Privacy Policy

This Privacy Policy explains how Kraft Ventures, LLC (“uSigning”, “we”, “us”) collects, uses, stores, and shares personal data when you use usigning.com and the uSigning e-signature service (the “Service”). For personal data collected from users in the European Economic Area (EEA) or the United Kingdom, we act as the data controller within the meaning of the GDPR. For personal data of residents of California and other US states with comprehensive privacy laws, we act as a “business” within the meaning of those laws.

1. Who we are

Kraft Ventures, LLC is a Delaware limited liability company. Registered office: 131 Continental Dr, Suite 305, Newark, DE 19713, United States. For any privacy question you can reach us at [email protected].

2. What we collect

We collect data in three categories:

Account data — when you create an account we store your email address, name (optional), password hash (when applicable), Google ID (if you sign in with Google), plan, and account timestamps.

Contract & signing data — when you send a contract we store the document (title, PDF or text content, field positions), recipient email addresses, sender identity, and a signing audit trail: IP address, user-agent, timestamps of every view and signature, and the signature image or typed name.

Usage & technical data — server logs (IP address, request path, response status, timestamp), and error diagnostics. We do not use analytics or advertising trackers on the marketing site or the product.

3. Why we process it

For EEA / UK users, our GDPR legal bases are:

Performance of a contract (Art. 6(1)(b)) — to authenticate you, store and deliver contracts, produce audit trails, and provide the paid features you subscribed to.

Legitimate interests (Art. 6(1)(f)) — to keep the Service secure, detect abuse, and improve reliability. We balance this against your privacy rights.

Legal obligation (Art. 6(1)(c)) — to keep invoicing and tax records for the periods required by law.

4. Signers & recipients

If someone sends you a document to sign through uSigning, we process your data (email, IP, user-agent, signature) on behalf of that sender, who is the data controller (GDPR) or business (CCPA) for that contract. We act as their processor / service provider. Requests to access or delete signer data should be directed to the sender in the first instance; we will assist as required by law.

5. Sub-processors

We use the following third parties to run the Service:

• Stripe, Inc. — payment processing (we never see card numbers)
• Resend — transactional email (signing requests, magic links, receipts)
• Anthropic PBC — AI-assisted document review, only when you explicitly submit a document for review
• Contabo GmbH (Germany) — server hosting
• Cloudflare, Inc. — DNS and CDN
• Google LLC — (i) Google Sign-In (we receive your email, name, and Google account ID); (ii) Google Tag Manager, Google Analytics 4 and Google Ads (loaded via GTM), used only if you have granted the Analytics or Marketing consent category via our cookie banner.

6. Where your data is stored & international transfers

Contracts, account data, and audit trails are stored on servers physically located in Germany (EU). As Kraft Ventures, LLC is a US company, administrative access to that data may occur from the United States. Some sub-processors (Stripe, Anthropic, Cloudflare) may process data in the United States. Where personal data of EEA / UK residents is transferred outside the EEA / UK, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and the EU-US Data Privacy Framework where the recipient is certified.

7. How long we keep it

Account data — for as long as your account is active. On deletion we remove it within 30 days.

Contracts & audit trails — kept for the life of your account plus 7 years after termination, to support the legal validity of executed signatures.

Invoicing & tax records — 7 years (IRS recordkeeping standards).

Server logs — 30 days.

8. Security

We encrypt data in transit (TLS) and at rest (disk encryption). Passwords are hashed with bcrypt. Access to production infrastructure is restricted to a small number of authorised personnel, protected by SSH keys and 2FA. We keep an audit log of administrative actions.

9. Your rights (GDPR — EEA / UK users)

If you are in the EEA or UK, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion (“right to be forgotten”)
• Restrict or object to processing
• Portability — receive your data in a machine-readable format
• Withdraw consent at any time (where processing is consent-based)

To exercise any of these, email [email protected]. We respond within 30 days. You also have the right to lodge a complaint with the data protection supervisory authority in your country of residence.

10. Your rights (CCPA / CPRA — California residents)

If you are a California resident you have the right to:

• Know what personal information we collect, use, and share
• Access a copy of the personal information we hold about you
• Request deletion of your personal information
• Correct inaccurate personal information
• Limit the use of sensitive personal information
• Not be discriminated against for exercising these rights

We do not sell or share personal information for cross-context behavioural advertising as those terms are defined under the CCPA. To exercise your rights email [email protected]. We will verify your request through your account credentials or, if you do not have an account, by other reasonable means. You may authorise an agent to make requests on your behalf; we may require proof of authorisation.

11. Signature generator tool (usigning.com/signature-generator)

The free signature generator tool runs entirely in your browser. Anything you type or draw — including your name and the signature image itself — is never transmitted to our servers, never stored, and never shared with any third party. All rendering, image processing and file download happens locally in your device.

The tool loads no third-party tracking scripts other than the consent-gated Google Tag Manager described in Section 12. Web fonts are self-hosted from usigning.com/fonts/ — no external requests to Google Fonts CDN, so your IP address is never sent to Google without consent (in compliance with LG München I, 20 Jan 2022, Az. 3 O 17493/20).

If you choose “Save to account”, you’ll be redirected to our sign-in page, and only then — after account creation — will the signature you generated be stored, on our EU servers, associated with your account.

12. Cookies & consent

We group cookies into four categories. You control the last three from the cookie banner shown on your first visit and any time from the “Cookie preferences” link in our footer.

Strictly necessary — required for the site to work. Includes our httpOnly session cookie (keeps you signed in), a short-lived oauth_state CSRF cookie during Google Sign-In, and theusg_consent cookie that records your consent choices. Cannot be disabled.

Analytics — Google Analytics 4 via Google Tag Manager. Loads only if you grant consent. Sets first-party _ga and_ga_* cookies. Anonymised usage stats to help us improve the product.

Marketing — advertising and conversion tracking (Google Ads via GTM). Loads only if you grant consent.

Personalization — non-essential cookies that remember your preferences.

We use Google Consent Mode v2. If you deny non-essential categories, Google may still receive aggregate, cookieless signals from your visit for measurement — no cookies are set and no personal identifiers are sent.

13. Children

The Service is not intended for and may not be used by children under 16. We do not knowingly collect personal information from children under 13 (COPPA) or under 16 (GDPR).

14. Changes to this policy

We may update this policy from time to time. Material changes will be announced on this page and, where practical, by email at least 30 days before they take effect. The “last updated” date at the top of this page reflects the current version.

15. Contact

Privacy questions, data-subject / consumer requests, or complaints: [email protected]
Kraft Ventures, LLC — 131 Continental Dr, Suite 305, Newark, DE 19713, United States.