Privacy Policy

Last updated: 2026-10-15

This Privacy Policy explains how BENJO Sign (the "Service", "we", "us"), an electronic signature service available at sign.bybenjo.com, collects, uses, shares and protects personal data. It applies to the businesses and people who open an account ("Account Owners" and their team members) and to the people who receive documents to sign ("Signers"). A Hebrew version is available at /privacy; both versions have the same content.

1. Who we are

The Service is operated by BENJO Sign (the "Company"). For any privacy question or request, contact us at office@ehud-golan.com.

2. Our role: controller and processor

• Account data (who you are, your login, billing and how you use the Service): we are the controller.
• Documents and Signer data (the files an Account Owner uploads, the people they send them to, what Signers fill in and sign, and the audit trail): we process these on behalf of the Account Owner, who decides what to send, to whom and why. For this data the Account Owner is the controller (the "database owner" under Israeli law) and we act as its processor (holder). If you are a Signer and want to exercise your rights over a document you received, please contact the business that sent it to you; we will help them respond.

3. Data we collect

3.1 From Account Owners and team members

• Account details: name, email address, organization name, language and time zone, your role in the organization, and the team members you invite.
• Sign-in data: one-time email login codes and, if you set one, a password — stored only as salted hashes; session records (creation and expiry time).
• Content you add: documents (PDF / DOCX) and templates, field layouts and {placeholders}, recipients' names, email addresses and phone numbers, messages to signers, logos, stamps and branding, and — if you upload one — your organization's signing certificate.
• Integration settings: API keys (stored hashed; only a short prefix is shown), webhook and callback URLs, webhook secrets and custom header values (stored encrypted), and the delivery log of webhook calls (time, status code, duration).
• Google account connection (optional): the email address of the Google account you connect and the OAuth tokens Google issues — see section 6.
• Technical data: IP address, browser user agent and request times in security and server logs; rate-limit counters (kept as one-way hashes of the IP address).
• Billing data (when paid plans are offered): plan, invoices and billing contact. Card details are handled by our payment provider and are not stored by us.

3.2 From Signers

• Details provided by the sender: your name, email address and, where used, phone number.
• What you enter: field values, your drawn, typed or uploaded signature and initials, photos or files you attach, comments, change requests and reasons for declining. Answers you have started but not submitted are saved on our server so you can continue later.
• Verification: if the sender requires it, a one-time code sent to your email or phone (we keep only a hash of the code and the result of the check).
• Audit trail: for every step (opened, viewed, downloaded a review copy, signed, commented, declined) we record the time, your IP address, your browser user agent, your device's time zone and, where the operator has enabled an offline IP-to-location database, an approximate location (country / city) derived from the IP address. No precise (GPS) location is ever requested. This audit trail is printed on the certificate page of the signed PDF and is part of the evidence of signing.
• Public signing links: if you start a document from a business's public signing link, the details you enter and a functional cookie that lets the same browser return to the same document.

4. How we use data

• To provide the Service: preparing documents, sending invitations, reminders and signed copies, collecting signatures, producing the signed PDF with its audit trail and digital signature, and delivering webhooks and callbacks to the URLs the Account Owner configured.
• To authenticate users and Signers, prevent fraud and abuse, and keep the Service secure (rate limiting, logs, verification codes).
• To provide support when you ask for it, and to send service and account notices (for example, a paused webhook or a retention notice).
• To comply with legal obligations and to establish, exercise or defend legal claims (for example, the evidential value of the audit trail).
• To operate and improve the reliability of the Service using aggregated, non-content metrics (such as error rates and counts of documents).

We do not sell personal data, do not use it for advertising or profiling, do not read the content of your documents except as described in section 10, and do not use your documents, Signer data or Google user data to train artificial-intelligence or machine-learning models.

5. Legal bases

Under the Israeli Protection of Privacy Law, 5741-1981 and its regulations (including Amendment No. 13), we process personal data for the purposes described in this policy, which are disclosed to you at collection. For people in the European Economic Area, the United Kingdom or Switzerland, our legal bases under the GDPR are:

• Contract — to provide the Service to Account Owners (Art. 6(1)(b)).
• Legitimate interests — security, fraud prevention, keeping an audit trail of signing, and improving reliability (Art. 6(1)(f)).
• Legal obligation — for example, tax and accounting records (Art. 6(1)(c)).
• Consent — for connecting a Google account and any optional feature that asks for it; you may withdraw consent at any time (Art. 6(1)(a)).

For Signer data we process on behalf of an Account Owner, the Account Owner is responsible for having a valid legal basis and for informing Signers.

6. Google user data

Account Owners may optionally connect a Google account. We request only the following scopes, each for the stated purpose only:

What we store

• The OAuth access and refresh tokens, encrypted at rest (AES-256-GCM) with a key kept separately from the data; the connected email address; and the ID of the Drive folder the Service created.
• For a file you pick in the Picker: the file's content is copied into your organization's documents, exactly as if you had uploaded it, under its file name. We do not keep a link to the file in your Drive.
• For email sent through Gmail: the same delivery record the audit trail keeps for any email (recipient, time, status and the Gmail message ID). Google keeps a copy of the sent message in your Gmail "Sent" folder, as it does for any message you send.

Disconnecting and deletion

• You can disconnect your Google account at any time in the dashboard settings. When you do, we revoke the tokens with Google and delete them from our systems immediately.
• You can also revoke access at any time at myaccount.google.com/permissions; the Service then stops being able to use your Google account, and we delete the stored tokens when we detect the revocation or when you disconnect.
• When you delete your account, all Google tokens and Google-related settings are deleted. Files already saved to your Drive belong to you and stay in your Drive; we do not delete them.

Limited Use

BENJO Sign's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• We use Google user data only to provide and improve the user-facing features described above, which are visible in the Service's interface.
• We do not use Google user data for advertising, including personalized, retargeted or interest-based advertising.
• We do not sell Google user data, and we do not transfer it to third parties except as needed to provide the features above, to comply with law, or as part of a merger or acquisition with notice to you.
• No human reads Google user data unless you give us explicit consent for specific data (for example, a support request), it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data is aggregated and anonymized for internal operations.
• We do not use Google user data to develop, improve or train generalized or non-personalized artificial-intelligence or machine-learning models.

7. Sharing and sub-processors

We share personal data only as needed to run the Service:

• Hosting and infrastructure: [HOSTING PROVIDER] — servers and storage where the Service and its data are hosted.
• Email delivery: [EMAIL PROVIDER] — sends login codes, signing invitations, reminders and signed copies when the Account Owner has not connected Gmail.
• SMS (only if a sender uses phone verification): [SMS PROVIDER] — delivers one-time codes.
• Google — only when an Account Owner connects a Google account, to send email through Gmail and save or open files in Drive, as described in section 6.
• The Account Owner's own systems: webhooks and callbacks deliver document events (and, where configured, short-lived download links to the files) to the URLs the Account Owner sets. Those systems are controlled by the Account Owner, not by us.
• Other parties to a document: the sender and the other Signers of the same document see the completed document and its audit trail.
• Legal and safety: authorities or courts when required by law, or to protect rights, safety and the integrity of the Service; and a successor in a merger or acquisition, subject to this policy.

Sub-processors are bound by written agreements that require confidentiality and appropriate security. We do not sell or rent personal data.

8. International transfers

The Service is operated from Israel, which the European Commission recognizes as providing an adequate level of data protection. Our servers are located in [HOSTING REGION]. Some providers (including Google and our email provider) may process data in other countries. Where data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. Transfers out of Israel are made in accordance with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001.

9. Retention

• The files of signed documents (the signed PDF, the audit certificate, signatures and attached files) are kept on our servers for 90 days after the document is completed — or a shorter period of at least 30 days that the Account Owner chooses — and are then deleted automatically. Before files that are not saved in Google Drive are deleted, the Account Owner is emailed twice (14 and 3 days before). A record of the document remains (its name, the signers, the time of each step, file fingerprints (hashes) and the audit log of events), so the Account Owner can still show what was signed, when and by whom. If the Account Owner connected Google Drive, a copy is also saved to the owner's Drive, where it stays under the owner's control. Account Owners are responsible for keeping their own copies (download, Drive or the API) for as long as they need them.
• Documents that were not completed (expired, declined or cancelled) have their files deleted on the same schedule, counted from when they were closed (with the same two email notices); the same record remains. Account Owners may delete documents earlier at any time.
• Account data is kept while the account is active and deleted within [ACCOUNT DELETION PERIOD] after the account is closed, except what we must keep by law (for example, invoices).
• Google tokens are deleted immediately on disconnection or account deletion.
• Security and server logs are kept for up to [LOG RETENTION PERIOD]; backups roll over within [BACKUP RETENTION PERIOD].

10. Security

• All traffic is encrypted in transit (HTTPS/TLS).
• Stored files are encrypted at rest (AES-256-GCM) with a separate key per organization; those keys, signing certificates, webhook header values and Google tokens are sealed in an encrypted vault.
• Each organization's data is kept in its own separate database; accounts are kept in a separate accounts database.
• Passwords, login codes, verification codes and API keys are stored only as one-way hashes; webhooks are signed (HMAC) so the receiver can verify them.
• Strict content-security policies, origin checks, rate limiting and protection against requests to internal networks.
• Our staff do not access the content of your documents, except when you explicitly grant support access, when needed for security (for example, investigating abuse), or when required by law.

No system is perfectly secure. If we become aware of a security incident affecting your personal data, we will notify you and the competent authorities as required by law.

11. Your rights

Israel. Under the Protection of Privacy Law, 5741-1981 (including Amendment No. 13), you have the right to access personal data about you held in a database, to request correction or deletion of data that is inaccurate, incomplete, unclear or out of date, and to ask to be removed from any direct-mailing list. You may also file a complaint with the Privacy Protection Authority.

EEA, UK and Switzerland. Under the GDPR you also have the right to erasure, restriction of processing, data portability, to object to processing based on legitimate interests, to withdraw consent at any time, and to lodge a complaint with your local supervisory authority.

To exercise any right, email office@ehud-golan.com. We may need to verify your identity, and we respond within 30 days (or the period required by law). Account Owners can also view, export and delete their data and documents directly in the dashboard. Signers should contact the business that sent the document (see section 2); we will assist that business.

12. Cookies

We use only strictly necessary cookies:

• a session cookie that keeps Account Owners signed in to the dashboard (HTTP-only, same-site); and
• on a business's public signing link, a functional cookie that lets the same browser return to a document it started.

We do not use analytics, tracking or advertising cookies, and we do not load third-party trackers. These public pages set no cookies at all.

13. Children

The Service is intended for businesses and is not directed at children. Accounts may be opened only by people aged 18 or over. We do not knowingly collect personal data from children under 16 for our own purposes; if you believe a child has provided us with personal data, contact us and we will delete it. An Account Owner who sends a document to a minor is responsible for obtaining any consent required by law.

14. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows the latest version. If we make material changes, we will notify Account Owners by email or in the dashboard before they take effect. Any change to how we use Google user data will be made only in line with Google's policies and, where required, with your renewed consent.

15. Contact

BENJO Sign
Email: office@ehud-golan.com