Privacy Policy

pdfscore(pdfscore.com, the "Service") lets a signed-in sender upload a PDF, place fields, and email recipients a link to sign it in their browser. This policy explains what personal information we collect, why, and the rights you have — including specific rights for California residents.

We collect the following categories of personal information:

• Identifiers & account data: for senders, the name, email, and profile image returned by Google sign-in; for recipients, the email address a sender enters and the name you type when signing.
• Documents & signing content:the PDF a sender uploads, field placements and annotations, and each recipient's typed name, drawn signature image, and signing date.
• Internet/network activity: standard request logs, error logs, and email delivery metadata.

We do not intentionally collect sensitive personal information or information from children under 16.

We collect this information directly from you (sender or recipient), from Google when a sender signs in, and automatically from your device when you use the Service.

We use this data solely to operate the Service: to authenticate senders, deliver signing links to recipients, render the signed PDF, email completed copies, send service-related notifications, and secure and debug the Service. We do not use it for advertising or build profiles about you.

We share personal information only with service providers who process it on our behalf under contract:

• Google — sender sign-in (OAuth); basic profile and email scope only.
• Resend — delivers our transactional and notification email; processes recipient addresses and attached signed PDFs.
• Neon — managed Postgres where signing requests are stored.
• Vercel — hosting, file upload storage (Blob), and cookieless, aggregate traffic analytics (no cross-site tracking or personal profiles).

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA). We have not done so in the preceding 12 months.

Unsigned or abandoned signing requests are permanently deleted 30 days after they are issued (we email a reminder about a week beforehand). Completed (fully signed) documents — the signed PDF and its audit trail — are retained as legal records of the transaction so they remain available if a signature is later questioned; you may delete a completed document yourself from your dashboard, or ask us to. Sender account records from Google sign-in are retained until you ask us to delete them. Operational logs are kept for a limited period for security and debugging.

Depending on where you live, you may have the right to:

• Know / access the personal information we hold about you and how we use and disclose it;
• Delete personal information we have collected;
• Correct inaccurate personal information;
• Opt out of any sale or sharing of personal information (note: we do neither);
• Non-discrimination for exercising these rights.

Email support@pdfscore.com with your request. We will verify your request using the email address associated with the data (for example, the address that received a signing link) and respond within the time required by law. You may use an authorized agent to submit a request on your behalf; we may ask the agent for proof of authorization. Senders can also delete any signing request they created directly from their dashboard.

California Civil Code §1798.83 lets California residents request information about disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information for third-party direct marketing.

We may update this policy; we will revise the effective date above when we do. Material changes will be reflected on this page.

Questions or requests: support@pdfscore.com.