Privacy Policy

We collect the following kinds of information:

• Account information, such as your name, email address, and password, when you register.
• Billing information processed through our payment provider; we do not store full payment card details on our own systems.
• Documents and signing data, including the files you upload, signature and form field entries, and the details of recipients you invite.
• A PDF selected through a public upload tool may be held temporarily before you create or sign in to an account so Inkly can continue that upload after authentication.
• Audit and verification data, such as timestamps, email addresses, and IP addresses connected to the signing process.
• Usage and device information, such as log data, browser type, and how you interact with the service.

We use the information we collect to:

• Provide, maintain, and improve the service, including processing and storing your documents and signatures.
• Generate audit trails that record how and when documents were signed.
• Process payments and manage your subscription.
• Communicate with you about your account, support requests, and service updates.
• Protect against fraud, abuse, and security threats, including automated screening of signature requests that can pause sending from an account until we review it, and comply with our legal obligations.

We do not sell your personal information. We share it only as needed to operate the service or as required by law:

• With service providers who help us run Inkly, such as hosting, email delivery, payment processing through Stripe, and automated spam and fraud screening, under agreements that require them to protect your data.
• With the senders and recipients involved in a signing transaction, as necessary to complete it.
• When required by law or legal process, or to protect the rights, safety, and property of Inkly, our users, or others.
• In connection with a merger, acquisition, or sale of assets, with appropriate protections in place.

We keep your information for as long as your account is active and as needed to provide the service. Completed documents and audit trails may be retained to preserve their evidentiary value and to meet legal obligations.

A PDF uploaded before authentication can be connected to an account for one hour. The direct Supabase upload authorization lasts two hours, so the private temporary copy becomes eligible for deletion only after that authorization and a short safety margin have expired. Bounded opportunistic and daily jobs then remove it; failed Storage deletions are retried with backoff.

You can delete documents from your account, and you may request deletion of your account by contacting us, subject to any retention we are legally required to maintain.

We use technical and organizational measures designed to protect your information, including encryption in transit and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

We use cookies and similar technologies to keep you signed in, remember your preferences, continue a temporary PDF upload after authentication, and understand how the service is used. Temporary upload cookies are HTTP-only, expire after one hour, and contain an unguessable claim secret rather than document contents. You can control cookies through your browser settings, although some features may not work properly without them.

If you connect your Google account, Inkly can import PDF files from your Google Drive into your workspace, and, on paid plans, save completed signed PDFs and their Certificates of Completion back to an Inkly folder in your Drive. Connecting is optional, and the connection belongs to your individual profile rather than your workspace.

• Access is limited to Google's openid, email, and drive.file scopes. drive.file lets Inkly open only the files you pick in Google's file picker and the files Inkly itself creates in your Drive; it cannot browse or read anything else in your Google Drive.
• Importing a file downloads the PDF you choose in your browser and uploads it to Inkly the same way a file from your computer would be. Inkly does not keep the Drive original in sync, and never edits, moves, or replaces it.
• Saving a completed document uploads the signed PDF and its Certificate of Completion to an Inkly folder that Inkly creates in your Drive. If that folder is later deleted, Inkly creates a new one the next time it saves a document.
• We store your connected Google account's email address and account ID, and a refresh token encrypted with AES-256-GCM, on our servers. Short-lived access tokens are not stored, and none of these credentials reach your browser, except a short-lived access token used only to open Google's file picker while you import a file.
• Inkly never deletes files it has saved to your Google Drive, including exported signed PDFs and certificates, even if the related document or your Inkly account is later deleted.

You can disconnect Google Drive at any time from Account settings → Integrations. Disconnecting revokes Inkly's access with Google and deletes the stored refresh token; if Google is temporarily unreachable, we retry the revocation for up to 7 days. Files already saved in your Google Drive are unaffected, and deleting your Inkly account also revokes this access.

If your organization uses Google Workspace, your administrator can block third-party apps, including Inkly, from connecting. If that happens, ask your administrator to allow Inkly before you connect.

Inkly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell Google user data, use it for advertising, or use it to develop, improve, or train generalized artificial intelligence or machine learning models. No one at Inkly reads it except with your permission, to investigate security or abuse, or to comply with the law.

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing.

To exercise these rights, contact us at hello@inkly.so. We may need to verify your identity before we respond.

Your information may be processed in countries other than the one where you live. When we transfer data across borders, we take steps to ensure it stays protected in line with applicable law.

Inkly is not intended for use by children, and we do not knowingly collect personal information from anyone under 18. If we learn that we have done so, we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will take reasonable steps to notify you, and the updated policy will govern our handling of your information going forward.

If you have questions about this Privacy Policy or how we handle your information, contact us at hello@inkly.so.