Privacy policy

Our role

For account, billing and website data, Sadir is the controller (the “database owner” under Israeli law).

For the documents, names, phone numbers and other details that our business customers collect from their own clients through Sadir, the business customer is the controller, and Sadir processes that information on its behalf and on its instructions. If you are a client of a business that uses Sadir, please contact that business about your information.

What we collect

• Account information: your name, email address, phone number (optional) and a hash of your password. We never store passwords in readable form.
• Workspace and invoice details: business name, contact details, branding, and the name, email and business ID you ask us to put on invoices.
• Client information that you upload or that your clients submit: names, phone numbers, email addresses, documents, and for signatures, the signer’s name, the signature, the time, IP address and browser details, which form the signature’s audit trail.
• Payment information: card payments are made on Cardcom’s secure page. We never see or store card numbers. We keep a payment token reference (encrypted), the card brand, the last four digits and the expiry date, so we can renew your subscription and show you which card is on file.
• Technical and security information: server logs (for example, time, requested address and error codes) used to keep the service secure and working.
• Product analytics: counts of key steps (for example, “first request created” or “trial converted to paid”), linked to a workspace but not to its documents. On the public website we count page views with a random identifier that lasts only for your browser tab. We don’t store IP addresses or browser details with it, and we don’t collect anything if your browser sends a Do Not Track or Global Privacy Control signal.

How we use information

We do not sell personal information, show advertising, or use your clients’ documents to train models or for any purpose other than providing the service to you.

• To provide the service: create workspaces, send your requests and reminders, store and display documents, and produce signed documents and certificates.
• To bill you and issue tax invoices through our payment provider.
• To keep the service secure: authentication, rate limiting, preventing abuse and investigating incidents.
• To communicate with you about your account, your trial, your subscription and important changes.
• To understand, in aggregate, which parts of the product help customers succeed, and improve them.
• To meet legal obligations, such as tax and bookkeeping rules.

Legal bases (EEA visitors)

We process information to perform our contract with you, to comply with legal obligations, and for our legitimate interests in operating a secure and reliable service. Where we rely on consent, you can withdraw it at any time.

Service providers

We use carefully selected providers to run Sadir. They process information only on our instructions:

• Railway — application hosting.
• Supabase — managed PostgreSQL database.
• Amazon Web Services — encrypted file storage in the Israel (Tel Aviv) region.
• Meta (WhatsApp Cloud API) — sending WhatsApp messages that you choose to send to your clients.
• Resend — sending emails, when email sending is enabled.
• Cardcom — card payments, payment tokens and tax invoices.

International transfers

Some of these providers process information outside Israel, including in the United States and the European Union. Where this happens, we rely on the protections permitted by Israeli law and, for EEA data, on appropriate safeguards such as standard contractual clauses.

How long we keep information

• Account and workspace data: while your account is active, and deleted within 90 days of closing it, except where we must keep it longer.
• Documents and client data: until you or your client deletes them, or your account is closed. Backups may keep copies for up to 30 more days.
• Signature audit trails are kept as long as the signed document, so the record stays complete.
• Billing records: for as long as Israeli tax and bookkeeping rules require (generally 7 years).
• Security logs: up to 12 months.

Security

Data is encrypted in transit. Files are stored encrypted in a private bucket and opened only through short-lived links issued after an access check. Passwords are hashed, sessions can be revoked, and access to customer data is limited to what running the service requires. No system is perfectly secure. If a security incident affects your information, we will notify you and the authorities as required by law.

Your rights

You may ask to see the personal information we hold about you, and to correct or delete it, as provided by the Protection of Privacy Law and, where it applies, the GDPR (including the rights to restrict processing, to object and to data portability). You can update most account details yourself in the app.

To make a request, email us at [contact email not configured]. We may need to verify your identity first. You may also complain to Israel’s Privacy Protection Authority or, in the EEA, to your local data protection authority.

Cookies and local storage

We use one essential cookie, which keeps you signed in. It can’t be read by scripts and isn’t used for tracking. We store your language and theme preferences in your browser. We don’t use third-party advertising or tracking cookies.

Children

Sadir is a business service and isn’t intended for anyone under 18.

Changes and contact

If we make material changes to this policy, we’ll notify account owners before they take effect. Questions are welcome at [contact email not configured].