Privacy notice
This explains what we do with personal data when you use Pixasign, who we share it with, where it is held and how long we keep it. Last updated 8 September 2026.
Who we are
Pixasign is a brand of Pixacomms Ltd, a company registered in England and Wales (number 15861826), registered office Dunleavy House, Dunleavy Drive, Cardiff, CF11 0SN. For questions about this notice or your data, email privacy@pixacomms.com.
Two different roles
This matters, because it decides who you ask about what.
- For your account - your name, email, password and billing - we are the controller. This notice covers it.
- For the documents you send and the people who sign them we are a processor. You decide what to send and to whom; we act on your instructions. The terms of that are in our data processing agreement. If you have signed something through Pixasign and want to know why, ask the business that sent it to you.
What we hold
- Account: your name, email address, a hashed password, and if you turn it on, a two-factor secret. We never store your password itself.
- Documents: the files you upload, their titles, and SHA-256 hashes of the original and sealed versions.
- Recipients: the name and email of each person you ask to sign, a single-use signing link, and when they opened and signed.
- Evidence trail: for each document event we record who acted, when, their IP address, an approximate location derived from it, and their browser user-agent string. These are hash-chained so the record cannot be quietly altered. This is the point of the product: without it a signature is a claim rather than evidence.
- Billing: your plan and its status. Card details are handled by Stripe and never reach our servers.
Why, and on what legal basis
- To provide the service you have asked for, and to bill you for it - performance of a contract.
- To produce a reliable evidence trail for signed documents - legitimate interests, ours and yours: an e-signature with no evidence behind it is not worth having, and a signatory reasonably expects the act of signing to be recorded.
- To keep accounts secure and investigate misuse - legitimate interests.
- To meet our own legal and accounting obligations - legal obligation.
Where it is held
Pixasign runs on servers provided by Hetzner Online GmbH in Nuremberg, Germany, in data centres certified to ISO/IEC 27001:2022. Encrypted backups are held in Reykjavík, Iceland. Both are in the EEA, which the UK recognises as adequate, so no additional transfer safeguards are required.
Nothing is held in the United States. That is a deliberate choice: the US CLOUD Act lets US authorities compel a US-headquartered provider to produce data held anywhere in the world, and our infrastructure is outside that entirely.
Location lookup for the evidence trail is done on our own server from a local database. An IP address is never sent to a third party to be geolocated.
Who else sees it
| Who | What for | What they get |
|---|---|---|
| Hetzner Online GmbH (Germany) | Hosting | Everything, at rest on their infrastructure |
| Stripe Payments Europe | Card payments and subscriptions | Your billing details. We never see your card number |
| Brevo (Sendinblue, France) | Sending signing invitations and account email | Recipient name, email address and the message |
We do not sell personal data, and we do not use it to train anything. We do not run advertising trackers.
Cookies
Pixasign sets only the cookies it needs to work: a session cookie so you stay signed in, and a preference cookie for your chosen theme. There are no advertising or analytics cookies, which is why you are not asked to consent to any.
How long we keep it
- Documents and their evidence trail: for as long as your account is open, because the evidence is the reason the document exists. Delete a document and we remove it and its file within 30 days.
- Account data: until you close your account, then 30 days, then deleted.
- Billing records: six years, which UK tax law requires.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing, or ask for it in a portable form. Email privacy@pixacomms.com and we will answer within one month.
If you signed a document sent to you by one of our customers, they decide what happens to it. Ask them first; we will help them respond.
If you are not happy with how we have handled it you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you told us first so we can put it right.
Changes
If we change this notice materially we will tell account holders by email before it takes effect.