backups until the applicable backup cycle expires. EzSignoff may retain limited information longer when reasonably necessary to comply with law; respond to a dispute or legal claim; investigate fraud, misuse, or a security incident; maintain necessary financial or operational records; or enforce agreements and protect legal rights.

When personal information is no longer reasonably required, EzSignoff takes reasonable steps to delete, destroy, or anonymize it.

12. Cookies and analytics

EzSignoff uses necessary cookies to support authentication, sessions, security, and application functionality.

EzSignoff also uses Google Analytics and Statcounter to understand website and application usage. Analytics providers may use cookies or similar technologies to collect information such as IP address, visited pages, referral information, approximate location, browser or device information, and interaction data, depending on provider configuration.

Visitors can use the cookie consent tool to accept or reject non-essential analytics cookies. Analytics scripts load only after you accept.

EzSignoff does not currently use advertising trackers or behavioural advertising technologies. General-purpose analytics are not used on signing and document-viewing pages to record document or signer information.

13. Email communications

EzSignoff uses Mailjet to send service-related emails, which may include account invitations, account verification messages, password reset messages, signing invitations, signing reminders, document-completion notices, and security and service notices.

Service-related emails are required to operate EzSignoff and may not include an unsubscribe option where the message is necessary to complete a transaction, protect an account, or provide the requested service.

14. Payments

EzSignoff currently offers free access to eligible verified nonprofit organizations and may introduce paid plans later. The eligibility criteria for the nonprofit program may be updated as the service develops.

EzSignoff has not yet selected a payment provider. If paid plans are introduced, payment-card information should be collected and processed by the selected payment provider. EzSignoff does not intend to store complete payment-card numbers.

15. Artificial intelligence and customer documents

EzSignoff does not currently send customer PDFs, signatures, or audit information to artificial intelligence providers, and does not use customer documents, signatures, or audit records to train artificial intelligence models.

Before introducing AI features that materially change how customer information is processed, EzSignoff will update its notices and provide additional choice or consent where required.

16. Privacy rights and requests

Subject to applicable law, an individual may request access to personal information held by EzSignoff; correction of inaccurate personal information; deletion of personal information where legally and operationally appropriate; withdrawal of consent where consent is the legal basis for processing; and information about EzSignoff’s privacy practices and service providers outside Canada.

EzSignoff may need to verify the requester’s identity before responding. If a signer asks EzSignoff to access, correct, or delete information associated with a document sent by an EzSignoff customer, EzSignoff may refer the request to or coordinate with the person or organization that uploaded and sent the document.

17. Privacy and security incidents

EzSignoff maintains a process for responding to suspected privacy and security incidents, including containing and investigating the incident, preserving relevant records, assessing the information and individuals affected, taking steps to reduce possible harm, correcting weaknesses, and notifying affected individuals, regulators, service providers, or others where required or appropriate.

18. Children and minors

EzSignoff is intended for organizations and individuals using the service for legitimate document-signing purposes. It is not designed as a service directed to children. An organization using EzSignoff for a document involving a minor is responsible for determining whether parental, guardian, or other legally required authorization is needed.

19. Changes to this Privacy Policy

EzSignoff may update this Privacy Policy when the service, providers, hosting arrangements, legal obligations, or privacy practices change. The updated policy will be published with a revised effective date.

20. Contact EzSignoff

Questions, concerns, complaints, or privacy requests may be directed to the Privacy Officer, EzSignoff, Alberta, Canada — rayc@vcto[REMOVE].ca.

Individuals may also contact the Office of the Information and Privacy Commissioner of Alberta for information about privacy rights under Alberta law.