Privacy Policy

Last updated: September 2026.

This policy explains what information DeliverPage collects, why, and the choices and rights you have over it — including under the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA) for anyone in scope of those laws.

What we collect

• Account holders (senders): organization name, email address, and password (stored hashed, never in plain text).
• Documents you upload: the files themselves and their version history.
• Viewers of a shared link: when someone opens a gated link, we record the email they verify with, IP address, browser user agent, and the time of the view. This is how document tracking works.

Why we collect it (legal basis)

• Contract performance: account and document data is processed to provide the sharing and tracking service you sign up for.
• Legitimate interest: viewer tracking data (email, IP, timestamp) is processed on behalf of the sender’s legitimate interest in knowing who accessed their shared document — the same purpose a physical signature log would serve.

Cookies

DeliverPage uses only strictly necessary cookies: one to keep you logged in, and one (per shared link, HMAC-signed) to remember that a viewer has passed a link’s password/email/NDA gates. We do not use advertising, analytics, or third-party tracking cookies.

Your rights

Subject to applicable law, you can ask us to: access the data we hold about you, correct it, delete it, export it, or restrict/object to certain processing. To exercise any of these, email [email protected]. If you’re a document viewer rather than an account holder, the sender who shared the document with you is the primary data controller for the view record — we’ll help route your request to them where required.

California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you additional rights over the personal information described above. In the preceding 12 months we have collected the categories of personal information listed in “What we collect” above, for the business purposes described in “Why we collect it.” We do not sell or share personal information for cross-context behavioral advertising, and we have not done so in the preceding 12 months.

California residents may request to: know what personal information we hold and how it is used; delete personal information (subject to legal exceptions); correct inaccurate personal information; and receive a portable copy of it. You will not receive discriminatory treatment for exercising any of these rights. To make a request, email [email protected]; we may need to verify your identity before completing certain requests, and you may designate an authorized agent to make a request on your behalf.

International data transfers

DeliverPage is hosted in the United States. If you are located outside the United States, your information will be transferred to and processed in the United States, which may not have data protection laws equivalent to your country’s. Where required by GDPR, we rely on the European Commission’s Standard Contractual Clauses (or another approved transfer mechanism) to safeguard personal data transferred internationally. By using DeliverPage, you consent to this transfer, storage, and processing to the extent permitted by applicable law.

Data processing agreement

For account holders who are subject to GDPR and act as the data controller for documents and viewer data they upload or collect through DeliverPage, DeliverPage acts as your data processor. A Data Processing Agreement (DPA) reflecting this relationship is available on request — email [email protected].

Data retention & security

We keep account and document data for as long as your account is active, plus a reasonable period after closure for backup and legal purposes, unless you request earlier deletion. See our Trust Center for the technical controls protecting this data.

Contact

Questions about this policy: [email protected].