Privacy Policy

1. Who we are

DocuLetra is operated by Cranford Tech Limited, a company registered in England and Wales with company number 15069364 and registered office at 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE (“we”, “us”). You can contact us at support@doculetra.com.

For your DocuLetra account data, we are the data controller. For the documents you send and the personal data of the people who sign them, you (or the organisation you work for) are the controller and we process that data on your behalf as a processor, under our Data Processing Agreement, available on request at support@doculetra.com.

2. What we collect

Account data

• Your name, email address and Google account identifier, received when you sign in with Google.
• Your timezone, detected by your browser, used to stamp signing dates.
• Your plan, usage counts and, once paid plans launch, billing records.
• Messages you send to our support address.

Google Drive data

• An access token for the Google Drive permission drive.file. This lets DocuLetra see and change only the files it creates in your Drive (your templates and signed copies). It cannot see any other file in your Drive.
• The contents of those templates, which we read to fill placeholders and create drafts.

Documents and signer data

• Draft documents you prepare for signature, and the placeholder values you supply.
• Names and email addresses of signers and CC recipients, which you or Claude provide.
• Signing evidence: signatures, initials and field values entered by signers, timestamps, IP addresses, browser details, email delivery events and any reason given for declining.

Technical data

• Product analytics and error reports, collected without cookies. We do not send document contents or signer email addresses to our analytics tool.
• Server logs, kept for 30 days, with email addresses removed.

3. How we use it

• To provide DocuLetra: create templates and drafts, send signing emails, collect signatures and deliver signed documents.
• To keep an audit trail that can serve as evidence of who signed what and when.
• To count usage against your plan, and to bill you once paid plans launch.
• To prevent abuse, such as spam or phishing sent through our signing emails.
• To provide support, fix errors and improve the product.

We do not sell personal data and we do not use your documents to train AI models.

4. Legal bases

Where the UK GDPR or EU GDPR applies, we rely on:

• Contract: to provide the service you signed up for.
• Legitimate interests: to secure the service, prevent abuse and improve DocuLetra.
• Legal obligation: to keep records we are required to keep, and to keep signing evidence.

For signer data, the sender is the controller and decides the legal basis for sending the document.

5. Google API Services

DocuLetra’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Google data only to provide DocuLetra’s user-facing features described above.
• We do not use Google data for advertising, and we do not sell it.
• We do not use Google data to train AI or machine learning models.
• People at Cranford Tech Limited do not read your Google data unless you ask us to for support, it is needed for security or to comply with the law.

You can remove DocuLetra’s access at any time from your Google account permissions.

6. Claude and Anthropic

You use DocuLetra through Claude, an AI assistant made by Anthropic. Anything you type into Claude or share with it, including document text, is handled by Anthropic under your own agreement with Anthropic, not by us. DocuLetra receives only what Claude sends to it when you ask Claude to use DocuLetra.

7. Where your data is processed

Our own systems (application servers, database and file storage) run in the European Union, in Frankfurt, Germany. Some of our service providers process data elsewhere:

Where personal data is transferred outside the UK or EU, we rely on adequacy decisions (including the EU-US Data Privacy Framework where the provider is certified) or Standard Contractual Clauses.

8. How long we keep it

• Draft PDFs: deleted when sent, or after 7 days if never sent.
• Signed documents: we do not store signed PDFs in our own systems. They are saved to the sender’s Google Drive, emailed to every party, and kept by our signing provider Documenso.
• Audit trails and envelope records: kept for the life of your account plus six years, because they are evidence of a signature.
• Account data: deleted within 30 days of you closing your account, apart from audit records kept as evidence.
• Server logs: 30 days.

9. Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict its processing, and withdraw consent. Email support@doculetra.com and we will respond within one month. If you signed a document someone sent you, please contact the sender first, as they control that data; we will help them respond.

You can also complain to your data protection authority, such as the Information Commissioner’s Office in the UK or the Data Protection Commission in Ireland.

10. Cookies

We use only cookies that are needed to keep you signed in and keep the service secure. Our analytics run without cookies.

11. Security

We encrypt data in transit and at rest, limit staff access, require multi-factor authentication on our administrative accounts, and keep each customer’s data separate. To report a security issue, email support@doculetra.com.

12. Children

DocuLetra is for businesses and is not intended for anyone under 18.

13. Changes

We will update this page when our practices change and change the date at the top. For significant changes we will tell account holders by email.

14. Contact

Cranford Tech Limited, 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE. Email: support@doculetra.com.