Introduction

HelloWeSign, as the data controller, places great importance on the protection of your personal data. This privacy policy informs you about how we collect, use and protect your data in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

1. Data controller

Company name: THIRD LEVEL

Address: 78 bd de la République, 92100 Boulogne-Billancourt, France

Email: contact@hellowesign.com

Data Protection Officer (DPO): THIRD LEVEL has not appointed a data protection officer, as such an appointment is not required for its activity under Article 37 GDPR. Any request regarding your personal data may be sent to the contact address below.

2. Data collected

When using the HelloWeSign platform, we collect the following categories of data:

2.1 Identification data

First and last name
Email address
Phone number (optional, if provided by the sender)

2.2 Usage data

Connection logs
IP address
Browsing data (User Agent)
Geolocation (optional)
User preferences
Signature history

2.3 Documents and signatures

PDF files uploaded for signing
Signature images (drawings or text signatures)
Signed documents
Proof documents

2.4 Traceability data

Timestamps of all actions
Signature events
OTP codes (hashed)

3. Processing purposes

Your data is collected and processed for the following purposes:

Creation and management of your user account
Provision of electronic signature services
Identity verification via OTP
Generation of proof documents
Ensuring traceability and legal compliance of signatures
Credit and billing management
Improvement of our services
Security and fraud prevention
Compliance with our legal obligations
Communication of service-related information

4. Legal basis for processing

The processing of your data is based on the following legal grounds:

Performance of a contract: For the provision of electronic signature services
Legal obligation: For regulatory compliance, traceability and evidence retention
Legitimate interest: For the improvement of our services and security
Consent: For certain marketing communications (optional)

5. Data recipients

Your data may be shared with the following recipients:

Authorized HelloWeSign personnel
Service providers (Railway hosting, Stripe payments, Resend emails)
Legal authorities upon justified request

We ensure that all our subprocessors comply with the GDPR and guarantee an adequate level of data protection.

6. Data retention

Your data is retained for the following periods:

Account data: Duration of the contract + 3 years
Billing data: 10 years (legal accounting obligation)
Connection logs: 12 months maximum
Documents and signatures: According to the retention period required by law or chosen by the user
Proof documents: In accordance with legal evidence retention obligations

7. Data security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, destruction or disclosure:

Data encryption in transit (HTTPS/TLS)
Secure document storage (Railway Object Storage, S3-compatible)
SHA-256 hashing of OTP codes and API keys
One-time password (OTP) authentication
Pre-signed URLs with expiration for document access
Secure hosting in the European Union (Vercel, Railway)
Regular backups
Strict access control
Timing-safe comparison to prevent attacks

8. Your rights

Under the GDPR, you have the following rights regarding your personal data:

Right of access: Obtain a copy of your data
Right to rectification: Correct inaccurate data
Right to erasure: Delete your data (subject to conditions, including legal retention obligations)
Right to restriction: Restrict the processing of your data
Right to portability: Receive your data in a structured format
Right to object: Object to the processing of your data
Right to withdraw consent: At any time

To exercise these rights, contact us at: contact@hellowesign.com

You also have the right to lodge a complaint with the CNIL (French data protection authority): www.cnil.fr

9. Cookies

Our platform uses cookies strictly necessary for the operation of the service:

Session cookies: To maintain your session (NextAuth)
Security cookies: To protect against CSRF attacks
Preference cookies: To remember your choices (theme, etc.)

You can configure your browser to refuse cookies, but this may affect the operation of the platform.

10. Data transfers outside the EU

Our hosting (Vercel, Railway) runs on servers located in the European Union: your documents and personal data do not leave the EU. Only email delivery (Resend) may involve a provider located outside the European Union; in that case, we ensure that it guarantees an adequate level of protection through standard contractual clauses or other approved mechanisms.

11. Modifications

We reserve the right to modify this privacy policy at any time. Any changes will be brought to your attention and the updated version will be published on this page.

12. Contact

For any questions regarding this privacy policy or the processing of your data, you can contact us: