Information we collect
Account information
When you sign in to the portal, we and our authentication provider process the information needed to verify your identity and manage access, such as account identifiers, email address, sign-in method, and session information. We also keep organization details, memberships, roles, and administrative activity.
Device and participant identifiers
The app creates a public identifier for your device, called a DID, which your organization registers to authorize you. We receive DIDs and signed messages from the app and associate them with your organization, permissions, labels, and activity. A DID can identify you to anyone who knows who controls it, so we treat it as personal information.
Requests and decisions
We process approval requests and the decisions made on them, including the requesting application, the proposed operation and its details, the participants involved, signatures, status, and timestamps. Requests can contain whatever information the requesting organization includes, so please avoid putting unnecessary personal or confidential information in them.
Notifications
If you turn on notifications, we receive a push token and related identifiers from your device so that we can send you notifications.
Communications
When you contact us through our website or by email, we receive your name, email address, message, and anything else you choose to include.
Technical information
When you use the Services, we and our providers automatically receive technical information such as IP addresses, device and app information, logs, and error and performance data. If you choose to share diagnostics with app developers in your device settings, your device's platform provider, such as Apple or Google, may also provide us with crash reports and usage information.
Information on your mobile device
The app creates its signing key in your device's secure key storage, such as the iPhone's Secure Enclave. The private key stays on your device. We never receive it, and it cannot be restored to another device from a backup.
Biometric unlock, such as Face ID or fingerprint unlock, and your device passcode are handled by your device's operating system. Neither the app nor SignerSet receives your biometric data or passcode.
The app also stores information on your device, such as settings, names you assign, and a history of your decisions. You can remove it using the controls in the app.
How we use information
We use information to:
- Provide, operate, and maintain the Services.
- Authenticate users, devices, and signed messages.
- Manage organizations, participants, and permissions.
- Deliver approval requests and notifications, and record decisions.
- Keep historical records and signed evidence for you and your organization.
- Secure the Services, prevent abuse, and fix problems.
- Respond to support and privacy requests.
- Improve the Services.
- Comply with law and enforce our terms.
We do not sell or rent personal information, share it for targeted advertising, or track people across other companies' apps and websites.
We do not use the content of your organization's requests, signed decisions, or your messages to us to train AI models, and we do not allow others to do so.
Retention
SignerSet exists to keep a reliable record of approvals. We keep action records, signed decisions, and related information for as long as needed to provide that record to you and your organization. We keep other information for as long as needed for the purposes in this policy, such as maintaining accounts, securing the Services, resolving disputes, and meeting legal obligations.
Some records expire automatically. Records that no longer appear in the portal may still be stored, and copies of deleted information may remain for a time in backups, logs, and our providers' systems. We do not guarantee that history will remain available permanently.
Security
We use technical and organizational measures designed to protect information, such as encryption and access controls. No system is perfectly secure, and we cannot guarantee the security of information.
Your choices and rights
The app lets you remove the signing identity and saved registration information from your device, clear saved decision history, and turn off notifications. Removing the identity also attempts to stop notifications to your device, but it does not revoke the DID registered with your organization or delete records held by our service. To revoke the old DID, ask your organization's administrator.
Your organization's administrators can revoke a device's authority. Revoking authority does not erase historical records.
You can ask us to access, correct, or delete your information by emailing signerset@wivity.com. We verify requests before acting on them, for example by confirming them with the email address on your portal account. Because the app has no separate login, requests about the records of a DID should come from your organization's owner and identify the DID.
Some records, such as signed decisions, document the actions of several people and form part of an organization's audit trail, and changing them can invalidate their signatures. We review requests about these records individually and may keep them where they are needed for those purposes or where the law permits or requires it.
Depending on where you live, you may have additional rights under local law. Contact us to exercise them.
International use and children
We are based in the United States and process information there and in other countries where our providers operate.
If you are in the European Economic Area or the United Kingdom, we process personal information to perform our contract with you or your organization and for our legitimate interests in operating and securing the Services. You may request access, correction, deletion, restriction, or portability of your information, object to its processing, and lodge a complaint with your local data protection authority.
SignerSet is a general-audience service and is not directed to children. We do not knowingly collect personal information from children under 13.
Contact
Wivity Inc., doing business as SignerSet
548 Market Street, PMB 69709
San Francisco, California 94104
United States
Changes to this policy
We may update this policy from time to time, for example as our Services, providers, or legal requirements change. We will post the updated policy on this page and revise the date above. Changes take effect when posted.
If we make a material change that significantly reduces how we protect information we already hold, we will give notice through the portal, the app, or by email before the change takes effect. If you continue to use the Services after an update, the updated policy applies.