Privacy policy

Controller

RedSwiss Sign (sign.redswiss.ch) is operated by Anthony Thomas, a private individual resident in Switzerland. For any question about your personal data: info@anthony-thomas.ch.

Data we process

• Account: name, email address, password (stored only as a hash, never in plain text), two-factor authentication settings, organisation and roles.
• Sign-ins: IP address and browser of your sessions and recognised devices, so we can warn you about unusual sign-ins.
• Documents: files you upload, placed fields, signed documents and signing certificates.
• Signers: name and email address of the people invited to sign, drawn or typed signature, one-time verification codes and audit trail (opening, consent, signature, download) with date, time, IP address and browser. The IP address appears on the signing certificate.
• Payment: for paid plans, billing data is processed by Stripe. We do not store your card details.
• Statistics: cookieless audience measurement with a tool hosted on our own servers (Umami). Page addresses are recorded without parameters, tokens or identifiers.

Purposes

• Providing the service: creating, sending, signing and keeping your documents.
• Proving the integrity of documents and how each signature took place.
• Securing accounts: two-factor authentication, sign-in alerts, abuse prevention.
• Managing subscriptions and payments.
• Sending service emails (signing invitations, verification codes, notifications, password resets).
• Improving the website with aggregated statistics.

We do not use your data for advertising and we do not sell it.

Legal bases

Where the EU General Data Protection Regulation (GDPR) applies, we process your data to perform our contract with you, on the basis of our legitimate interest (security, proof of signatures, cookieless statistics) or to meet our legal obligations.

Hosting and service providers

• Infomaniak Network SA (Switzerland): hosting of servers and databases. Your documents are stored in Switzerland.
• Resend (United States): sending emails. Resend stores email content and delivery logs in the United States; this transfer is covered by standard contractual clauses adapted to Swiss law.
• Stripe (Ireland and United States): payment processing. Stripe is certified under the Swiss-U.S. Data Privacy Framework.

These providers only process your data to deliver their services to us.

Retention

• Account: kept while active, then deleted within 30 days of your request.
• Documents, certificates and audit trail: kept as long as their owner's account exists, since they serve as proof of the signatures, then deleted with it.
• Signing links: valid for at most 30 days, or until the deadline set by the sender.
• Verification codes: valid for 10 minutes.

Some data may be kept longer where the law requires it, for example payment records.

Cookies

We only use cookies that the website needs to work: a session cookie to keep you signed in and a cookie that remembers your theme preference (light or dark). We use no advertising or tracking cookies.

Security

Traffic is encrypted (HTTPS), passwords are hashed, two-factor authentication is available, access to documents is limited to authorised people and signing links are unique and time-limited.

Your rights

You can ask to access your data, correct it, delete it or receive a copy in a common format, and object to certain processing. Write to us at info@anthony-thomas.ch; we reply within 30 days.

You can also contact the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) or, if you live in the European Union, the data protection authority of your country.

Changes

We may update this policy. The date of the current version is shown at the top of this page; for significant changes we will inform you by email or on the website.