Privacy Policy.

Last updated: [DATE OF OWNER APPROVAL]

Who runs this site

eSig Studio (esigstudio.com) is operated by Gravity XL Inc.. Questions about privacy:info@esigstudio.com.

The short version

Without an account, the signature builder runs in your browser and what you type isn’t sent to our servers.
With a free account (optional), we store your email address and the signatures you choose to save, so you can edit them from any device.
Uploaded images are never stored by us, with or without an account.
No advertising or tracking cookies. We count visits with Cloudflare Web Analytics, which doesn’t use cookies. After you sign up, a few setup emails you can turn off; no newsletters.
If you subscribe to Pro or Team, Stripe processes the payment. We never see or store your full card number.
You can delete a saved signature, or your whole account, at any time.

Using the builder without an account

Your name, contact details, links and design choices are processed by code in your own browser to build the preview and the signature you copy or download. By default your draft is kept only in the memory of the current browser tab: it stays while you move between pages of this site and is cleared when you reload or close the tab.

If you turn on Remember on this device, your text and design settings are saved in your browser’s local storage on that device until you turn it off, click Clear saved draft, or clear your browser’s site data. Anyone using the same browser profile could see them, so don’t use this on a shared computer.

Files you download (HTML, plain text, images and profile files) are created in your browser and saved to your device.

Free accounts and saved signatures

If you create an account, we store:

Your email address, to send sign-in links and identify your account. There’s no password.
The signatures you save: the details and design settings you entered (for example name, job title, phone, email, website, address and social links). We store these as structured data, not as ready-made email HTML.
An unsaved draft, only if one arrives when you sign in and can’t be saved automatically. It stays until you open and save it, discard it, or delete your account.
Sign-in records: when you last signed in, and hashed session identifiers (the sign-in cookie itself stays in your browser).
Your plan (for example, how many signatures your account can save).
Saved brand colors (Pro and Team), if you save any.
Team: your company design, and the names and contact details you add for your employees. Add people only with their permission; you can edit or delete their signatures any time.

When you ask for a sign-in link while editing, the draft you’re editing is sent with the request so it can be saved to your new account. If you don’t open the link, it expires after 15 minutes. After that, the draft attached to it is cleared, and the expired request is deleted after about a day. (This cleanup runs whenever someone requests a sign-in link, so on a quiet day it can take a little longer.) Expired sign-in sessions are deleted the same way.

Account data is stored with our hosting provider, Cloudflare Pages (Cloudflare D1 database).[OWNER REVIEW: confirm the database location setting and link to the provider’s privacy terms.]

Payments

Pro and Team payments are handled by Stripe on its own secure pages. Stripe receives your card details and billing information directly; we don’t. We store your Stripe customer and subscription IDs, your plan, billing period (monthly or annual), subscription status and renewal date, so we can give your account the right features. We also keep a record of Stripe’s payment notifications (event IDs and types) to avoid processing any of them twice. See Stripe’s privacy policy.[OWNER REVIEW: confirm how long billing records are kept (tax and accounting rules may require it).]

Emails we send

Sign-in links, when you ask for one.
Setup emails: one reminder if you asked for a sign-in link but didn’t use it, a welcome email with installation help, and up to two tips (one about the Pro templates if you’re on Free, or one if you’re on a paid plan but haven’t saved a signature a couple of days in). Each has a link to turn them off.
Payment receipts for Pro and Team come from Stripe.

Emails are sent through Resend, an email delivery service, which processes your email address to deliver them (see Resend’s privacy policy). To send each email only once and to remember if you turned setup emails off, we store a keyed hash of your email address (not the address itself) with the type of email and when it was sent.

Images

Uploaded PNG or JPEG images are checked, resized and re-encoded in your browser (which also removes embedded metadata such as camera details). They’re held in memory for the current tab only. They aren’t uploaded, saved to your account or published by this site, even when you save a signature. The one exception stays on your device: when you leave for sign-in or checkout to unlock a Pro signature, the image is kept in your browser’s own storage for this site so it’s still there when you come back. It’s removed as soon as you return, or after six hours. If a saved signature used an uploaded image, you’ll need to upload it again in a later session or insert it in your email app.

If you enter the address of an image you already host, your browser loads it directly from that host to preview it, and your recipients’ email apps will load it from there too. That host may log those requests. We don’t fetch, copy or proxy the image. Contact icons in signatures (phone, email and so on) are small image files served from this site, so your recipients’ email apps request them from us like any web image.

Design service and team requests

When you request a design service, we store the name, email, optional phone number, company, package, number of employees, preferred email app and notes you provide, and email them to our team at info@esigstudio.com so we can reply. We use them only to respond and deliver the work you ask about.[OWNER REVIEW: set how long requests are kept.]

Cookies and similar technologies

Sign-in cookie (only if you sign in): keeps you signed in for up to 30 days. It’s marked HttpOnly and can’t be read by page scripts.
Signed-in indicator (only if you sign in): a small cookie with the value “1” so pages can show “My signatures” instead of “Sign in”. It contains no personal data.
Local storage: only if you choose “Remember on this device”.
Stripe: when you check out or manage billing, you’re on Stripe’s own pages, which use Stripe’s cookies for payment security and fraud prevention.

We don’t use analytics or advertising cookies. Our hosting provider, Cloudflare, may set a strictly necessary security cookie (for example, to tell people apart from automated bots); it protects the site and isn’t used for tracking or advertising.

Visitor statistics

To see which pages people visit and how quickly they load, we use Cloudflare Web Analytics. A small script reports the page address, the page that linked to it, your browser and device type, your country and page-speed measurements. It doesn’t set cookies or use your browser’s storage, and Cloudflare says it doesn’t use your IP address or other details to identify or follow you. We see totals only, never individual visitors, and nothing you type in the signature builder is included.

How we use information

To build, save and export the signatures you ask for.
To sign you in, keep you signed in, and send the sign-in and setup emails described above.
To give your account the plan you pay for, and to manage renewals, failed payments and cancellations.
To reply to your messages and design requests, and to deliver the work you order.
To keep the service secure and prevent abuse (for example, limiting repeated sign-in attempts).

We don’t sell your personal information, and we don’t share it for advertising. We don’t use it to train AI models. We don’t send newsletters or marketing email beyond the setup emails described above.

Service providers we use

These companies process information on our behalf, only to run the parts of the service described here:

Cloudflare: hosts the website and the database that stores accounts and saved signatures, delivers pages to your browser, and provides the cookie-free visitor statistics described above.
Resend: delivers sign-in and setup emails and forwards design requests to our inbox.
Stripe: processes Pro and Team payments and hosts the checkout and billing-management pages.

We may also disclose information if the law requires it, or to protect the rights and safety of our users and the service.[OWNER REVIEW: confirm this list before launch, and link each provider’s privacy policy.]

Abuse prevention

To limit repeated sign-in emails and spam requests, we count recent attempts using keyed hashes of the email address and connection address, not the values themselves.

Hosting logs

When your browser requests a page, Cloudflare Pages processes technical information needed to deliver it and protect the service, such as your IP address, browser user agent, the page requested and the time, and may keep this in logs for operations and security. Our own application doesn’t log the contents of your signatures or requests.

[OWNER REVIEW: confirm the hosting provider’s logging and retention for this account.]

How long we keep information

Your account, saved signatures, company design and brand colors: until you delete them or delete your account.
An unsaved draft kept for you: until you open and save it, discard it, or delete your account.
Sign-in requests: the draft attached to one is cleared once it expires (15 minutes); the request itself is deleted after about a day.
Sign-in sessions: up to 30 days, or until you sign out.
Abuse-prevention counters: about a day.
Subscription records and payment notifications: while your account exists. [OWNER REVIEW: tax and accounting rules may require keeping billing records longer.]
Design requests: [OWNER REVIEW: set a retention period.]

Your choices and rights

See and correct your information: open My signatures, or edit any saved signature. You can export a signature’s settings as a profile file from the builder.
Delete a signature, or your whole account, yourself at any time (see below).
Ask us about the information we hold about you, or to delete information you can’t delete yourself, by emailing info@esigstudio.com. We may need to confirm the request comes from you.

[OWNER REVIEW: add any rights and disclosures required where you and your users are located, for example California (CCPA/CPRA) if it applies to your business.]

Security

Pages and data travel over HTTPS. There are no passwords to leak: sign-in links work once and expire in 15 minutes, and only one-way hashes of sign-in links and session identifiers are stored. The sign-in cookie can’t be read by page scripts. Card details go to Stripe, never to us. No system is perfectly secure; if we learn of a problem that affects your information, we’ll tell you.

Deleting your data

A signature: delete it from My signatures.
Your account: Account settings → Delete account. This cancels any subscription immediately and removes your account, saved signatures, company design, employee records, unsaved draft and sign-in sessions. Service requests you sent are kept as correspondence but unlinked from the account; email us to have them deleted. Stripe keeps its own payment records. The keyed hashes described above (which emails were sent and whether you turned setup emails off) are kept, but no longer linked to an account.
This device: use “Clear saved draft”, or clear your browser’s data for this site.

Signatures you’ve already installed in an email app, or sent in emails, are copies outside our control and aren’t affected.

Children

This tool is intended for people creating professional email signatures and isn’t directed at children.

Changes

If how the site handles information changes, for example if image hosting is added, this page will be updated before the change goes live, with a new “last updated” date.

Contact

Questions about this policy or your information: info@esigstudio.com. More ways to reach us are on theContact page.[OWNER REVIEW: add a mailing address if required where you operate.]