Privacy Policy

Effective 2026-11-02

1. Who we are

JVANET PTY LTD (ABN 26 696 484 107), of Brisbane, Queensland, Australia, is the data controller for personal data processed through ForgeSign. Contact for all enquiries, including privacy and EU/UK data-protection requests: hello@jvanet.com.

2. Personal data we collect

Account data — email, name (if you provide it), hashed password
Documents you upload — content, filename, page count
Signer data — when you send for signature: signer email, name, signature image, IP address (hashed), user-agent string
Usage data — signing events, AI feature usage, billing events
Cookies — see our Cookie Policy

3. Why we process it (lawful bases)

Performance of contract — account, documents, signing events: needed to provide the Service
Legal obligation — audit trail records: required by ESIGN/UETA
Legitimate interest — security logs, fraud prevention, product improvement
Consent — non-essential cookies, marketing emails (always opt-in)

4. AI processing

When you ask for AI assistance:

Document text + images are sent to Anthropic (the AI model provider) under our customer-data agreement
Anthropic does NOT use your data to train models (per their commercial terms)
Signer chat questions + the document text are sent to Anthropic with each message
AI outputs are stored alongside your document for the lifetime of the envelope plus 90 days. If you save a document as a template, the AI summary saved with it is kept for as long as the template exists.

5. Who we share data with (subprocessors)

See Subprocessors for the full list. Summary: Supabase (database + storage), Anthropic (AI), Stripe (billing), Resend (email), Vercel (hosting).

6. Data retention

ForgeSign account data — your drafts, templates, AI usage and consent records are deleted when you close your ForgeSign account (Account → Close ForgeSign account). Their stored files are removed within 30 days.
Sent envelopes — every envelope you sent, with its documents and audit trail, is kept for 10 years (ESIGN evidentiary requirement), also after you close your ForgeSign account, when it is detached from your account. Your email is kept with them in the closure record, to answer requests about them. That month’s sends and AI usage still count toward your plan’s limits if you use ForgeSign again.
Templates — the template’s copy of your document, its fields and signer roles, and the AI summary saved with it are kept until you delete the template or close your ForgeSign account.
Chat history — kept until envelope completes plus 90 days, then auto-deleted.
Billing records — kept 7 years (tax/audit requirement).
Server logs — kept 30 days, then automatically rotated.
Abuse reports — when a recipient reports a request, we keep the report, with their email and note, to handle abuse.
Your Forge sign-in — your sign-in is shared with other Forge products, so closing your ForgeSign account does not delete it. We delete it on request: email hello@jvanet.com.

7. Your rights (EU/UK GDPR)

You may:

Access the personal data we hold about you
Correct inaccurate data
Delete your data (subject to retention obligations for ESIGN audit)
Port your data in a machine-readable format
Object to specific processing
Lodge a complaint with your local supervisory authority

To exercise any of these rights, email hello@jvanet.com. We will respond within 30 days.

8. International transfers

Some subprocessors are based in the United States. Transfers from the EU/UK to the US are made under the EU-US Data Privacy Framework (where the subprocessor is certified) or via Standard Contractual Clauses.

9. Security

See our Trust & Security page. In summary: TLS 1.3 in transit, AES-256 at rest, app-layer encryption on biometric data (signature images), hash-chained tamper-evident audit trail, role-based access controls.

10. Children

The Service is not intended for users under 18. We do not knowingly collect data from children.

11. Changes to this Policy

Material changes are notified by email and in-app banner. The effective date is shown above.