Privacy policy

This translation is provided for information only. The French version is the only legally binding one.

Last updated: July 2026

1. When you sign yourself, your documents never reach us

The signing tool runs entirely in your browser (client-side JavaScript). When you open a PDF to sign it yourself:

• the file is read from your disk by the browser and loaded into memory (RAM);
• display, adding the signature and generating the signed file are carried out locally;
• the signed PDF is saved directly to your device's downloads folder;
• no network request carries your document, your signature or their content.

The simplest test to check this: switch off your internet connection, then sign a document. Everything works. A service that sent your file to a server would be unable to do so. From your second visit onwards, the page itself loads without a network: it is kept by your browser, not fetched again each time.

Only one operation requires a connection: the sign-up that unlocks unlimited use, since it sends your email address to our server. It happens only once, and never involves your documents.

We therefore keep no copy of the documents you sign yourself, for the simple reason that we never receive them.

2. When you get someone else to sign, the document passes through our server

The “get someone to sign” feature cannot work without the document reaching that person. So we do not claim that it stays with you: it passes through. Here is exactly how.

• The document is encrypted in your browser, using AES-256-GCM, before anything is sent. The server never receives the PDF in plain text.
• The decryption key is never stored. If you ask Parapheo to send the email, it passes through the secure request and the server's memory for the time needed to compose the message. If you choose to pass on the link yourself, it stays on your device. In both cases, it is placed after the “#” character in the final link and is not sent when that link is opened.
• The access link expires after 30 days. The encrypted file is physically erased during the next run of the scheduled purge. A daily run normally limits this additional delay to less than 24 hours, provided the task runs properly at the host. A cancellation or refusal triggers an immediate erasure attempt. Retrieval is timestamped, but does not erase the file before its expiry date, so as to avoid deletion before the browser has confirmed decryption.
• To document the process, we record the email addresses of the requester and the recipient, the file name, the SHA-256 hashes reported by the browsers, the status and the timestamps. We no longer record the IP address or the browser in the proof record.
• The recipient verifies access to their email address with a six-digit code. This verifies the address used in the process, not their legal identity. We keep only a temporary hash of this code.
• The certificate uses a random token separate from the document link. Anyone who has this confidential link can view it. The public certificate masks the email addresses and shows no file name, IP address, browser or reason for refusal.

The processing necessary to create, send and finalise the request is based on the performance of the service requested (Art. 6(1)(b) GDPR). After signature or refusal, the limited retention of proof metadata is based on our legitimate interest in establishing, exercising or defending rights in the event of a dispute (Art. 6(1)(f) GDPR). You can object to this second processing; your request will be examined taking into account the situation and any legitimate grounds that might require retention.

What this means in practice: the server storage contains the encrypted document and the metadata described above, but not the decryption key, which is not kept. A copy of this storage therefore exposes these encrypted bytes and this metadata. The confidentiality of the content relies on cryptographic protection and the secrecy of the key; it does not allow the storage to be described as inviolable. It is not the same promise as “your file never leaves your device”.

If this difference bothers you for a particular document, sign it yourself and send it by whatever means you choose: the signing tool, for its part, transmits nothing.

Your signatures

Your signed documents are stored on your device for 7 days. If you have confirmed an email address, the tool stores in your browser's database (IndexedDB) the original document, the signed document and the position of the signatures, so that you can download them again or resume your work. These files never reach us at any point, they do not leave your device, and we have no way of accessing them. They are deleted automatically after 7 days, or sooner if you exceed 10 documents or 50 MB. The “My documents” panel lets you erase everything in one click, and logging out also erases them.

The signatures you draw or import can be stored on your device, in your browser's local storage, so that you do not have to recreate them on each visit. This storage is switched on and off with a checkbox in the “My signatures” panel, and a link lets you erase everything immediately. These images never leave your device and are never sent to us.

When the “favourite texts” bonus is unlocked, the five snippets you choose are also kept in the browser's local storage. Their content is not sent to Parapheo. They disappear if you clear the site data from your browser.

3. The usage counter, stored on your device

The first three successful exports are free, whether they come from the signing tool or from a legacy PDF tool subject to the quota (the pro workspace is excluded). To keep track of where you stand, a shared counter is recorded in your browser's local storage (localStorage), on your device. A failed attempt is not counted. The storage contains only a number and, if you have unlocked access, a technical token. This token is also copied into the necessary cookie pph_acces (valid for one year). The optional cookies _ga and _ga_* can only appear after you consent to audience measurement; they are described in section 6.

This storage is strictly necessary for the service you request: it is not used for any audience measurement or profiling, and does not allow you to be tracked from one site to another. The local counter is not transmitted as such. The access token is sent only to the Parapheo APIs that need to authenticate the account, check the quota or synchronise progression; these requests contain no PDF, signature, favourite text or file name. Clearing your browser data erases the local copy.

4. Your email address, beyond three uses

To continue signing and using the PDF tools without limits, we ask you for a confirmed email address. This is the trade-off we have chosen to fund a free tool, rather than advertising or selling data.

What we collect

• your email address;
• the date of sign-up and that of confirmation;
• a truncated IP address (the last segment is replaced by a zero), kept as proof of the origin of the acceptance of the account and, where applicable, of the marketing consent;
• the indication, which you tick yourself, of personal or professional use;
• the exact wording and version of the boxes you ticked, so that we can demonstrate the terms accepted and, if you chose to give it, the marketing consent given;
• a hash of your password, produced by the bcrypt algorithm.
• for account-linked progression, activated automatically after confirmation, a random referral code, the identifier of the tool reported by the browser after a local export, the points awarded and, only if you share your link, the technical link between a referrer and a referred person; no file name, PDF content, added text, recipient or address book is recorded in these tables.

We do not ask for your name, phone number or postal address.

The password, specifically

Your password is not stored. We keep only a hash computed by bcrypt, with a random salt: a string of characters from which the original password cannot be recovered. In practical terms, if our database were stolen, the passwords would still not be readable from it.

This has a consequence we accept: we cannot give it back to you. It is shown to you only once, when your address is confirmed, and never sent by email. An email stays in an inbox for years and sometimes travels unencrypted. If you lose it, a link received by email logs you back in and you choose a new one.

Failed login attempts are counted, in the form of a hash of the address, in order to slow down repeated attempts. This counter contains neither a readable email address nor a password.

A necessary acceptance and an optional consent

These two boxes are separate and unticked by default. The first records your acceptance of the contract of use required to create the account. The second collects optional marketing consent and is never a condition for accessing the service.

Sign in with Google (optional)

You can create your access by signing in with a Google account instead of waiting for a confirmation email. In that case:

• we receive only your email address and the technical identifier of your Google account, not your name, your photo, your contacts or any other data;
• as your address has already been verified by Google, access is unlocked immediately;
• this option involves Google Ireland Limited / Google LLC, whose privacy policy applies to your relationship with Google. The Google sign-in script is only loaded when you open the access window: the signing page itself contacts no third party;
• the two boxes described above, acceptance of the terms and the optional marketing choice, apply in exactly the same way;
• this option is a convenience, never an obligation: the email address route remains available and involves no one other than us.

What we do not do

• No transfer to third parties. Your address is not sold, rented or shared with partners. If this were ever to change, we would ask you again, explicitly, naming the recipients; a past consent would not cover this new purpose.
• No advertising and no advertising trackers on the site.
• No profiling based on your documents: we have no access to them.

How long

An unconfirmed sign-up becomes eligible for deletion after 30 days and is erased during the next run of the purge. A confirmed address is kept until you unsubscribe, and at most 3 years after our last contact. The log documenting your consents is kept for 5 years, then deleted by the same task.

For an unfinished signature request, the link becomes unusable after 30 days. The encrypted document and the corresponding metadata are deleted during the next run of the purge. After a signature or refusal, the metadata needed for the certificate can be consulted for 5 years from the final event so that an ordinary contractual dispute can be handled, then deleted during the next run. The purge must be run at least once a day; if this task fails or is not scheduled, physical erasure is delayed. This proof retention period must be reassessed if the nature of the instrument or a specific obligation requires a different period.

Unsubscribing

Every email contains an unsubscribe link that works in a single click, without justification and without logging in. The same link lets you delete the account. The metadata of a completed signature request is not deleted with the account when it remains necessary for the proof purpose described above. It is deleted when its own retention period expires. Withdrawing is as easy as consenting.

Progression events, your code and referral relationships are kept for the lifetime of the account and then deleted with it. If a referred person deletes their account after qualifying an invitation, the relationship is deleted; the referrer keeps only the points already awarded, with no information that could identify the deleted account.

5. Checking the free quota

Aggregated measurement of the PDF tools: when local processing finishes and you are connected to the internet, the browser may send Parapheo the name of the tool used, the result (success or failure), the number of pages and the size in bytes. The server adds up these figures per tool and per day to identify useful features and failures. This signal contains neither the PDF, nor its name, nor its text, nor an account identifier; the statistics table does not keep any individual journey. It is separate from Google Analytics and does not measure a simple page visit.

The counter recorded in your browser can be reset by clearing local storage or by using private browsing. For the limit of three free uses to remain meaningful, it is backed by a server-side check.

In practice, before an export from a tool subject to the quota, if you are connected to the internet, your browser asks our server whether the limit has been reached or whether your token corresponds to a confirmed account. After a successful export, the counter is incremented. These requests contain neither the document, nor the signature, nor the file name, only the quota action and, if you are logged in, the technical token.

• The server calculates an irreversible fingerprint: a SHA-256 hash combining a secret key, your IP address and your browser. The IP address is never recorded in plain text, and the fingerprint does not make it possible to identify you or to track you from one site to another.
• We keep only this fingerprint and a counter, over a rolling window of no more than 30 days. The entry then becomes eligible for deletion and is erased during the next run of the scheduled purge.
• Legal basis: legitimate interest in preventing the circumvention of a usage limit and abuse of the service (Art. 6(1)(f) GDPR).
• If you are offline, the local counter still applies: the remaining free uses and an already confirmed access work, but an anonymous person who has used up their three uses must sign in when back online.
• If your unlimited access is active, the token issued at confirmation is kept on your device. The tools can have it validated by the server before export, without transmitting the PDF; the local signing tool can continue offline with this token.

6. Cookies and audience measurement

The site primarily uses your browser's local storage for the counter and, if you confirm your address, a first-party cookie pph_acces containing only a technical unlimited-access token valid for one year. It contains neither your email address nor any readable data and remains strictly necessary for the service requested. After a separate consent, Google Analytics may set its measurement cookies (_ga, _ga_*); they do not exist before acceptance and are deleted upon withdrawal.

The site sets no advertising cookies and uses no ad network. The PDF libraries are hosted on our own domain. The Google sign-in script is loaded only when you choose that sign-in method and remains separate from audience measurement.

To work offline, the site asks your browser to keep its own files (the page, the styles, the PDF libraries) by means of a “service worker”. This mechanism stores only public files of the site, never your documents or your signatures, and allows no tracking. Your signed documents, for their part, are stored separately in the browser's database for the 7-day history described in section 1, and never leave it. You can remove it at any time from your browser's tools, Application tab, by deleting the site data.

Audience measurement is optional. It is disabled by default and only starts after you click the “Accept audience measurement” button in the banner. It uses Google Analytics (measurement ID G-5QJ8J41LHR) to find out which public pages are viewed and to improve the service. The site does not transmit any PDF, form content, email address or account identifier; the page sent is limited to the public path, without query string or fragment. Advertising signals and personalisation are disabled. You can refuse or withdraw your choice at any time via “Manage cookies”; this withdrawal disables measurement and deletes any Google cookies present.

You can also voluntarily send feedback from the tool. The server then receives the category, the rating, your message and a reduced diagnostic (browser family and width range). Do not include any document, link or secret in it. This feedback is used to fix and prioritise the product and is deleted after 90 days. To limit abuse, a temporary technical identifier derived from the IP address is used for rate limiting; it is not displayed in the administration interface and is not kept in the feedback.

7. Server logs

As with any website, the pages and scripts are delivered by a hosting server that may record technical access logs (IP address, date, requested address, browser) for security and operational reasons. These logs do not contain the content of your documents. Certificate pages prevent the referrer from being sent to other pages, but their confidential address may appear in the logs of the server that receives it. These logs are based on our legitimate interest in ensuring the security of the service (Art. 6(1)(f) GDPR), are reserved for that purpose and are not used commercially in any way.

The technical events of the “request a signature” process recorded in the application log no longer contain a file name, a document fingerprint or a token prefix. They remain associated with the email address for no more than 30 days, then are deleted during the next purge. Separate events documenting a consent or an account operation follow their own retention period of 5 years.

A “file” mail mode exists solely for local development: it writes the complete message, its recipient and its links to disk in a protected folder. It must never be enabled in production, and these files become eligible for erasure after 24 hours. The scheduled purge then carries out the erasure. The diagnostic of the last sending is also limited to 24 hours and does not keep the recipient's address in plain text.

8. Data controller

Original Web, Mohammed Afife, sole trader (entrepreneur individuel), 10 avenue Jean Mermoz, 13160 Châteaurenard, France. For any question or request concerning your data: contact@original-web.com.

9. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability provided for by the GDPR, as well as the right to withdraw your consent at any time.

• The quickest way: from your account area, the “delete my account” button immediately erases the access account data. Completed signature records follow the separate proof retention period stated above.
• The unsubscribe link in each of our emails withdraws your marketing consent without affecting your access to the tool.
• Otherwise: write to contact@original-web.com. We reply within 30 days at the latest, usually much sooner.

You can also lodge a complaint with the CNIL, 3 place de Fontenoy, 75007 Paris, cnil.fr.

10. Processors

• Hosting of the site and database: Hostinger International Ltd, 61 Lordou Vironos Street, 6023 Larnaca, Cyprus (European Union).
• Sending emails: the code allows either the mail server of the host Hostinger International Ltd, used by default, or the API of Brevo, Sendinblue SAS, if this mode is enabled in the production configuration. This page cannot determine which mode is currently enabled. Any activation of Brevo must be entered in the record of processing activities and covered by the corresponding data processing agreement.
• Google authentication (only if you choose this option): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A transfer to Google LLC (United States) is possible in this context, governed by the standard contractual clauses and the EU-US Data Privacy Framework.

The actual recipients therefore depend on the options enabled in production. They must be checked at each release, and this policy must be updated if the configuration changes.

11. Changes

Any change to this policy is published on this page with a new date. A new purpose, for example a multi-signatory process involving server-side processing, or the sending of partner offers, would be the subject of separate information and, if it is based on consent, of a new explicit request. We never apply a change retroactively to consents already obtained.

Sign my PDF