Privacy Policy
Last updated: 9 October 2026
Au Fait Solutions Pty Ltd (ABN 17 655 104 304), trading as SignSwifly ("we", "us"), is committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy explains what we collect, why, and the choices you have. It covers our websites and the SignSwifly application (the "Service").
What we collect
- Account information — your name and email address when you sign up, provided through our sign-in provider (Microsoft Entra External ID). We never see or store your password. We also keep your workspace's name and your role in it; a preferred name and mobile number, if you add them; signatures you save (drawn, typed or uploaded); and the email addresses of people you invite.
- Company sign-in and SCIM (Scale) — if your organisation uses them, the details its identity provider passes us when you sign in, and the names, email addresses, active status and group memberships its directory sends us.
- Accepting our Terms — each time you accept our Terms of Service: the version you accepted, when, your IP address and browser, and that it was in the app.
- Documents and envelope data — the documents you upload, the fields you place, and the names, email addresses and mobile numbers (if given) of the people you send to. What signers add: signatures, the values they fill in, files they attach, comments, reasons for declining, and the names and email addresses of any witness or other signer they name. Bulk-send lists, and your address book, which records each recipient you add.
- Signing evidence — when a document is viewed or signed we record the time, IP address and browser and device information in a tamper-evident audit trail, along with the version and fingerprint of the Electronic Record and Signature Disclosure each signer accepted, and, for a witness, their confirmation that they saw the signing and how (in person or by video call). This is the core evidentiary feature of the Service.
- Billing — the billing email, name, address and ABN or tax ID collected by Stripe at checkout. Card details go to Stripe; we never see them.
- Support and contact — correspondence you send us, and messages from our contact form, which are passed to our support mailbox.
- Email delivery records — whether each email we send was delivered or bounced, so we can tell a sender when an invitation didn't arrive.
- Text message records — for each text we send a signer: when it went, what it was for, and our text provider's id for it, so texts can be counted and billed. Not the number or the words.
- Connections — API keys, stored only as a one-way hash; webhook addresses and their secrets, which are kept encrypted; and, on Scale, the Microsoft 365 connection's settings (your Microsoft tenant and the site, library and folder chosen). We keep no Microsoft passwords or sign-in tokens.
Why we collect it
- To provide the Service: routing documents to signers, recording legally meaningful evidence of signing, sealing completed documents, and issuing certificates of completion.
- To operate and secure our systems, prevent fraud and abuse, and provide support.
- To bill paid plans, the SMS add-on and single envelopes, and to keep a record of each acceptance of our Terms of Service as evidence of the agreement.
- To send service emails and text messages (signing invitations, reminders, codes to sign with, completion notices, account messages). We don't sell personal information, and we don't send marketing to signers.
Where your data lives
Documents, signing evidence and account data are stored in Microsoft Azure data centres in Australia. Sealed documents and certificates of completion are kept there in write-once storage for 7 years. Emails are sent through Microsoft Azure Communication Services, which holds its data in Australia, and sign-in is handled by Microsoft Entra External ID, which keeps the primary copy of sign-in data in its Australian data centres.
Some information goes outside Australia:
- Billing details are held by Stripe, which may store and process them outside Australia, including in the United States.
- Emails go to each recipient's own email provider, wherever it is. On Team and Scale, the sender can choose to attach the sealed documents.
- Text messages to signers (on Scale, on Solo and Team with the SMS add-on, and on an envelope sent on a single envelope with SMS) are sent through ClickSend, part of the Sinch group: the signer's mobile number and the text, which carries their signing link or a one-time code. ClickSend stores them in Australia and deletes them after 120 days; its monitoring provider and Sinch group teams may process them outside Australia, in North America, the EU and the Philippines.
- Webhook notifications go to the address the workspace chose, wherever it is.
- On Scale, completed envelopes saved to Microsoft 365 are held in the workspace's own Microsoft 365, in whatever location that is set up in.
- Email you send to our support address, and messages from our contact form, are kept in our support mailbox, hosted by Hostinger outside Australia (Hostinger has no data centre in Australia).
Who we share it with
Besides what's described below, we share personal information only with the service providers we need to run the Service:
- Microsoft: Azure for hosting and storage, Azure Communication Services for email, and Entra External ID for sign-in.
- Stripe, for billing paid plans, the SMS add-on and single envelopes.
- ClickSend (Sinch), for text messages to signers, where the sender asks for them.
- Our support mailbox provider, for email you send to support and messages from our contact form.
- DigiCert, whose timestamping service receives only a fingerprint of each sealed document, never the document or any personal information.
Some information goes where a workspace tells us to send it: to the other people on an envelope, to its webhook addresses, or on Scale to its own Microsoft 365. Everyone on an envelope can download its certificate of completion, which shows each party's name, email address or mobile number, role, what they did and when, IP address and browser.
We may disclose information where the law requires it. We never sell or rent personal information.
Retention
How long documents are kept depends on the sending workspace's plan and settings. Sealed documents are legal evidence for every party who signed, so some records are kept even when the documents themselves are no longer handed out.
| What | How long |
|---|---|
| Completed documents on Solo, Team and Scale | For as long as the workspace exists, unless a Scale workspace sets a retention period. |
| Completed documents of envelopes sent on Free | Available to the sender and signers for 6 months after the envelope finishes. After that they stay stored but aren't handed out, unless the workspace upgrades. |
| On Scale, with a retention period | The workspace chooses 30 days to 10 years after an envelope finishes. After that, its documents stop being handed out. If the workspace has also confirmed deletion, the documents as they were uploaded and any files signers attached are deleted, starting 7 days after it confirmed. A deletion is final. The sealed documents and certificates are kept as the next row says, but aren't handed out. |
| Sealed documents and certificates of completion | In write-once storage for 7 years from sealing, whatever the workspace's setting. After that, deleted only if the workspace confirmed deletion. |
| Envelopes under a legal hold (an add-on to Scale) | Neither withheld nor deleted by the workspace's retention policy until every hold on them is released. The plan's other limits still apply. Holds are placed and released by the workspace, and each is recorded. |
| Envelope records and audit trails | Not deleted by any retention setting. Each deletion of documents is recorded on the audit trail. |
| Account information | While your account is active. Deleted on verified request after closure, except where we must keep records by law. |
| A closed workspace | Kept as it was for 30 days after we close it at your request, so it can be reopened if you ask. Then its people's accounts, drafts, templates, saved files, contacts and settings are deleted, with the documents of its envelopes as they were uploaded and any files signers attached. Its envelopes' records and audit trails, and the sealed documents and certificates, are kept as the rows above say, and our billing records as the law requires. If we're legally required to keep it for longer, we keep it until that ends. |
| Records of accepting our Terms | Kept for 7 years after the account or workspace is closed, as evidence of the agreement. |
| Email delivery records | 180 days. |
| Our record of staff looking at a customer's envelope | 7 years. |
Files we delete stay recoverable in our storage for a short time, usually a week or two, only so we can recover from a fault of our own. We don't use this to restore documents a workspace chose to delete. Database backups are kept for a limited period and are not restored except to recover the Service.
Security
Data is encrypted in transit and at rest. Each signer gets a personal signing link. It keeps working while the envelope is open, even after reminders, unless the sender corrects the address or our support team replaces it, and after everyone has signed it is where they download their copies. We store only a one-way hash of it. Completed documents are digitally sealed (PAdES) with a trusted timestamp so any later change is detectable. Our app reaches our databases and storage with Azure managed identities. Through our support tools, our staff see an envelope's details but not its documents. Opening what's in a document takes a stated reason, lasts 60 minutes, covers one envelope, and is written on that envelope's audit trail. The few people who run our systems can reach stored data, and do so only to keep the Service running.
Your rights
You may request access to, or correction of, the personal information we hold about you. If you were a signer on someone else's document, note that we don't alter completed signed documents or their audit trails, because they're evidence for every party. How long the documents stay available is set by the sender's workspace (see Retention), and sealed copies are kept for 7 years. Requests about a document's content are best directed to its sender. To make a request, or to complain about our handling of your information, contact us below. If you're not satisfied with our response you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
Cookies
The marketing site sets no advertising or analytics cookies. The application uses only what it needs to work: browser storage that keeps you signed in, remembers when you were last active so you can be signed out after a period idle, and holds work you haven't saved yet on that device, such as what you've typed on a signing page or a draft in the editor. Microsoft's sign-in pages set their own cookies.
Changes
We'll update this policy as the Service evolves and note the date above. Material changes will be announced by email or in the app.
Contact
Email us, or use our contact form.