Privacy Policy - How We Handle Your Data

1. Introduction

NomaSign is operated by YouSource SA (Pty) Ltd ("NomaSign", "we", "us", or "our"). We collect personal information when you use our digital signing platform. This policy explains what we collect, why, and what choices you have.

We operate under South Africa's Protection of Personal Information Act (POPIA). If you're in the EEA or UK, GDPR applies to you as well.

NomaSign lets you send documents out for signature, keeps track of who signed and when, and returns the completed version to you. Every step is recorded in an audit trail for your documents (see section 2.2).

2. What Information We Collect

2.1 Information You Provide

When you create an account, we ask for your name and email address. A company name is optional. If you subscribe to a paid plan we also need billing details. Your payment card numbers go straight to our payment processor though, and are never stored on our servers.

When you kick off a signing workflow, you upload documents and provide recipient details along with whatever message you want to include. If you use our browser extension, it recognises PDFs inside your browser and only sends a file, and the address it was opened from, when you choose to send it for signing. Records of support conversations and any feedback you send us are kept too.

2.2 Information Collected Automatically

Our servers log certain technical data automatically. Which pages you visit, which features you use, device information, browser type, IP address, and the times you access the service. That data is used for troubleshooting, security monitoring, and to understand how the product gets used in practice.

Signing activity is logged in more detail, because that record is the proof of what happened and when. For every signing workflow the audit trail contains:

the name and email address of the sender and of each recipient
each event with its exact time: invitation sent, document viewed, terms accepted (and which version), signed or declined
the IP address, browser details and a device identifier of the person behind each event
a cryptographic fingerprint of the document before and after each signature, so any later change can be detected

The audit trail is also embedded in the signed PDF itself, so it travels with the document.

2.3 Your Google or Microsoft Account

You sign in to NomaSign with your Google or Microsoft account. When you register or sign in, your provider shows you which permissions NomaSign asks for, and you decide whether to grant them. We use those permissions only to provide the features you use, such as storing and retrieving your documents, sending signing invitations from your own mailbox, and suggesting contacts when you add recipients. We don't scan, index or sync your files, mailbox or contacts in the background.

You can withdraw these permissions at any time in your Google or Microsoft account settings. Features that depend on them stop working until you grant them again.

3. How We Use Your Information

Most of it is used to actually run the service you signed up for. That means managing your account, sending signature requests on your behalf, firing off reminders, and generating audit trails so your signed documents have proper legal standing.

It also helps us process payments and handle billing, and to provide support when you need help. Activity patterns get monitored so we can spot fraud and stop abuse of the platform.

Usage data helps us make the product better: it shows us what's working well, what's slow, and where people get stuck. It also tells us which of our marketing brings people to NomaSign (see section 7). We may email you about product updates and offers. Every one of those emails has an unsubscribe link.

Some records we're simply required to keep for tax, legal, and compliance reasons.

4. Legal Basis for Processing (GDPR Users)

For users in the EEA or UK, GDPR requires a lawful basis for processing personal data. Most of what we do falls under contractual necessity. We need your information to deliver the service you're paying for. Legitimate interests covers security measures, fraud prevention, and product improvements. Where we're legally required to keep records, that's legal obligation. For optional things like analytics and advertising cookies on our website we rely on consent.

One important note. If someone sent you a document to sign through NomaSign, that person (or their organisation) is the data controller (the "responsible party" under POPIA). They decide why and how your data is processed for that transaction. NomaSign acts as the processor (the "operator" under POPIA), providing the technical infrastructure underneath.

5. Where Your Documents Are Stored

This was a deliberate design choice. Your documents stay in your own cloud storage (Google Drive, OneDrive, SharePoint, etc.), not on our servers, and keep whatever security settings you have configured there. We don't keep copies of your documents. While a workflow runs, a document may pass through our systems, for example to deliver it as an email attachment, and any temporary copy is deleted automatically. The only exception is when you ask us or give us permission to keep one, for example so we can investigate a support issue with a specific document.

What we do hold onto is your account information and the audit trail described in section 2.2.

Your data is stored encrypted and hosted in South Africa. Data in transit is encrypted with TLS. Authentication is secured, access is role-based, and activity logs are kept.

6. Cookies

We use cookies, and similar technologies such as your browser's local storage. They fall into three groups:

Essential. These keep you signed in, keep your account secure and remember choices such as your cookie preference. The service doesn't work without them.
Analytics. These show us how the website and app are used, so we can improve them.
Advertising measurement. These tell us which of our ads and campaigns lead people to sign up or buy (see section 7).

On our website, analytics and advertising tools only set cookies after you allow us. Until then they receive only cookieless signals that don't identify you.

7. Analytics and Advertising

We advertise NomaSign online and measure which ads work. For that we use how you navigate our website and app: which pages you visit, which link or ad brought you there, and whether you signed up or bought a plan.

We never use your documents or their contents, the people you send documents to, or the files, emails and contacts in your Google or Microsoft account for advertising or marketing, unless you or they give us permission (for example, when they register themselves).

8. Who We Share Data With

We don't sell your personal information. Full stop.

Some information is shared with service providers who help us run NomaSign, only as far as they need it to do their job, and under agreements that require them to protect it. They fall into these categories: hosting and infrastructure, payment processing, invoicing and accounting, email delivery, analytics and advertising, and error monitoring and security.

When you send a document for signing, the recipient sees your name, email address, and whatever message you included. If we get a valid legal request (a subpoena or court order, that kind of thing), we comply. And if NomaSign is ever acquired or merged, user data would form part of that transaction.

Outside of those situations, your information is only shared when you specifically ask us to share it. Setting up an integration with another service is the typical example.

9. Your Rights

Depending on where you live, privacy laws may give you various rights over your personal information. You might be able to request a copy of the data we hold about you, or ask us to fix inaccuracies, or request deletion (though we may need to keep some records for legal reasons). Other possibilities include data portability, objecting to certain processing, and withdrawing consent.

To act on any of these, email . Most responses go out within 30 days. Complex requests or legal constraints can take longer.

10. How Long We Keep Data

Personal information is retained for as long as it's needed to operate the service, maintain security, resolve disputes and meet legal requirements. Your account data stays as long as your account is active. After you close the account, most of it gets deleted, unless we're legally required to keep it or have a legitimate business reason (resolving a billing dispute is the obvious one).

Documents themselves live in your own cloud storage, not ours. Audit trail data (who signed what and when) is kept for a period of time to support the integrity of signed transactions. Security logs stay around for monitoring and troubleshooting.

Want something deleted sooner, or want to know what we still have on file? Drop us an email and we'll explain what's possible.

11. International Transfers

A few of our service providers operate outside South Africa, which means your information may be processed in other countries. When that happens, appropriate safeguards are put in place and providers are contractually required to protect your data.

12. Children

NomaSign is meant for users 18 and older. We don't knowingly collect information from children. If you think a minor has created an account or submitted personal information, let us know so we can sort it out.

13. Policy Updates

This policy may change as the product evolves or when the law requires it. Updated versions go up on this page. For material changes we may also notify you by email or inside the application.

14. Contact

Questions about this policy or want to exercise your privacy rights? Email us at .

If you're not satisfied with our response, you can contact your local data protection authority. In South Africa, that's the Information Regulator.