DRAFT for lawyer review. This is not legal advice and has not been assessed against the Australian Privacy Principles by a lawyer.

What we collect

Account information: your name, work email, business name, password (stored only as a hash) and billing status. Payment card or bank details are collected by Stripe, not stored on our servers.

Contract information: the PDF you upload, signer names and email addresses, the fields they complete, signature images, and the signed PDF.

Audit information: when a link is opened or signed, IP address, and the browser user agent (device, operating system and browser). The certificate of completion includes those details so the sender has a record.

Why we collect it

We use this information to provide the service, send signing and reminder emails, bill for contracts sent, keep a completion record, secure accounts, and meet accounting and legal obligations. We do not sell personal information.

Overseas hosting

BTD Contracts is hosted on Render. Render may store and process data outside Australia, including in the United States. Email is sent using Resend, and payments are processed by Stripe. Those providers may also hold data outside Australia. By using the service you consent to that overseas disclosure. We take reasonable steps to require those providers to handle personal information appropriately, but overseas recipients may not be subject to the Privacy Act.

Who we share it with

We share signer details and the document with the people you name on the envelope, including copy recipients. We share billing details with Stripe. We share email addresses and message content with Resend so invitations can be delivered. We may share information if the law requires it.

Retention

We keep account data, envelopes, signed PDFs, certificates and audit events while the account is open and for up to 7 years after the account closes, because the records may be needed for a dispute or for tax. Password-reset tokens are kept only until they are used or expire (one hour). You may ask us to delete information earlier. We will delete it unless we need to keep it for a legal claim, a law, or to finish an invoice.

Access and correction

You can ask for a copy of the personal information we hold about you, and ask us to correct it, by emailing hello@btdcontracts.com.au. We will respond within 30 days. If we refuse, we will explain why and how to complain.

Deletion requests

Email hello@btdcontracts.com.au with the address on the account or the signing link. We will delete or de-identify personal information we are not required to keep. Signers can ask as well as account holders. Deleting a signed contract may not be possible while the sender needs it as a business record.

Security

We use hashed passwords, hashed session tokens, access limited to your own workspace, and HTTPS in production. No method of storage is perfectly secure.

Complaints

Contact us first at hello@btdcontracts.com.au. If you are not satisfied you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.