Privacy Policy

BuiltSign is a registered trade name of Crul.Dev, a sole proprietorship registered at the Dutch Chamber of Commerce under number 97533114 ("we", "our", or "us").

We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our document signing platform. Crul.Dev, trading as BuiltSign, is the data controller within the meaning of the General Data Protection Regulation (GDPR).

By using BuiltSign, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this privacy policy, please do not access the service.

Personal Information

We may collect the following types of personal information:

• Account Information: Name, email address and password when you create an account and, if you add them, your company name and phone number.
• Payment Information: Payment details and billing address (processed securely through Mollie). For a Dutch billing address we look up the street and city in the public Basisregistratie Adressen en Gebouwen (BAG) of the Kadaster, through PDOK. We only send the postcode and house number, never your name, email address or IP address.
• VAT Information: The VAT rate you pay depends on the country where you live or are established. To determine that country and to be able to show it to the tax authorities, we record at checkout and with every payment: the country of your billing address, the country of your IP address (provided by our hosting provider Vercel), the country of your payment method as reported by Mollie (the country where your card was issued, the country of your bank account or, if neither is available, the country Mollie detects during the payment) and the country of your phone number. For this we only keep country codes, not your IP address and not your full account number. If you enter a VAT number, we check it in VIES, the European Commission's validation system, and keep the result together with the name and address VIES returns and the consultation number. Legal basis: legal obligation (VAT legislation). We keep this information for 7 years, or 10 years if we pay the VAT through the One-Stop Shop (OSS). If you believe the country we determined is wrong, email legal@builtsign.com.
• Documents: PDF files you upload for signing, including any personal data contained within them.
• Signature Data: Electronic signatures, IP addresses, and timestamps associated with signing events. For a drawn signature we also record how it was drawn (position, pressure and timing of the pen strokes); we keep this only as evidence in case a signature is disputed.
• Identity check of your account (voluntary): if you choose to have your account checked, our partner Didit B.V. (NL/EU) processes your ID document and a selfie. BuiltSign only keeps the name on the document, the type of document and the date of the check, and shows that name and date to recipients of your requests and in the certificate. We do not keep photos, the document number or your date of birth. Legal basis: your consent; you can skip the check and keep using BuiltSign as before.

Automatically Collected Information

• Device and browser information
• IP address and approximate location
• Usage data and analytics
• Cookies and similar tracking technologies
• Where your signup came from: whether you came through an ad and from which page (without an identifier, for everyone), and after consent also the campaign, the referring site and the Google Ads click id. We only use this to measure which campaigns work.

We determine the city, region and country for an IP address with a local database from DB-IP (db-ip.com, CC BY 4.0); your IP address is not sent to third parties for this.

We use the information we collect to:

• Provide, maintain, and improve our services
• Process document signing requests
• Create and maintain audit trails for legal compliance
• Process payments and prevent fraud
• Send transactional emails and notifications
• Provide customer support
• Analyze usage patterns to improve user experience
• Comply with legal obligations

Legal Basis for Processing

We process your personal data based on the following legal grounds under Article 6 of the GDPR:

• Contract: Processing necessary to perform our agreement with you (providing document signing services).
• Legitimate Interest: Processing for our legitimate business interests (analytics, security, fraud prevention) where these do not override your rights.
• Legal Obligation: Processing necessary to comply with legal requirements (audit trails, tax records, determining the VAT country).
• Consent: Where you have given explicit consent (marketing communications, optional features).

Your documents and data are stored securely using industry-standard encryption. We use Amazon Web Services (AWS) S3 for document storage with server-side encryption. All data transmissions are protected using TLS 1.3 encryption.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

We retain your personal information for as long as your account is active or as needed to provide you services. Signed documents and audit trails are retained for a minimum of 7 years to comply with legal requirements. If you enter your email address on our website to register but do not finish, we keep that address for at most 30 days (legal basis: legitimate interest) to send you a single reminder; after that it is deleted automatically. You can opt out directly via the link in that email.

You may request deletion of your account and personal data at any time. However, the right to erasure (Article 17 GDPR) is not absolute. We may refuse deletion for data we are legally required to retain, including: (a) signed documents and audit trails necessary to establish, exercise, or defend legal claims (Article 17(3)(e) GDPR); (b) financial and administrative records subject to the 7-year statutory retention obligation under Article 52 of the Dutch General Tax Act (AWR). After the mandatory retention period expires, your data will be permanently and irreversibly deleted.

QuickSign (signing without an account): we process your e-mail address, a one-time confirmation code, the uploaded document, your name and signature as you place them, the recipient's address and any message, and technical data recorded during signing (your IP address and the city, region and country derived from it, your browser, device and time zone, and timestamps). Purpose: placing your signature, delivering the signed document and recording evidence of the signing. For the daily limits against abuse we only use a hashed version of your e-mail address and IP address. Legal basis: performance of the contract and our legitimate interest in evidence and abuse prevention. Seven days after the session starts we automatically delete the document, the signed PDF and the message to the recipient, and we erase your e-mail address and the recipient's from the session data. The evidence of the signing is kept for as long as needed to demonstrate the signing, including your name, e-mail address and signature, the document name, the IP address with the location derived from it, browser, device and time zone data, timestamps, the address you sent the document to, the certificate ID and the document hashes.

We may share your information with:

• Service Providers (sub-processors): Third-party vendors supporting our platform, each contractually bound by Standard Contractual Clauses (SCCs, Commission Implementing Decision EU 2021/914) or adequacy decisions where applicable: Supabase, Inc. (database & authentication, EU Frankfurt, SCC); Amazon Web Services EMEA SARL (object storage, EU Stockholm, Adequacy EEA); Render Services Inc. (backend hosting, EU Frankfurt, SCC); Vercel, Inc. (frontend hosting, EU Frankfurt with global CDN, SCC); Resend, Inc. (email delivery, EU Ireland, SCC); Twilio Ireland Ltd. (SMS verification, EU Dublin, Adequacy EEA); DigiCert Inc. (trusted timestamps, document hash only, US, SCC); hCaptcha by Intuition Machines Inc. (bot protection, EU edge, SCC); Mollie B.V. (payment processing, NL/EU, within EEA); Didit B.V. (identity and biometric verification, NL/EU, within EEA); Upstash, Inc. (rate limiting, EU Frankfurt, SCC); Functional Software, Inc. (Sentry) (error monitoring, technical error data only, EU Frankfurt, SCC). An up-to-date list is available at builtsign.com/legal/subprocessors.
• Signing Parties: Other parties involved in document signing workflows you initiate.
• Legal Requirements: When required by law, regulation, or legal process.
• Business Transfers: In connection with a merger, acquisition, or sale of assets.

We do not sell your personal information to third parties for marketing purposes.

We use mobile numbers only to send the service text messages described in our Terms of Service. We do not sell or share mobile numbers or SMS consent with third parties or affiliates for their marketing or promotional purposes. Twilio processes mobile numbers solely to deliver our messages.

If you are located in the European Economic Area (EEA), you have certain data protection rights:

• Access: Request a copy of your personal data.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your personal data.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to certain processing of your data.
• Restriction: Request restriction of processing.
• Withdraw Consent: Withdraw your consent at any time where processing is based on consent.
• Lodge a Complaint: You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or another supervisory authority in the EU.

To exercise these rights, please contact us at legal@builtsign.com. We will respond to your request within one month.

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

Our service is not directed to individuals under 16 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

We may update this Privacy Policy from time to time. For material changes, we will notify you by email at least 30 days before they take effect. We will also update the "Last updated" date on this page. Continued use of the service after the notice period constitutes acceptance for processing based on contract or legitimate interest. For processing based on consent, we will request renewed consent where required by applicable law.

If you have questions about this Privacy Policy or our data practices, please contact the data controller:

• Email: legal@builtsign.com
• Crul.Dev (trading as BuiltSign)
• Mazustraat 28, 1363 RE Almere, The Netherlands
• KVK: 97533114
• VAT: NL005276049B01