Privacy policy

MonaSign is operated by Weedoo VOF, a company registered in Belgium. For the data you enter into MonaSign, Weedoo VOF is the processor and the company that created the workspace is the controller. For your own account details, Weedoo VOF is the controller.

Questions about this policy go to hello@weedoo.work.

Only what is needed to run the service:

• Account: your email address and a hashed password, or a sign-in provider identifier. We never see your password.
• Company workspace: company name, logo, brand colours, plan, and the settings you choose.
• People: the details an administrator enters for each person a signature is made for, such as name, job title, department, email address, phone numbers, website, social profile links and a photo. Administrators are responsible for having the right to enter these details. A company that adds people by hand can let each person update their own phone numbers, title, links and photo from the page behind their personal share link; those changes go into the same record.
• Signature designs and the images uploaded for them. Images used in signatures are publicly reachable by their address, because recipients' mail programs have to load them.
• Send history: to whom a signature or invitation email was sent, when, and whether it was delivered.
• Click counts: if a company turns on link tracking, each click on a link in its signatures with the time, the link and the browser type. We do not store who clicked or their IP address.
• Survey answers: if a company puts a one-tap question under its signatures, each answer with the time, the chosen value, the signature and the sender it came from, and any comment the recipient chooses to type on the thank-you page. We do not store who answered or their IP address; comments should not contain personal details.
• Campaign results: each time a campaign banner is loaded by a mail program or clicked, with the time, the campaign, the signature and the sender it was shown under, and the name of the mail program family (such as Outlook or Gmail). We do not store who received the email, their IP address or their full browser details. To leave the sender's own loads out of the numbers, we keep a hashed form of the sender's network address for two days when the Outlook add-in fetches their signature; the hash changes every day, cannot be turned back into the address, and is deleted after two days.
• Activity log: sign-ins and changes in a workspace (who, what, when), with the IP address and browser they came from, to keep accounts safe and to answer questions about changes.
• Billing: for Pro plans, a customer reference from our payment provider. Card details are entered on the payment provider's pages and never reach our servers.

When a company installs the MonaSign Signature add-in for Outlook (published in the Microsoft 365 app store and in Microsoft 365 admin center), the add-in asks MonaSign for the signature that belongs to the mailbox that is signed in. To do that it sends the mailbox address and, when the company has enabled Microsoft single sign-on, a Microsoft identity token that lets us verify that address.

The add-in does not read, store or transmit the content of your emails, your contacts or your calendar. It inserts a signature into the message you are writing and nothing else.

A company can choose to take its people and teams from Microsoft 365 instead of entering them by hand. A Microsoft 365 administrator of that company signs in and grants MonaSign permission to read the directory; MonaSign then reads each user's name, email address, job title, department, phone numbers and office address, and stores them as the company's people, grouped by department. Nothing is written back to Microsoft 365. Profile photos are read and stored with the person's other details so they can appear in the signature. By default every sync is started by an administrator and no Microsoft token is kept. If the company turns on the nightly sync, MonaSign keeps the refresh token Microsoft issued to that administrator, encrypted, and uses it only to read the directory each night; turning the nightly sync off deletes it.

People who disappear from the directory are marked and stop receiving signatures (with the nightly sync, the night after they leave); the company deletes them from MonaSign or switches source. The company decides, as controller, that its directory data is used this way.

Data is stored in a database and file storage hosted by Supabase in Frankfurt, Germany (European Union). The application runs on Cloudflare's network, which serves requests from the location closest to the visitor. Backups stay within the European Union.

We use a small number of service providers under written data processing terms:

• Supabase (database, authentication, file storage)
• Cloudflare (hosting, network, transactional email delivery)
• Stripe (payments, only for Pro plans)
• Microsoft (only when a company uses the Outlook add-in with single sign-on, verifies domains through Microsoft 365 or syncs its directory)

The full list, with locations, is on the sub-processors page. How we process data for your company is set out in the data processing agreement.

We do not sell data and we do not share it with advertisers.

MonaSign sets one cookie: the session that keeps you signed in. There are no analytics or advertising cookies. Public signature pages set no cookies at all. A preference for light or dark mode is stored in your browser, not on our servers.

Data stays as long as the workspace exists. When an administrator deletes a person, a signature or the whole workspace, the records are removed immediately and uploaded images are removed with them. Backups are overwritten within 30 days.

Some records expire on their own, checked every night: the activity log (who signed in or changed what, with IP address and browser) after 12 months, and link clicks, campaign results, survey answers and emailed signatures after 13 months. When a workspace is deleted, its activity log entries keep only what happened and when; email addresses, IP addresses and details are removed at once.

Signatures already pasted into a mail client are copies held by that mail client and are outside our control.

Under the GDPR you can ask to see, correct, export or delete the data we hold about you, and you can object to or restrict its processing. If you are listed as a person in a company workspace, the quickest route is the administrator of that company, who can edit or delete your entry directly. You can also write to hello@weedoo.work and we answer within 30 days.

You have the right to complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit) or the supervisory authority of your own country.

All traffic is encrypted in transit. Access to data is restricted per company by database policies, so one company can never read another's records. Integration secrets are encrypted at rest. Passwords are hashed by our authentication provider and are never stored in clear text.

When this policy changes in a way that matters, we update the date at the top and tell workspace administrators by email before the change takes effect.