Privacy Policy

Last updated: October 15, 2026

This policy explains what personal data the nondisclosures.com service (NonDisclosures) handles when you visit the website, generate a preview NDA, hold an account, sign an NDA someone sent you, or connect a CRM or applicant tracking system. It explains why we handle that data, who else receives it, how long we keep it and what you can ask us to do. It is written to meet the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).

1. Who is responsible for your data

For account, billing, website and support data, the controller is the administrator of the nondisclosures.com service. You can reach the administrator about anything in this policy at support@nondisclosures.com. We answer privacy requests from that address.

For the content of NDAs and the data of people who sign them, the picture is different, as described in section 6.

2. What this policy covers

It covers the public website, the one-time preview generator on the home page, the web application you use after signing in, the signing pages that counterparties open from an email link, the emails we send (sign-in codes, signing invitations, reminders, billing notices), integrations you connect and support conversations by email. It does not cover other websites you reach through links on our pages or the CRM, ATS and messaging tools you connect, which have their own policies.

3. What we collect

We collect only what the service needs to work.

• Account data. Email address, name, a hashed password or sign-in code record, time zone, the workspace you belong to, your role (admin, editor or viewer) and your plan.
• NDA content. The data you enter or upload to create agreements: party names, legal entity types, addresses, signer names, titles and email addresses, the purpose of the agreement, chosen clauses, term, governing law, free-text additional terms, and the generated or uploaded documents themselves (PDF and DOCX files).
• Signer data. When someone signs, views or declines an NDA: their name and email address as entered by the sender, the time the invitation was opened, the typed or drawn signature, IP address, browser and device information (user agent), timestamps of each step, a decline reason if they give one, and a cryptographic hash of the document. This is the audit trail that makes the signature verifiable.
• Register data. Status, owner, counterparty, type, effective date, expiry date and reminder history of each agreement, plus notes and tags your team adds.
• AI analysis data. On paid plans, the text of documents you ask us to review or extract, the description you write when using AI drafting, and the results (summary, risk score, flagged clauses, extracted terms).
• Integration data. If an admin connects a CRM or ATS, the records needed to send an NDA at the chosen stage, typically deal, account or candidate name, contact names and email addresses, the stage, the record identifier, plus the access token for that connection. If you connect a messaging tool, the channel identifiers we post to.
• Usage counters. How many NDAs you have sent and AI analyses you have run in the current billing period.
• Billing metadata. Plan, billing period, amounts, invoice numbers, billing email, the last four digits and brand of your card, its expiry month and country, tax identifiers you provide and the status of each payment. Full card numbers are entered directly with our payment operator and never reach our servers.
• Technical logs. IP address, browser and device type, pages requested, timestamps, error reports and security events such as failed sign-in attempts.
• Preview inputs. If you try the generator without an account, the NDA type, the party names, purpose, term and state you entered, and a hashed form of your IP address used to limit previews.
• Support messages. What you write to support@nondisclosures.com and our replies.

We do not ask for and do not want special categories of data (health, religion, biometric data and similar). Please do not put them into NDAs or uploads unless an agreement genuinely requires it.

4. Why we use it and on what legal basis

We do not send marketing emails without your consent, and you can unsubscribe from any non-essential email with one click. We do not sell personal data and we do not share it for cross-context behavioral advertising.

5. AI processing

AI features run only for paying accounts and only when a user starts them. The text of the document, or the deal description, is sent to an AI model provider that processes it on our behalf and returns the result. We do not use your documents to train AI models, and the AI model provider may use the content only to return the result to us. Analysis results are stored with the NDA in your workspace. AI output can be wrong and is not legal advice, as our Terms of Service explain.

6. Customer content and people who sign NDAs

When a customer uses NonDisclosures to prepare and send agreements, the customer decides what goes into those agreements and whom to send them to. For that NDA content and for signer data, the customer is the controller and the administrator of the nondisclosures.com service acts as a processor that handles the data on the customer's instructions.

If you received an NDA through NonDisclosures and are not our customer:

• the company that sent it to you is responsible for why your data is in the agreement, and you should contact it first about access, correction or deletion;
• we use your name, email address and signing details only to deliver the invitation, show you the agreement, record your signature or decline, send you the completed document and keep the audit trail;
• we do not add you to any mailing list and we do not use your data for our own marketing;
• you can write to support@nondisclosures.com and we will pass your request to the sender and help it respond.

A signed agreement and its audit trail are evidence of a contract. Deleting them can harm one of the parties, so signed documents are deleted on the instructions of the customer that owns them, according to its retention settings, rather than at the request of a single signer, except where the law requires otherwise.

7. Who receives your data

We use a small number of service providers, each bound by a data processing agreement and allowed to use the data only to provide their service to us:

• a hosting provider that runs our servers and databases in data centers in the European Union and the United States;
• an email delivery provider that sends sign-in codes, signing invitations, reminders and receipts;
• a payment operator that processes card payments and stores card details;
• an AI model provider that processes documents for AI features on paid plans;
• an error monitoring and backup storage function operated within our hosting environment.

Integrations you connect (for example HubSpot, Salesforce, Greenhouse, Lever, Workable or Slack) receive the data that you or your admin choose to send to them, such as NDA status or a signed PDF. Those services are operated by their own providers under their own terms.

We may disclose data when the law requires it, for example in response to a valid court order, and we will tell the affected customer where we are allowed to. If the service is transferred to a new operator, data moves with it under the same protections and we will announce the change in advance.

8. International transfers

Our providers may process data outside your country, including in the United States. Where data leaves the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism, together with additional safeguards such as encrypted connections.

9. How long we keep data

10. Security

Every connection to the service uses TLS. Documents are kept in private storage that is never publicly reachable, and every download passes an access check. Signing links are stored only as SHA-256 hashes and expire, and secrets of connected integrations are encrypted in our database. Access inside the service follows workspace roles, and access by our staff is limited to what is needed to run and support the service, and logged. Every NDA keeps an audit trail of who did what and when. Company plans add single sign-on (SAML), audit log export and configurable data retention. More detail is on our Security page. No system is perfectly secure, and if a breach affects your personal data we will notify you and the competent authorities as the law requires.

11. Your rights

Depending on where you live, you have the right to access your data, correct it, delete it, receive it in a portable format, restrict or object to certain processing and withdraw consent you have given. Residents of California and other US states with privacy laws have the right to know, delete and correct personal information and to opt out of its sale or sharing, which we do not do. We will not treat you differently for using any of these rights.

Account holders can export their NDAs and register at any time from the application. For any other request, write to support@nondisclosures.com from the email address on the account. We may ask for confirmation of identity and will answer within 30 days (45 days under the CCPA, with notice if we need an extension). You may also complain to your local data protection authority.

12. Children

NonDisclosures is a business tool and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us data, write to us and we will delete it.

13. Cookies

We use only cookies that are strictly necessary for the website and application to work. See our Cookie Policy.

14. Changes to this policy

When we change this policy, we update the date at the top. If a change materially affects how we use your data, we will tell account holders by email before it takes effect.

15. Contact

Questions about this policy or your data: support@nondisclosures.com, the administrator of the nondisclosures.com service.