Privacy notice

This explains what we do with personal data when you use Pixasign, who we share it with, where it is held and how long we keep it. Last updated 19 October 2026.

If we sent you a sales email about Pixasign, read If we emailed you about Pixasign first.

Who we are

Pixasign is a service of Pixacomms Ltd, registered in Wales, company no. 15861826. Registered office: Dunleavy House, Dunleavy Drive, Cardiff CF11 0SN. For questions about this notice or your data, email hello@pixasign.co.uk.

If we emailed you about Pixasign

This part is for you if we sent you a sales email about Pixasign. You did not give us your details. We found them. Here is where, what we do with them, and how to stop us.

Pixacomms Ltd is the controller for this data. Our details are under “Who we are”, above.

Where we got your details

• Companies House. The public register of UK companies. It gives us your company's name, number, registered address, incorporation date and business activity codes, and the name of one of its officers, such as a director.
• Your company's own website. The business email address published there, and sometimes the name and job title of the person it belongs to.

Sometimes we work out a likely address from a name on Companies House and the company's web address. We never email an address we have only worked out.

We do not buy lists or use data brokers.

We only email companies

We only send these emails to companies and limited liability partnerships registered at Companies House. Our system will not write to anyone without a company number. It will not write to a personal address at Gmail, Outlook.com, Yahoo and the like.

We do this because the rules on unasked-for marketing email are stricter for individuals and sole traders than for companies.

What we hold

• Your name and job title, as your company's website or Companies House gives them.
• Your business email address, and the web page we found it on.
• Your company's details from Companies House, and its website.
• Short notes about what your company does, how big it is and how it signs documents now, written from its website with the help of AI software (see “Who else sees it”). We use them to decide whether to write to you and what to say.
• Whether your address passed our check that it can receive mail. That check runs on our own server. It does not read your mail.
• What we sent you and when, whether it bounced, and whether you replied or asked us to stop. If you replied, we keep your reply, and a short note of what came of it.

Our emails carry no tracking pixel, so we cannot tell whether you opened one.

Why we use it, and on what legal basis

To tell businesses about Pixasign, our e-signing service, by email.

Our legal basis is legitimate interests, under Article 6(1)(f) of the UK GDPR. It is not consent. You did not give us consent, and we do not claim you did.

The balance, in three lines:

• Our interest: finding business customers for Pixasign.
• The cost to you: one unasked-for email at work, and at most two follow-ups.
• Why we think it is fair: we write only to companies, at an address the business published, and every email says who we are and how to stop.

If you disagree, you can object. For marketing, your objection is final.

How to stop us

Reply to our email, from the address we wrote to. Put one of these in the subject or the first line:

unsubscribe, no thanks, remove me, opt out, not interested or please stop.

You do not need to give a reason.

• Our system checks for replies automatically. If your first reply to us uses one of those words, your address goes on our do-not-contact list at the next check, normally within one working day, and stays there for good.
• Any first reply from that address, whatever it says, stops our follow-ups. An automatic reply, such as an out-of-office, does not.
• Our system acts only on your first reply. If you have already replied to us once, email us instead, as below.

Or email hello@pixasign.co.uk and tell us which address to remove.

We keep your address on the do-not-contact list for good. It is the only way to be sure we never write again. We use it for nothing else.

Who else sees it

• Microsoft. Our sales email is sent and received through Microsoft 365, from Microsoft Ireland Operations Ltd. Every message we send you, and every reply, is stored there. So is any email you send to hello@pixasign.co.uk.
• Cloudflare, Inc. If you email hello@pixasign.co.uk, Cloudflare receives the message and passes it to our Microsoft 365 mailbox.
• Anthropic. We used its AI software, Claude, to read company websites, find and check the published contact details, and write the notes above. The pages it read, including your name and email address where they appear on them, were processed by Anthropic.
• A server we rent in Iceland. It holds the records above and runs the mail check.
• Hetzner Online GmbH, Germany. Each night a backup of those records is copied, over an encrypted connection, to the server Pixasign runs on. A copy may also go to a company computer in the UK over an encrypted private link.
• Telegram. When you reply, our system sends us an alert through Telegram, a messaging service. The alert shows your email address, your company's name and the start of your reply.

We do not sell your data. We do not pass it to anyone for their own marketing.

Where it goes

• Iceland and Germany are in the EEA. The UK treats the EEA as adequate, so no extra safeguard is needed.
• Microsoft and Cloudflare may process data in the United States. Both are certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), which is the safeguard UK law recognises for transfers to certified US companies.
• Anthropic processes data in the United States. Its own privacy policy says it protects transfers from the UK with standard contractual clauses in the form approved for the UK.
• Telegram is run from outside the UK and the EEA, and we have no transfer agreement with Telegram for these alerts. No other UK transfer safeguard covers them either.

How long we keep it

What decides how long we keep each record is what it is for, so this is set out record by record. Wherever a record below has no end date yet, it is kept until you ask us to delete it, apart from the do-not-contact list. “Your other rights”, below, says how to ask.

• If we never prepared an email to you: your contact record is deleted 12 months after we last updated it. The Companies House details we hold on your company, including an officer's name and the email address we found, stay with the company's record, which has no end date yet.
• If we prepared or sent one: kept, with what we sent, and we have not yet set an end date. It is kept for two reasons: so we can show what we sent you, and when, if you ask or complain; and so we never write to you again as if you were new.
• The do-not-contact list: kept for good, on purpose.
• Copies: our nightly backups keep copies for a while after a record is deleted. The research files behind our list, which hold the same details, are kept on a company computer in the UK, also with no end date yet.

Your other rights

You can also ask for a copy of what we hold, ask us to correct it, ask us to delete it, or ask us to limit how we use it. “Your rights”, below, says how, and how to complain to the Information Commission. If you ask us to delete your data, we delete your record but keep your email address on the do-not-contact list. That is what stops us writing again.

Automated decisions

Our system, with the AI software named above, chooses which companies to email, and which version of the email to send, from each company's line of business and our notes on it, as Companies House and its website give them. It makes no decision about you that has a legal or similarly significant effect.

Three different roles

This matters, because it decides who you ask about what.

• For your account (your name, email, password and billing) we are the controller. This notice covers it.
• For the documents you send and the people who sign them we are a processor. You decide what to send and to whom; we act on your instructions. That includes the evidence trail recorded while a document is signed: we keep it on your behalf, and the legal basis for it is yours. The terms of that are in our data processing agreement. If you have signed something through Pixasign and want to know why, ask the business that sent it to you.
• If we sent you a sales email about Pixasign we are the controller. See If we emailed you about Pixasign.

What we hold

• Account: your name, email address, a hashed password, the two-factor secret that every account must set up, and hashed recovery codes. We never store your password itself.
• Documents: the files you upload, their titles, and SHA-256 hashes of the original and sealed versions.
• Recipients: the name and email of each person you ask to sign, a single-use signing link, and when they opened and signed.
• Evidence trail: for each document event we record who acted, when, their IP address, an approximate location derived from it, and their browser user-agent string. Each event is hash-chained to the one before, and the chain's final value is printed on the evidence certificate every party is sent, so a later change to the record would not match their copy. This is the point of the product: without it a signature is a claim rather than evidence.
• Billing: your plan and its status. Card details are handled by Stripe and never reach our servers.
• Server logs: every web server keeps a record of requests, and ours is no exception. We write the page requested, the time, the browser, the page that linked to it if the browser sends one, and whether the request succeeded. The visitor's IP address is shortened before it is written, so a visit can be counted without a visitor being identified, and the full address never reaches disk. Server access logs are rotated as they grow, and rotated files are deleted after 30 days. Application logs are capped in size and overwritten as they fill. We use them to count visits and to keep the service running.

Why, and on what legal basis

• To provide the service you have asked for, and to bill you for it: performance of a contract.
• The evidence trail for signed documents is recorded for the business that sent the document, as its processor, so the legal basis for it is that business's, not ours. See “Three different roles”, above.
• After a document is deleted, keeping the fingerprint of the sealed file and the serial number and issuer of its DigiCert timestamp, so that pixasign.co.uk/check can still tell a genuine Pixasign document from a changed or imitation one: legitimate interests, ours and those of anyone relying on the document.
• To keep accounts secure and investigate misuse: legitimate interests.
• To meet our own legal and accounting obligations: legal obligation.

Where it is held

Pixasign runs on servers provided by Hetzner Online GmbH in Nuremberg, Germany, in data centres certified to ISO/IEC 27001:2022. Encrypted backups are held in Reykjavík, Iceland. Both are in the EEA, which the UK recognises as adequate, so no additional transfer safeguards are required.

Your documents and their evidence trail are stored on our servers in Germany, with backups in Iceland. Card payments are handled by Stripe, and email is sent through Brevo; both are listed below.

Three of the companies listed below may handle personal data in the United States: Stripe (billing data only), Cloudflare (email sent to hello@pixasign.co.uk) and Microsoft (our mailbox). Each is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), which UK law recognises as a safeguard for transfers to certified US companies. Stripe also uses the UK International Data Transfer Addendum where a contract is needed.

Location lookup for the evidence trail is done on our own server from a local database. An IP address is never sent to a third party to be geolocated. Approximate location uses GeoLite2 data created by MaxMind, available from maxmind.com.

Who else sees it

We do not sell personal data, and we do not use it to train anything. We do not run advertising trackers.

Cookies

Pixasign sets only the cookies it needs to sign you in securely and to take you through sign-up and payment. There are six, and you only get the ones for what you do: someone reading the website or signing a document sent to them gets none. All six are set by pixasign.co.uk itself, none of them can be read by scripts on the page, and none is used for advertising or to follow you to other sites.

There are no advertising or analytics cookies, which is why you are not asked to consent to any. These six are strictly necessary for a service you have asked for. We count visits from our own server logs instead, described above, which need no cookie and involve no third party.

Saved on your device, not in a cookie

When you prepare a document to send, Pixasign keeps a draft in your browser's own storage (local storage), so the work survives if the page closes. It holds the document's title, the email subject and message you wrote, the names and email addresses of the people you added, the signing order, where you placed each field, and the PDF's file name, size and page sizes. It does not hold the document itself, and it is not sent to us. It is removed when you send the document or discard the draft, and only the four most recent drafts are kept. Signing out does not remove it and it has no expiry date, so on a shared computer, discard the draft or clear the site data for pixasign.co.uk (below).

Removing them, or not having them

Because the six cookies are needed for the service to work, there is nothing to opt in to on this site, and no cookie banner. You can still remove them, or opt out of them altogether:

• Sign out. Signing out removes the sign-in cookie. The others expire on their own after the times above.
• Delete them in your browser. Every browser lets you see and delete the cookies for one site: in Chrome, Edge, Firefox and Safari, look in the settings under privacy or site data and search for pixasign.co.uk. Clearing the site data for pixasign.co.uk removes the saved drafts too.
• Block them. You can tell your browser to block cookies from pixasign.co.uk. The website will still work, and you can still sign a document sent to you, but you will not be able to sign in to an account.

How long we keep it

• Documents and their evidence trail: for as long as your account is open, because the evidence is the reason the document exists. To have a document deleted, email hello@pixasign.co.uk. When we delete a document we keep only the SHA-256 fingerprint of the sealed file and the serial number and issuer of its DigiCert timestamp, so pixasign.co.uk/check can still recognise it. None of them reveals what the document says.
• Account data: for as long as your account is open. To have your account and its data deleted, email hello@pixasign.co.uk. The fingerprints of its sealed documents are kept, as above.
• Billing records: six years, which UK tax law requires.
• Backups: once something is deleted, its copies in our encrypted backups are removed as the backups roll over, which completes within 90 days, as our data processing agreement says.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to limit how we use it, object to processing, or ask for it in a portable form. Email hello@pixasign.co.uk and we will answer within one month.

To have an account you need to give us your company's name, your name, your email address and a password, and set up two-factor sign-in. A paid plan also needs billing details, which Stripe collects. Without them we cannot provide the service.

If you signed a document sent to you by one of our customers, they decide what happens to it. Ask them first; we will help them respond.

Complaints about how we use your data

To complain about how we have handled your personal data, email hello@pixasign.co.uk with “Data protection complaint” in the subject, and say what happened. We acknowledge every data protection complaint within 30 days of receiving it, look into it, and tell you the outcome without undue delay. A request to use one of your rights above is answered within one month, as it says there.

If you are not happy with how we have handled it you can complain to the UK data protection regulator, the Information Commission (still known as the ICO), at ico.org.uk, though we would rather you told us first so we can put it right.

Changes

If we change this notice materially we will tell account holders by email before it takes effect.