Privacy policy

Who we are

Digital Waivers is operated by Conrado Maggi, Málaga, Spain, trading as Digital Waivers. We are the business responsible for the data described under "Data about account holders" below. We do not have a data protection officer; the operator answers privacy questions directly at [email protected].

Two kinds of data, two roles

There are two groups of people this policy is written for, and we have a different role for each.

• Account holders are the businesses that put their waiver online with us: the owner who signs up, and any staff they add. For this data we decide what is collected and why, so we are the business responsible for it (the "controller" in European terms, the "business" in California terms).
• Signers are the customers, parents and guardians who sign a waiver on their phone or at a front desk. That data belongs to the business whose waiver it is. They decide what the waiver asks and how long it is kept. We store and process it for them under our data processing agreement, and we only act on their instructions. In legal terms we are their "processor" or "service provider". Read the data processing agreement.

Data about account holders

What we collect

• Account details. Your name, email address, password (stored only as a one-way hash), business name, industry, time zone and logo.
• Waivers you create. The text of every version of every waiver, including the ones you archive. Each signature points at the exact version that was signed.
• Google Drive connection. Only if you connect Google Drive: the Google account email, an access token and a refresh token so we can write PDFs to the folder you chose, and the scope you granted. We never see your Google password. Disconnecting deletes the tokens.
• Sessions and security logs. A session cookie while you are signed in, the IP address and browser of each sign-in, and failed sign-in attempts so we can block abuse. Kiosk devices get a separate token you can revoke from the waiver page.
• Billing. On a paid plan, Stripe handles your card and sends us the invoices and the status of the subscription. We never see or store card numbers.
• Support messages. Whatever you email us, kept with our reply.

Why we use it

• To run your account: publish your waivers, store signatures, generate PDFs, send signed copies, sync to Drive, and bill you. This is what you signed up for.
• To keep the service safe: rate limiting, blocking abuse, investigating problems. This is in our legitimate interest and yours.
• To contact you about your account: a cap you are close to, a sync that failed, a change to these terms. These are service emails, not marketing.
• To send product news, only if you opt in. We do not send any today, and every such email will carry an unsubscribe link.
• To meet legal obligations, mainly keeping invoices for as long as tax law requires.

If you signed a waiver

When you sign a waiver through Digital Waivers, you are dealing with the business whose name is on the page. We provide the form, store the result and generate the PDF for them.

What the signed waiver records

• What you typed: your name, email address, phone number and date of birth if the waiver asked for them, and your answers to any questions the business added.
• If you signed for children: their names and dates of birth, and your statement that you are their parent or legal guardian.
• Your signature, drawn or typed.
• The exact text of the waiver and of the consent statements you saw, the date and time, the IP address and browser used, and whether you signed from a link, a QR code or a kiosk at the venue.
• Whether you ticked a marketing box, if the business shows one. That choice goes to the business, not to us. We never market to signers.
• A PDF of all of the above, with a document ID and a fingerprint so it can be checked later.

What we do with it

• We show it to the business in their account, generate the PDF, and email you a copy if you gave an email address and the business has that turned on.
• If the business connected Google Drive, a copy of the PDF goes to a folder in their Drive.
• We keep it for as long as the business tells us to. A business can erase an individual signature at any time, and where a retention period is set for its account, signed waivers past it are erased automatically.
• We do not use it for anything else. We do not contact you, we do not build profiles, and we do not share it with anyone except the companies listed under "Who we share data with", who work for us.

How to see, correct or delete it

Contact the business you signed with. They can look up your signature, give you the PDF and erase it in one step, and they are the ones who decide. If you cannot reach them, email [email protected] with the document ID from your PDF and we will pass the request on, or act on it ourselves if the law requires us to.

Sign pages, thank-you pages and the verify page are marked so that search engines stay out, and the link to each sign page is only known to the business and the people they share it with.

Who we share data with

We use a small number of companies to run the service. They act on our instructions and are not allowed to use the data for their own purposes.

Company	What for	Where
DigitalOcean, LLC	Hosting, database and file storage	Frankfurt, Germany
Mailgun Technologies, Inc. (Sinch)	Sends email: signed copies, verification codes, account notices	EU region
Stripe Payments Europe, Ltd.	Payments and invoices for paid plans. We never see or store card numbers.	Ireland
Simple Analytics B.V.	Cookieless visitor counts on the public website and the sign-up and login pages. Receives no personal data and does not track signers or the app.	Netherlands
BunnyWay d.o.o. (Bunny Fonts)	Serves the web font. Receives your IP address when the font loads, sets no cookies.	Slovenia
Google LLC	Only if you connect Google Drive: receives a copy of each signed PDF in your own Drive.	United States

Beyond these, we disclose personal data only if the law requires it, to defend a legal claim, or as part of a sale of the business, in which case the buyer takes on this policy. We tell account holders about legal demands for their data unless we are prohibited from doing so.

We never sell personal data, never share it with advertisers, and never use it to train AI models.

Cookies

We set only the cookies the site needs to work: a session cookie that keeps you signed in, a token that protects forms against forgery, and a "remember me" cookie if you ask for one when signing in. There are no analytics cookies, no advertising cookies and no third-party trackers, which is why you do not see a cookie banner.

Where data is stored

Our servers, database and file storage are in Frankfurt, Germany. If you are in the United States, that means your data is stored outside the US, under European data protection law. Some of the companies above are based in the US or operate globally; where they handle personal data outside the European Economic Area, the transfer is covered by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

How long we keep data

• Signed waivers: for as long as the business that owns them says. If a retention period is set for their account, we erase signatures past it every day. If they erase one by hand, the personal data goes immediately and only a record that it was erased remains, so the document ID still checks out.
• Your account: until you close it. We then delete the account and everything in it within 30 days. Export your signed waivers as CSV and download your PDFs before you close it.
• Signed-in sessions end after 2 hours without activity.
• Server and security logs: 30 days.
• Backups: 30 days. Data you delete is gone from backups within that time.
• Invoices: for as long as tax law requires, generally up to six years.

How we protect data

• Every connection is encrypted with TLS.
• Passwords are stored as bcrypt hashes. Kiosk PINs are hashed the same way.
• Signature images and PDFs are kept in private storage that is not reachable by URL. Each PDF carries a SHA-256 fingerprint so any change to it can be detected.
• Every record is tied to one account. One business cannot see another's signers.
• Sign pages and sign-in forms are rate limited.
• Only the operator has server access. We look inside an account only to fix a problem you reported or when the law requires it.

No system is perfectly secure. If we learn of a breach that affects your data, we will tell you without undue delay.

Your rights

Wherever you live, you can ask us what personal data we hold about you, have it corrected, have it deleted, get a copy in a usable format, and object to how we use it. Account holders can do most of this themselves from Settings. Signers should start with the business they signed with, as explained above.

Email [email protected]. We answer within 30 days and do not charge for requests. We may ask you to confirm who you are first, and we will never treat you differently for exercising a right.

If you are a California resident, the rights above cover what the California Consumer Privacy Act gives you. We do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of. If you live in another US state with a privacy law, the same rights apply. If you are in the European Economic Area or the United Kingdom, you can also complain to your data protection authority; for us that is the Spanish Agencia Española de Protección de Datos. We would appreciate the chance to sort it out with you first.

Children

Digital Waivers is for businesses, and account holders must be adults. Children's names and dates of birth appear in signed waivers only because a parent or legal guardian typed them while signing for the child, and that data belongs to the business whose waiver it is. We do not knowingly collect personal data from a child under 13 for our own purposes. If you believe a child has signed a waiver on their own, tell the business or email us and it will be erased.

Changes to this policy

We will update this policy as the service or the law changes. The date at the top is the current version. If a change matters to you, for example a new company we share data with, we email account holders before it takes effect.

Contact

Privacy questions and requests: [email protected]. Everything else: [email protected].