Privacy
Last updated 1 October 2026.
1. Who we are
Paraph is run by Ieuan Turner, trading as Paraph (“we”, “us”), in the United Kingdom. We are the controller for your account and for the records in section 2 that are ours. Contact us at info@tryparaph.com.
For the documents you send and the people you send them to, you are the controller and we are your processor: the contract is yours, and we hold it on your instructions.
We have not appointed a data protection officer. Ieuan Turner is responsible for data protection and reads every message to info@tryparaph.com.
2. What we hold, why, and for how long
Your account
- What we hold
- Your email address, your organisation’s name, your role in it, and how you heard about Paraph if you answered that question.
- Why
- To give you an account, sign you in and run your organisation.
- Lawful basis
- Contract (Article 6(1)(b)).
- How long
- Until you ask us to delete the account.
Documents
- What we hold
- The PDFs you upload, the signed copies and their completion certificates.
- Why
- To send your documents for signature and give everyone the signed copy.
- Lawful basis
- We act as your processor: you decide what is sent and to whom (Article 28). For the account holder, contract.
- How long
- Until you delete them. A draft that was never sent is deleted 90 days after it was last edited, and we email you 14 days before. On Pro you can set rules that delete documents on a schedule.
Signers’ details
- What we hold
- Each signer’s email address, their name if the sender gave it, their signature and the values they filled in.
- Why
- To ask each person to sign and record that they did.
- Lawful basis
- We act as the sender’s processor (Article 28).
- How long
- With the document, until the sender deletes it.
The audit trail
- What we hold
- When each document was sent, opened, agreed to and signed, and the IP address and browser of the person who did each.
- Why
- To keep the evidence of who was asked to sign, what each person did and when, so a signed document can be relied on.
- Lawful basis
- Legitimate interests (Article 6(1)(f)): everyone who relies on a signed document needs the evidence. As the sender’s processor for the rest.
- How long
- With the document. When a document is deleted, a record that it existed and was signed stays, and we remove the personal details from it if you ask.
The first-page check
- What we hold
- Which of a short list of bank and government names, or invoice words, appear on a document’s first page, and the domain names of links on that page. Never the page itself.
- Why
- To stop the service being used for phishing.
- Lawful basis
- Legitimate interests (Article 6(1)(f)): keeping the service safe for the people it emails.
- How long
- With the document.
- What we hold
- The addresses we send to, what each email is about, whether it was delivered, and a list of addresses that bounced or marked us as spam.
- Why
- To deliver signature requests, reminders and signed copies, and to stop mailing addresses that bounce or complain.
- Lawful basis
- Contract, and legitimate interests for the bounce and complaint list.
- How long
- Delivery records as long as our email provider keeps them. An address on the bounce and complaint list stays there until it is removed, so we never keep mailing it.
Reports of a document
- What we hold
- The document reported, the reason and any detail given, and the reporter’s IP address and browser.
- Why
- To act on a document somebody tells us looks like fraud.
- Lawful basis
- Legitimate interests (Article 6(1)(f)): protecting the people our service emails.
- How long
- With the reported document.
The contact and feedback forms
- What we hold
- Your message, your name if you gave it, and your email address if you gave it.
- Why
- To read and answer what you send us.
- Lawful basis
- Legitimate interests (Article 6(1)(f)): answering you.
- How long
- Emailed to info@tryparaph.com and kept in that mailbox as long as we need it to answer you. The website stores none of it.
Billing
- What we hold
- Your plan, whether it is monthly or yearly, when it renews, and the reference Stripe gives your payment account. Card details go straight to Stripe and never reach us.
- Why
- To take payment for Pro and keep the records the law requires.
- Lawful basis
- Contract, and legal obligation (Article 6(1)(c)) for tax records.
- How long
- As long as you have an account, and tax records for as long as the law requires.
Security and abuse limits
- What we hold
- Counts of requests from each IP address or account, and our hosting providers’ request and sign-in logs.
- Why
- To keep the service running and stop scripts misusing it.
- Lawful basis
- Legitimate interests (Article 6(1)(f)): security.
- How long
- Counts are deleted after two days. Request and sign-in logs are kept for the short period each provider sets.
Badge clicks
- What we hold
- A count of clicks per day for each place the badge appears. Nothing about who clicked.
- Why
- To know how often the “Signed with Paraph” badge is clicked.
- Lawful basis
- No personal data is kept.
- How long
- Indefinitely, as a number.
If you are signing a document somebody sent you, we hold your email address, your name if the sender gave it, your signature, the values you filled in and the audit trail. You do not need an account and we do not create one for you.
3. What we do not do
We do not sell your data, and we do not share it for anyone else’s marketing.
We do not read your documents, except the automated first-page check in section 2.
This website counts page views with Vercel Web Analytics. It sets no cookies, keeps the page address without its query string, and is never loaded in the app, on a signing page or on an invitation link, because those addresses contain a credential and analytics records the address of every page it runs on. There are no advertising pixels anywhere.
We count clicks on the “Signed with Paraph” badge ourselves, as a number per day for each place it appears. Nothing about who clicked is kept.
4. Where your data is, and transfers outside the UK
Documents and the database are stored in London, with Supabase in the AWS eu-west-2 region, and the servers that handle them run in Vercel’s London region.
Some of the providers on the sub-processors page are outside the UK, and each is listed there with where it is. For each, we rely on the transfer safeguards in that provider’s data processing terms. Ask us and we will tell you which safeguard applies to which provider.
Payment for Pro goes through Stripe. Under the Stripe Services Agreement, a UK business contracts with Stripe Payments UK Ltd and Stripe Payments Europe, Limited. Card data may also be processed by Stripe, LLC in the United States, under the Stripe Data Processing Agreement and its Data Transfers Addendum.
5. Your rights
You can ask for a copy of what we hold about you, ask us to correct it, delete it or restrict how we use it, object to how we use it, and ask for it in a portable form. We do not rely on consent, so there is no consent to withdraw.
Two protections act automatically. A document can be held for a few hours before it is sent, and an organisation’s sending is paused when two different recipients report its documents as impersonation or as asking for payment. Neither stops anybody signing, and if either happens to you, reply to the email we send and a person will look at it. The fair use page explains both.
Email info@tryparaph.com with what you want. We answer within one month, and we may ask you to confirm it is you before we act.
If you signed a document somebody else sent, the sender controls it. We will pass your request on to them and act on it ourselves where we can.
6. Complaints
You can complain to us about how we handle your data on the complaints page, under section 164A of the Data Protection Act 2018 as the Data (Use and Access) Act 2025 amended it. We acknowledge a complaint straight away and reply without undue delay.
You can also complain to the Information Commission at ico.org.uk/make-a-complaint, on 0303 123 1113, or by post to Information Commission’s Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL. You do not have to come to us first.
8. Changes to this page
If we change what we hold or why, we update this page first and change the date at the top. If a change affects you, we email you before it takes effect.