Privacy Policy
1. Who is responsible
SocialDNA Systems LLC (Virginia, USA) runs MyESign and every socialDNA product. We decide how your account data is handled. When you use a product inside a company team, that company decides who reads its records and how long they are kept; we process those records for the company.
2. What we collect
- Account: name, e-mail, phone (if you use it), language, and how you sign in (password, code, passkey, Google, Apple).
- Teams: the groups you belong to (your personal group, your company, your family) and your role in each.
- Devices and security: IP address, device and app version, push-notification token (if you allow notifications), sign-in times, active sessions, a log of every request to our servers, and anonymous first-party counters of which screens are used.
- Plan and payments: your plan, usage counts (including AI usage metered to your plan), amounts, and the subscription identifiers Apple or Stripe give us (the card itself stays with Stripe or Apple).
- Identity check, only in products that require it: the result of a face check (pass or fail, scores, device) done on our own servers and, for some functions, name, state, expiry and last four digits of an ID document.
- On your device only: your language, the team you selected and the e-mail you typed for a sign-in link stay in the browser or app storage; your session token is in a protected cookie or the app's secure storage, never in page storage.
- In MyESign: Document · Envelope · Sign request · API key · Webhook · Signature usage · Document to sign · MyESign team settings · Support attachment · Booking page · Appointment · Booking offer
We do not collect advertising identifiers, we do not track you across other apps or websites, and we do not build interest profiles about you for advertising.
Information about people who are not our users
Our customers also store information about other people: their clients, workers and contacts; the people they e-mail, text, fax or mail; signers of their documents; guests who book an appointment; visitors who open a public link (we log the IP address and browser). For those records our customer decides the purpose and we process them for the customer. Construtech, MyNewRoof and Leads also show public records about licensed contractors, permits and properties (from state licensing boards, permit and property registries and published directories); we hold them as public information to help our customers find and vet businesses, and the people named have the rights in section 8.
3. Why we use it, and on what basis
- To provide the product you asked for (contract): sign you in, store and show your records, read files with AI where the product says so, send the codes and notices you need, take payments.
- To keep the service safe (legitimate interest): detect abuse, investigate problems, keep the request log.
- When you say yes (consent): marketing messages from socialDNA products; sharing your contact with partners; the face check; location recording while you work (your employer asks for it in MyTeamDay); text messages to a number you give us. Each one is asked separately, is never pre-checked, and can be withdrawn at any time without affecting the rest of the service.
- When the law requires (legal obligation): tax and payroll records, answers to valid legal orders.
4. What we never do
- We do not sell your personal information and do not share it for cross-context behavioral advertising, so there is no "Do Not Sell or Share" step you need to take. Sharing your contact with partners happens only if you turn it on in "Your consents and choices"; under some state laws that sharing may count as a "sale", and turning it off is your opt-out. We treat a Global Privacy Control signal from your browser as that opt-out.
- We do not share your mobile number or your consent to receive text messages (SMS) with third parties or affiliates for marketing or promotional purposes. Text messages go only to people who asked for them or agreed to them; reply STOP to stop and HELP for help, and we honor a STOP within the time the law sets. Message and data rates may apply.
- We do not train AI on your content or account data, and our providers (Google, Anthropic) do not either; no data-sharing or "improve the model" option is enabled with any provider.
- Our staff do not read your content, except when you ask for support and point us to something, to stop abuse, or when the law requires.
5. Who processes data for us
Only service providers that help us run the product, each bound by contract to use the data only for that. The full list for MyESign is on the page "How we handle your data". We update that list — as a new version — before a new provider starts receiving your data. When you connect a Gmail or Microsoft mailbox, we use its data only to show it to you and the people you choose in the product, never for advertising and never to train AI models; our use of Gmail data complies with the Google API Services User Data Policy, including the Limited Use requirements.
6. Where your data is kept
Our servers and providers are in the United States (one public map service used for house measurements is in Europe, and receives only coordinates). If you live in Brazil, the European Union or the United Kingdom, your data is transferred to the United States with the safeguards the law requires (such as the standard contractual clauses of the ANPD or the European Commission).
7. How long we keep it
| What | How long |
|---|---|
| Your account (name, e-mail, phone, sign-in methods) | While the account is open. After you close it: 30 days to change your mind, then erased. |
| What you store in the product (files, records, photos) | Until you or your team delete it. What belongs to a team stays with that team when you leave it. |
| Backups | Deleted data leaves our backups within 35 days. |
| Security and access logs (who did what, when, from which address) | 12 months. |
| Billing records | 7 years, as tax law requires. |
| Your consents (which version you accepted, when and from where) | While the account is open and 5 years after, to prove what was agreed. |
| Sign-in codes | 10 minutes. |
| Face check (only in products that require it) | The check runs on our own servers; no image goes to an AI vendor. We keep the result (pass or fail, scores, device) with your account. The straight-on frame is kept only until the ID-document step is completed, and at most 30 days; the document step keeps the state, expiry and last four digits of the ID, and your name for the verified level. |
| Work location pings (MyTeamDay) | 12 months (365 days), then deleted automatically. |
| Time cards, shifts and pay records kept for a company (MyTeamDay) | By the company, for the period labor and tax laws require (in the US at least 3 years for payroll records, 2 years for time cards and 4 years for employment-tax records), even after you leave the company or close your account. |
| Signed documents and their certificates (MyESign) | Kept by the sender and the sender's team as long as their account or team exists. A signer can download the signed copy from the signing link for 30 days and afterwards by asking the sender. |
| Faxes (myefax) | While your account is open; releasing a fax number does not delete the faxes. |
| Public links you create (client portal, photo portfolio) | Until the expiry you set (client portal: 60 days by default). A portfolio link created without an expiry lasts 1 year and the public copy of each photo has no location or camera data. Each visit is logged (IP address, browser, referrer; the last 500 visits). |
| Your data export file | 7 days after it is ready. |
| Your STOP (text-message opt-out) | Kept indefinitely, by phone number, so that we never text that number again — even after the account is deleted. |
8. Your rights
You can, at any time and free of charge:
- see and download your data (in the product, "Download your data");
- correct what is wrong;
- delete your account and what is only yours ("Delete your account", in the app and on the web);
- withdraw consent for marketing, partners, location or the face check ("Your consents and choices");
- object to a use, or ask us to limit it, and appeal if we say no.
We answer within 45 days (extendable once by 45 days when we tell you why). If we refuse, we say why and how to appeal: reply to our answer with "appeal" and we decide within 60 days; residents of Virginia may also contact the Office of the Attorney General of Virginia, and residents of other US states with privacy laws (such as California, Colorado, Connecticut and Texas) their state's attorney general or privacy agency. In California, the list in section 2 is also our notice of the categories of personal information we collect; we have not sold or shared personal information in the past 12 months. Under Brazil's LGPD our contact for data protection (encarregado) is privacy@socialdna.app and we answer within 15 days; you may complain to the ANPD. Under the GDPR (European Union) and the UK GDPR we answer within one month and you may complain to your data protection authority. When a request is about records that belong to a company team, we forward it to that company and help it answer.
9. Security
Encryption in transit and at rest; every request checked against the permissions of each record; files opened through links that expire in minutes (a client-portal or portfolio link lasts as long as its owner sets); a log of who did what; sessions you can end per device; secrets of connected accounts stored encrypted. No system is perfect: if a breach affects your information, we tell you and the authorities as the law requires.
10. Biometric information (face check)
Some functions ask you to look at the camera. Before any image is captured we ask for your separate, written consent; the check runs on our own servers and no image goes to an AI vendor or anyone else. We keep the result and the measurements that produced it with your account; the straight-on frame is deleted as soon as the ID-document step is done, and at most in 30 days. We never sell, lease or disclose biometric information. If you live in a state with a biometric privacy law (for example Illinois, Texas or Washington), the consent you give is the written release that law requires, and this section is our public retention and destruction schedule: biometric data is destroyed when the purpose is met and, at the latest, when your account is purged.
11. Children
The products are for people aged 18 or older. We do not knowingly collect personal information from children under 13; if we learn we did, we delete it. Information about a child in a family product (MyChildHub) is entered by a parent or guardian, who manages it. A supervised profile for a minor (AI Lab family group) is created and managed by a parent or guardian, who sees and controls what the minor does.
12. Cookies and your device
We use one cookie, for your session (HttpOnly, 30 days), and no third-party or advertising cookies. Your language, selected team and the e-mail you typed for a sign-in link stay in your browser or app storage. Our screens count page views with first-party anonymous counters (no cookie, no cross-site tracking), kept for 120 days. Some pages load fonts from Google Fonts, which receives your IP address for that request. No cookie banner is needed because none of this is used for advertising or tracking.
13. Changes
We publish every version here with what changed. If a change matters to how your data is used, we tell you before it takes effect and ask you to accept it the next time you sign in.
14. Contact
SocialDNA Systems LLC · [to be confirmed] · privacy@socialdna.app
All versions
- Version 1 · 2026-11-07 · current — First version for every socialDNA product.