Privacy & cookies

Your document content

Everything you type into a document — names, addresses, account numbers, amounts, phone numbers, email addresses — is processed entirely inside your browser. Document generation and PDF export run locally on your device. The content is never sent to our server, never stored in a database, and we cannot access it — unless you send the document for signature or create a fill-in link yourself, and then it reaches the server only encrypted (see below).

If you use the save option, the data is written to your browser's local storage (localStorage) on your own device. You can remove it at any time by clearing site data in your browser settings or using “Clear form”. A company logo, if you set one, is kept the same way (localStorage) for your next documents; remove it in “My documents”. It reaches our server only encrypted, as part of a document sent for signature.

The QR code at the end of every PDF holds only the address of the “Verify” page, a fingerprint of the document's text (not the text itself) and, for a signed document, its id — no names, amounts or keys. The “Verify” page reads the file you choose in your browser: nothing reaches the server and no analytics run there.

A file uploaded to “Sign your own PDF” is opened and signed in your browser and, with its fields, stays in the browser's database (IndexedDB) on your device until you use “Remove file”. It reaches the server only if you send it for signature: the whole file, encrypted like any document (see below). Emails then say only “PDF document” and a party number — the file name and the parties' names stay inside the encrypted copy.

Electronic signature

When you sign a document, the app processes: the signature image (drawn, typed in a chosen handwriting font or uploaded from a picture), the signer's name, initials if you add them, the date and time of signing with the time zone from the device clock, the moment the consent to sign electronically was ticked and its wording, and a hash of the document's content. They are used to make the signed document and the signature record at its end.

We do not collect how the signature was written (pressure, speed, order or timing of strokes), location or device data — only the image is kept. Signature data is stored with the document in the browser (localStorage, or IndexedDB for your own PDF) and in the PDF you download. On a shared computer, remove it with “Clear form” (“Remove file” for your own PDF) or in “My documents”. When you send for signature, create a fill-in link or save online, it reaches the server only inside the encrypted copy of the document. In the clear, the server records only when it received a party's signature (send for signature) or an answer (fill-in link) — that time goes into the signature record.

Sending for signature

When you use “Send for signature”, the document — its text, the values you entered, images and signatures already made, and for your own PDF the file itself — is encrypted in your browser (AES-256-GCM) before it leaves your device. Only the encrypted copy reaches the server. The key is part of the link, in the fragment after the # sign. When you open a page from such a link, your browser does not send that fragment to the server. Sending the invitations is different: the link, key and all, goes through our server, because the server is what sends the message, and it then sits in the recipient's mailbox and with our mail provider. We do not store the link itself. A party's link carries only half of the key and our database holds the other half — neither the mail provider alone nor our database alone is enough to read the document. The sender's link, the one that shows the status, carries the whole key, so please do not forward that message.

Besides the encrypted copy we keep: the document type and language, SHA-256 hashes of the link tokens, the parties' roles, when each opened, signed or declined, and — if you give them — the parties' email addresses and yours. A reason for declining is encrypted with the same key. We also keep a hash of the IP address the document was sent from (an HMAC with a secret key — the address itself is not stored), so that one person cannot use up the hourly sending limit for everyone; it is deleted with the document. The database is run for us by Neon, on servers in Frankfurt (EU).

If you give an email address, the message with the link is sent through Resend. A party's link carries only half of the key; we keep the other half and hand it over only after the code from the email (below), so the link alone, from a message that reached the wrong hands, does not open the document. The sender's link carries the whole key. If you would rather not give an address, copy the link and pass it on yourself. Messages carry only the document type and the party's role, never the contract text.

If the sender leaves reminders on, a party with an email address who has not signed gets a reminder on the third day after sending and on the third day after the previous one — at most two, and only if the invitation email actually went out. Such a reminder carries no link, because we do not keep the key; it points to the first message. The sender can send a reminder with the link from the status page: their browser hands the link over for that one message.

When a party declines, we email the sender and the other parties who were sent an invitation. The message names only the document type and the role of the party who declined.

The sender can protect the links with a 6-digit access code, which they pass on to the parties themselves, another way. The code is made in their browser; we keep only its hash (salted scrypt) and the number of wrong tries — after five, the link is locked for 15 minutes, and each further lock lasts twice as long, up to a day. The code is never sent by email.

Before the document opens, each party confirms an email address with a 6-digit code we send to it through Resend: to the address the sender gave or, when there is none, to the one the party types. We keep the confirmed address, where it came from and when it was confirmed; they go into the signature record in the PDF, so the sender and the parties who confirmed their own address see them. The code is kept as a hash (salted scrypt) for 10 minutes and 5 tries. All of it is deleted with the document.

The encrypted copy and the sending records are deleted automatically 30 days after sending, or 14 days after every party has signed or someone has declined, whichever comes first. The sender can delete the document sooner, from the status link, and remove the links and codes kept in their browser with “Remove from this browser”. No analytics run on the page a link opens, even with consent.

Fill-in links

When you create a “Fill-in link”, the document is encrypted in your browser just as for sending for signature, and the key is in the link, after the # sign. Anyone holding the link can open the document, fill in the chosen party's fields, sign it and send an answer.

An answer — the values entered and the signature — is encrypted in the respondent's browser with the form author's public key. Only the author's panel link opens it: people holding the fill-in link cannot see each other's answers, and neither can we. Besides the encrypted data we keep the document type and language, a hash of the author's token, whether the form takes answers, the time and size of each answer, and a hash of the IP address of the author and of each respondent (an HMAC, not the address) for the hourly limits. No emails are sent.

The form and its answers are deleted automatically 30 or 90 days after it is created — the author chooses when making the link, 30 days by default. The author can delete single answers or the whole form sooner. No analytics run on the form page.

Account

Filling in, signing on your own device and downloading documents need no account. An account is needed only to send a document for signature, create a fill-in link or send a reminder, so that it is known from whose confirmed address a document went out. You sign in without a password: we email a 6-digit code to the address you give, through Resend.

We keep the account's email address and the dates it was created and last signed in; for a code, its hash (scrypt), the number of tries and a hash of the IP address (an HMAC, not the address) for the hourly limits. Codes are deleted after a day. A signed-in browser gets a session cookie that signing in needs to work (HttpOnly, 30 days); the server keeps only its hash. Your browser also remembers the account's address (localStorage) to fill it in at the next sign-in; it is removed when you sign out and when you delete the account. With a sent document and a fill-in link we record which account it came from. The account's address is shown to the parties as the sender in the invitation email and in a reminder with the link.

You can delete the account yourself on the “My documents” page with “Delete account”: we delete the address, the sessions and the codes. Documents and links sent earlier keep working until their date, no longer linked to the account. An account does not change how document content is handled — it is still encrypted in your browser and we cannot see it.

Saving online. If you save a draft, a template or your own PDF to the account, we keep it encrypted in your browser with a key we do not know (we hold only its SHA-256, to refuse a save made with another key). The item's name and content are encrypted; we see its kind (draft, template, PDF), size and dates. Your browser keeps the key until you sign out — without it we cannot recover the items. We keep them until you delete them (one by one in “My documents”, all at once with “start over”, or together with the account).

Pre-filling via URL — an important caveat

The site lets you pre-fill fields using URL query parameters. This is convenient, but a URL — unlike the content you type into the form — is sent to the server and may be recorded in the hosting provider's access logs, in your browser history, and wherever you paste that link.

For that reason we recommend against putting sensitive values in the URL, such as bank account or identity document numbers. URLs reported to our analytics have their query string stripped.

Analytics — only with your consent

Until you accept in the banner, no analytics script is loaded at all. After you accept we use:

• Vercel Analytics — aggregated visit statistics (page address without query parameters, country, device type). No cookies, no profiling.
• Microsoft Clarity — usage statistics and interaction recordings that help us find usability problems. The document preview area and form inputs are marked for masking so contract content does not end up in recordings. Clarity sets its own cookies. We pass on consent for analytics only — never for advertising.

You can withdraw consent at any time below. Withdrawal does not affect the lawfulness of processing carried out before it.

Hosting, service providers and data transfers

The site is hosted by Vercel Inc. Like any web server, the host records technical access logs (IP address, browser type, requested address, timestamp). We process these based on our legitimate interest in keeping the service secure and available.

These providers process the data described on this page on our behalf:

• Vercel Inc. (USA) — hosting, server functions and logs, and Vercel Analytics once you consent. The functions behind sending for signature run in Frankfurt (EU), but Vercel also processes data in the United States.
• Neon (Databricks, Inc., USA) — the database for sending for signature, on servers in Frankfurt (EU).
• Resend (USA) — sends the emails with links and the reminders. Recipient addresses and message records are stored in the United States.

Microsoft Clarity runs only with your consent, and for it Microsoft is a separate controller rather than a provider acting on our behalf. The data goes to Microsoft Ireland Operations Limited and is transferred to data centers in the United States. See the Microsoft Privacy Statement.

For visitors in the European Economic Area, transfers to the United States rely on the European Commission's decision on the EU-U.S. Data Privacy Framework, which Vercel, Databricks (Neon), Resend and Microsoft have joined, with standard contractual clauses as a fallback.

Data controller and your rights

The data controller is Gmbi Marek Papis, operator of airenovationcalculator.com. Full details of the controller, legal bases, retention periods, recipients and your rights (access, rectification, erasure, restriction, objection, portability and lodging a complaint with a supervisory authority) are set out in the main site's privacy policy:

airenovationcalculator.com privacy policy