Privacy Policy
Version 2.1 · Last updated October 26, 2026
This Privacy Policy describes how ARSA VENTURES PVT LTD (“SignNinja”, “we”, “us”) collects, uses, and protects information when you use SignNinja, whether as a sender who creates an account or a recipient who signs a document sent to you.
For information about your own account, we decide how it is used and are the “controller” (in India, the “data fiduciary”). For the content of documents an organization sends, the organization decides what is sent and to whom, and we handle it on its behalf as its “processor”.
1. Information We Collect
- Account information — name, email address, and organization details you provide when you sign up.
- Document and signer information — the documents you send, the names and email addresses of recipients, and the signature, consent, and authentication data recorded during signing.
- Usage and device data — IP address, browser and device type, and activity within the service, collected automatically and used for security, fraud prevention, and the audit trail a signing platform is expected to keep.
2. How We Use Information
We use the information above to:
- Provide, operate, and secure the signing workflow you initiate;
- Send transactional email — signing invitations, reminders, and completion notices;
- Maintain the audit trail and evidence record for each completed sign request;
- Improve the service and respond to support requests;
- Comply with legal obligations and enforce our Terms of Service.
We do not sell your personal information, and we do not use document content to train any model.
3. Why We Are Allowed to Use Your Information
Data-protection law asks us to have a lawful reason for each way we use personal information. These are ours.
| What we do | Our lawful basis |
|---|---|
| Running your account and the signing service you asked for: signing in, sending sign requests, delivering emails and one-time codes, storing documents. | Performance of a contract with you or your organization (GDPR Article 6(1)(b)). In India: your consent when you sign up or sign, or a use the Digital Personal Data Protection Act, 2023 permits for providing a service you requested. |
| Recording who signed what, when and from where (audit trail, IP address, device type, signing certificate). | Our legitimate interest, and that of the sender and the signers, in a reliable record of a transaction (Article 6(1)(f)). It is also part of performing the signing itself. |
| Security, abuse and fraud prevention, and error monitoring. | Our legitimate interest in keeping the service safe and working (Article 6(1)(f)). |
| Meeting legal obligations, such as tax records and lawful requests from authorities. | Legal obligation (Article 6(1)(c)). |
| Answering demo requests and support emails. | Our legitimate interest in replying to people who contact us (Article 6(1)(f)), and the request you made. |
4. Who We Share It With
We share information only with the service providers that operate SignNinja on our behalf — database and file storage, transactional email delivery, and hosting infrastructure — each bound by their own data protection obligations to us. We do not share your documents or signer data with third parties for their own marketing purposes.
5. International Data
SignNinja serves customers in both the United States and India, and infrastructure supporting the service may be located in either region. Where data is transferred internationally, we take reasonable steps to protect it consistent with applicable law.
6. Service Providers
We rely on a small number of service providers to run SignNinja. Each receives only what it needs to do its job for us:
- Supabase — database, document storage and sign-in (hosted in the United States).
- Hostinger — hosting for the SignNinja website and application (India).
- Resend — delivery of the emails the service sends, such as signing invitations and sign-in codes.
- Sentry — error monitoring, so we learn about faults quickly. Session screen recording is not used.
We will update this list before adding a provider that handles your personal information.
7. Documents You Send Through SignNinja
When an organization uses SignNinja to send documents for signature, the organization decides what is sent and to whom, and we process that content on its behalf to provide the service. Business customers who need a data processing agreement can contact us at hello@signninja.io.
8. Data Security
Documents and account data are encrypted, access-controlled, and isolated per organization. Our security approach is described in more detail on our Trust Center.
9. How Long We Keep It
We keep information only as long as it is needed for the purpose it was collected for, to meet our legal obligations, and to preserve the evidentiary record of completed sign requests. An organization chooses how long its own documents are kept.
| Information | How long |
|---|---|
| Account details: name, email address, organization. | While the account is open. After it is closed they are kept for 30 days, during which you can ask us for a copy or to reopen the organization, then are deleted automatically from live systems, and in any case within 30 days. |
| Documents, signed copies and evidence packages. | Until the organization deletes them, or its own retention rules (Settings, Security) remove them. By default nothing is deleted automatically. A legal hold stops deletion. After the organization is closed, the account timings above apply. |
| The audit trail of a sign request, including IP address and device type. | As long as the sign request it belongs to, because it is part of the evidence. |
| One-time sign-in and signing codes. | Valid for 10 minutes, and stored only in a form that cannot be read back. |
| Sign-in session and time zone cookies. | The session until you sign out or it expires; the time zone for up to a year. |
| Error reports held by our error-monitoring provider. | 90 days. |
| Backups of the database and stored files. | Overwritten on their normal cycle within 90 days after the live data is deleted. |
| Support emails and demo requests. | As long as needed to deal with your request and any follow-up. |
10. Your Rights
Depending on where you live, you may have the right to access, correct, export, or request deletion of your personal information, to object to or restrict some uses of it, and to withdraw consent you have given.
- EU and UK: the rights in the GDPR and UK GDPR, including to complain to your local data-protection authority.
- India: under the Digital Personal Data Protection Act, 2023, to access, correct and erase your personal data, to have a grievance addressed, and to nominate someone to exercise these rights for you.
- California: to know what we collect, to delete or correct it, and not to be treated worse for asking. We do not sell or share personal information for advertising.
To make a request, contact us at hello@signninja.io. We reply within 30 days. If you are a signer on a document sent by an organization, we may need to pass your request to that organization.
11. Cookies
We only use cookies and similar storage that the service needs to work. We do not use advertising or cross-site tracking cookies.
- Sign-in (
sb-…-auth-token) — keeps you signed in; removed when you sign out. - Time zone (
sn_tz) — remembers your time zone so times are shown in it; kept for up to a year. - Notifications (stored in your browser, not a cookie) — remembers when you last opened notifications, to show what is new.
12. Children’s Privacy
SignNinja is not directed to children, and we do not knowingly collect personal information from children.
13. Changes to This Policy
We will give at least 30 days notice of a material change before it takes effect. Each published version is listed under Version history below.
14. Grievance Officer (India)
If you are in India and have a concern or complaint about how your personal data is handled, you can contact our Grievance Officer at hello@signninja.io or by post at ARSA VENTURES PVT LTD, 2202, Tower-1C, Landcraft Golflinks, Delhi-Meerut Expressway, Ghaziabad 201002. We will acknowledge your complaint and respond within the time required by applicable law.
15. Contact
Questions about this policy can be sent to hello@signninja.io.
- Company
- ARSA VENTURES PVT LTD
- Registered office
- 2202, Tower-1C, Landcraft Golflinks, Delhi-Meerut Expressway, Ghaziabad 201002
- Contact
- hello@signninja.io
Version history
- Version 2.1October 26, 2026Clarified that after closure a copy of the data or reopening is available on request during the first 30 days, and that deletion then happens automatically.
- Version 2.0October 25, 2026Added the lawful basis for each use of data, retention periods, EU and UK representative details, how long backups and error reports are kept, and company registration details.
- Version 1.0October 2026First published version.