What personal data eSignLoop collects, why, who it is shared with, how long it is kept, and the one place where an append-only evidence record limits what erasure can reach.
Last updated 2026-10-20
Verticos.ai LLC operates eSignLoop. This policy explains what we do with personal data. Where you are a customer, you are the controller of the signer data you put into the service and we act as processor on your behalf; for your own account data we are the controller.
| Data | Why |
|---|---|
| Account name, email, organization | To provide the account and contact you |
| Authentication factors | To secure administrative access |
| Documents you upload and the values entered into them | To render, send and complete the agreement |
| Recipient names, email addresses and optional phone numbers | To deliver the agreement and record who it went to |
| IP address and user agent at each signing event | Evidence: part of the audit record of who acted and from where |
| Timestamps and authentication outcomes | Evidence: when each step happened and whether identity checks passed |
| Consent version accepted | Evidence: what wording the signer agreed to |
| Payment reference, card brand, last four digits, expiry | To charge the subscription or credits and to display the method |
| Product usage events | To understand how the product is used |
| Analytics page views (optional, with consent) | To see which pages get used — reported as a route pattern, never a URL |
We use a small number of sub-processors to run the service. Each receives only what it needs:
| Sub-processor | Purpose | What it receives |
|---|---|---|
| Email delivery provider | Sending invitations, passcodes and copies | Recipient email address, subject and message body |
| Payment provider | Collecting card details and taking payment | Card details entered directly by you, and billing contact |
| Hosting and database provider | Running the service | All service data, encrypted in transit |
We do not sell personal data and we do not use document contents to train models. We disclose data to authorities only where legally required, and will tell you unless prohibited.
We aim to keep completed agreements and their evidence for seven years from completion. That is a target rather than a guarantee — see the Terms of Service, section 7. Drafts that are never sent are deleted on a shorter schedule, and preparation work by visitors who never create an account is deleted sooner still.
Depending on where you are, you may have rights to access, correct, export, restrict or erase personal data, and to object to processing. Export is built in: you can download your data at any time without asking us.
To exercise a right, contact support@verticos.ai. If you are a signer rather than an account holder, the organization that sent you the agreement is the controller of that data, and we will direct your request to them.
We are a California company, so this section applies to everyone, not only to California residents.
In the twelve months before the date above we collected the categories of personal information listed in section 1: identifiers (name, email, IP address), commercial information (what you bought), internet activity (how the product was used), and the contents of documents you chose to upload. We collect it for the purposes in section 2 and disclose it only to the sub-processors in section 3.
Californian residents have rights to know, delete, correct, and to limit the use of sensitive personal information, and we will not discriminate against you for exercising them. Two honest notes: we do not collect sensitive personal information as the Act defines it, so there is nothing to limit; and deletion of completed agreements is constrained by the retention period and the append-only evidence record described in section 5.
Whether we currently meet the revenue and volume thresholds that make every provision of the Act apply to us is a question of our size, not of our intentions. We operate to the standards above regardless.
We set a session cookie when you sign in. It is necessary for the service to work and is not optional.
We also offer optional product analytics, provided by Google Analytics through Firebase. It is off until you choose to allow it. Nothing is loaded, no identifier is set and no request is made to Google before that choice — declining means the measurement code is never fetched, not that it is fetched and asked to behave.
If you allow it, we record which pages are used and in what order, along with the coarse information a browser sends with any request. Three limits are set in code rather than promised: advertising identifiers and cross-site signals are disabled, IP addresses are truncated, and automatic page-view collection is switched off in favour of reporting a route pattern.
You can change your mind at any time using the analytics control in the footer of any page. Withdrawing takes effect immediately and for the rest of that session. We ask again if we change materially what we are asking for.
Our sub-processors may process data outside your country. Where that happens we rely on the transfer mechanisms available to us, and the current list of sub-processors and their locations is available on request.
We will post material changes to this policy before they take effect. Contact: Verticos.ai LLC, a California limited liability company, support@verticos.ai. The support page at /support explains how privacy requests are handled.