Data Processing Addendum
Effective: Saturday, November 7, 2026
This Data Processing Addendum (“DPA”) is between PHM Enterprises LLC, a Florida company in the United States (“we”, “us”), and the company that uses Signature Sync (“you”). It forms part of our Terms of Service and applies automatically, with no signature needed, whenever we process personal data for you that is protected by the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection or a similar law. Our Privacy Policy covers the same data from the point of view of each person.
If you want a countersigned copy for your records, email support@signature-sync.com with your company’s legal name and address. A signed copy has the same terms as this page.
This agreement is published in English. If parts of it are shown in another language, the English version governs.
The short version
- Your company is the controller of its directory. We process it only to build and deliver your signatures and digital cards.
- We do not sell it, use it for advertising, or send it to an AI provider.
- It is hosted in the United States. For EU, UK and Swiss customers, the transfer is covered by the EU Standard Contractual Clauses and the UK Addendum, which this DPA includes.
- We tell you about a breach within 10 days at most, and give you 30 days’ notice before adding a sub-processor.
1. Who is responsible for what
- Your company is the controller of the personal data it puts into Signature Sync: its directory, the people it invites, and the content of its signatures. You decide what goes in, who it is shown to and when it is removed.
- PHM Enterprises LLC is your processor for that data. We process it only on your instructions, which are given by your use of Signature Sync and your admins’ settings.
- We are the controller of a small amount of data we need to run our own business: your company’s account and billing contact, payment and invoice records, support conversations, the security records that protect the service, and the form on this website. That is described in our Privacy Policy.
- You confirm that you have a lawful basis, and have given your people any notice the law requires, for putting their details into Signature Sync and showing them in signatures and digital cards.
2. The personal data involved
The people concerned are your employees and anyone else your admins add to the directory or invite to sign in.
| Data | What it is | Why |
|---|---|---|
| Directory | Each person’s name, job title, department, work email and the phone number shown in their signature. | Every signature and digital card is built from it. |
| Photo | Only if the person adds one. They can remove it at any time. | Shown on their card and, if the design includes it, in their signature. |
| Signature designs | The designs your company saves, which person uses which, and whether each person has installed theirs. | To show the right signature and track the rollout. |
| Digital card counts | How many times each card is opened and saved per day, and whether it came from a QR code, an NFC tag, an email signature or a link. Counts only: Signature Sync does not record who opened it, their IP address or device. Like any web server, ours keeps short-lived technical logs to keep the service running and secure. | So each person and your admins can see that cards are being used. |
| Sign-in accounts | For admins and anyone else who signs in: name, email, username, a password stored only as a secure hash or a passkey record, role, language and time zone. | To let people sign in and to limit what each one can do. |
| Security records | Sign-in times, IP address, browser or app version and device type, and a history of who changed which record and when. | To keep accounts secure and investigate problems. |
Signature Sync does not read the content of anyone’s email, and does not ask for special categories of data (such as health or religion). Please do not put them in the directory.
Nature and purpose: storing the data and using it to build, show and deliver email signatures and digital business cards. Frequency: continuous, for as long as you use Signature Sync. Duration: until the data is deleted under section 8.
3. How we use it
- Only to provide Signature Sync to your company: to store the directory, build signatures and digital cards from it, show them to your team, and install or push them where your admins choose.
- We process it only on your documented instructions, which are these Terms, this DPA and your admins’ use and settings, unless the law requires otherwise. If it does, we will tell you first unless the law forbids that. We will tell you if we believe an instruction breaks data protection law.
- We do not sell it, rent it, use it for advertising or build profiles from it.
- Our people access it only when needed to run the service, fix a problem or answer a support request from your company.
4. Sub-processors
You authorise us to use these service providers to run Signature Sync. Each receives only what it needs for its job, and each is bound by a written agreement that protects the data at least as well as this DPA. We remain responsible to you for them.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| DreamHost (New Dream Network, LLC) | The server, database and backups Signature Sync runs on | All of the data above, stored on the server and in its backups | United States |
| Twilio SendGrid | Delivering the emails Signature Sync sends (invitations, sign-in and verification emails, notices) | The recipient’s email address and the message | United States |
| Anthropic | “Start with AI” in the signature designer, only when someone uses it | Only what the person types into the request, plus the company name, brand colour and tagline. We do not send directory records. | United States |
| Stripe | Payments and invoices | Your billing contact and billing details, plan and seat count. We act as controller for this data. | United States and other countries where Stripe operates |
Google Workspace (optional): if your admin connects your Google Workspace, Signature Sync sets each person’s Gmail signature through Google’s API. The signature and email address go to your own Google Workspace, under your company’s agreement with Google.
Before we add or replace a sub-processor, we will update this list and email your company’s admins at least 30 days ahead. If you object on reasonable data protection grounds and we cannot resolve it, you may end your subscription and we will refund any prepaid fees for the period after it ends. Questions: support@signature-sync.com.
5. International transfers
Signature Sync is hosted in the United States. Your data is stored and processed there, and by the providers listed above.
- EU and EEA: the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated into this DPA by reference. Module Two (controller to processor) applies, or Module Three (processor to processor) where you are yourself a processor. You are the data exporter and we are the data importer.
- Choices in those clauses: clause 7 (docking) applies; under clause 9(a), option 2 (general written authorisation) applies, with the 30 days’ notice in section 4; the option in clause 11(a) does not apply; under clause 13, the supervisory authority is the one that is competent for you; under clauses 17 and 18, the governing law and courts are those of Ireland. Annex I is sections 1 to 3 of this DPA, Annex II is section 6, and Annex III is the list in section 4.
- United Kingdom: the UK Addendum (the ICO’s International Data Transfer Addendum to those clauses, version B1.0) is incorporated by reference. Its Tables 1 to 3 are filled in by this DPA and the choices above, and under Table 4 either party may end it as its section 19 allows.
- Switzerland: the same clauses apply, with the Swiss Federal Data Protection and Information Commissioner as the supervisory authority for transfers under Swiss law, and references to the GDPR read as references to the Swiss Federal Act on Data Protection.
- If your country’s law (for example in Australia or Canada) needs other transfer terms, email support@signature-sync.com and we will work through them with you.
If those clauses conflict with the rest of this DPA or the Terms, the clauses govern.
6. Security
- All traffic is encrypted in transit (HTTPS/TLS).
- Passwords are stored only as secure hashes, and people can sign in with a passkey instead.
- Each company is kept separate: every record belongs to one company, and the app is built to read and write only the records of the company you sign in to.
- Access inside a company follows roles, so only admins manage the directory, designs, users and plan.
- Digital card links are signed so they cannot be guessed, and a card stops working when its person leaves the directory.
- Sign-in records and a history of changes are kept, so problems can be traced.
- Servers are reached only with SSH keys, not passwords. The database is backed up every night, on the server and to separate storage, so it can be restored after a failure.
7. Helping you meet your obligations
- Requests from your people: your admins can correct or remove anyone in the directory themselves, at any time. If someone asks you for a copy of their data, or for something you cannot do in the app, email support@signature-sync.com and we will help.
- Breaches: if we determine that a personal data breach affected your company’s data, we will notify your admins without undue delay and no later than 10 days after that determination, with the information you reasonably need for your own notices, and keep you updated as we learn more.
- Your assessments: we will answer reasonable questions about how Signature Sync processes data, for example for a data protection impact assessment or a security questionnaire.
- Confidentiality: anyone who works on Signature Sync for us is bound to keep your data confidential.
8. Retention, return and deletion
- Most items your admins delete are kept for 30 days, so mistakes can be undone, then removed permanently. Sign-in records and change history are removed after 90 days.
- If you ask by email to support@signature-sync.com before or within 30 days after your company account is closed, we will send your admins a copy of your company’s data in a common format.
- When your company account is closed, we delete its data within 30 days. Copies in backups are deleted as the backups expire, within 60 days. Web server logs are kept for up to 8 weeks.
- We keep only what the law requires us to keep, such as billing and tax records.
9. Information and audits
We will make available the information you reasonably need to show that this DPA is being followed, starting with this page and our answers to your questions. If that is not enough, or a regulator requires it, you may audit our compliance once a year, at your own cost, with 30 days’ written notice to support@signature-sync.com, during business hours, in a way that does not expose other customers’ data or our security.
10. Liability and order of precedence
Each party’s liability under this DPA is subject to the limits in the Terms, except where those limits are not allowed by the clauses in section 5 or by law. If this DPA conflicts with the Terms, this DPA governs for the processing of personal data.
11. Changes and language
If we change this DPA in a way that matters, we will email your company’s admins before the change takes effect and update the date above. A change never lowers the protection the clauses in section 5 require. If this DPA is shown in another language, the English version governs.
12. Contact
PHM Enterprises LLC, Florida, United States · support@signature-sync.com