Privacy Policy

This policy explains how mndok (“mndok”, “we”, “us”) handles personal data when you use mndok.com, whether you send documents (a “sender”) or sign them (a “signer”).

1. Our role

For sender accounts, and for the website itself, mndok is the controller of the personal data.
For documents and the information about signers in them, the sender is the controller and mndok processes that data on the sender’s behalf to provide the signing service. If you’re a signer with questions about a document, contact its sender; we’ll help where we can.

2. What we collect

From senders

Account details: name, email address, optional company, and a bcrypt hash of your password.
Documents you upload, the signers you add, the fields you place, and your templates and API keys (stored as hashes).
Sign-in records: time, success or failure, IP address, browser, operating system and device type.

About signers

The name and email address the sender provided.
What the signer enters: signatures and initials (as images), name, email, company, designation, text and checkbox answers, including partly completed forms saved before they finish.
Signing evidence: acceptance of the e-signature disclosure, and the time, IP address and browser of each action (opening, viewing, saving, signing or declining).
Email tracking: emails we send to signers contain a small image and a tracked link. When the image loads or the link is clicked, we record the time, IP address and user agent, so the sender can see whether the email was opened and the link used. Some email apps load images automatically; we flag those where we can.
Visit details: for each visit to a signing link, the browser, operating system, device type, time zone, language and screen size, the number of saves, and when the visit started and was last active.

From everyone

Technical logs, such as IP addresses and error reports, kept to run and secure the service.

Website and app analytics

We use Google Analytics on mndok.com, including inside the app and on signing pages, to understand how people find and use mndok. It records things like pages viewed, approximate location, device and browser. Before any page address is sent to Google, we remove private parts such as signing links and password-reset links. We don’t show ads or use Google’s advertising features. In the EEA, the UK and Switzerland, analytics cookies are off by default, and Google receives only cookieless measurements.

Google sign-in

If you choose Continue with Google, Google shares your name, email address and Google account ID with us so we can create or sign in to your account. We don’t receive your Google password or access to anything else in your Google account.

3. Why we use it

To provide the service: storing, sending, signing and completing documents, and showing senders each signer’s progress (contract, or the sender’s legitimate interests).
To create evidence of how each document was signed, which protects senders and signers if a signature is disputed (legitimate interests and legal obligations).
To keep accounts and the service secure and prevent abuse (legitimate interests).
To send service emails, such as invitations, reminders and completion notices (contract and legitimate interests).
To comply with the law and respond to lawful requests (legal obligation).

Where the law requires consent, for example for some tracking in certain countries, we or the sender obtain it.

4. Who we share it with

The parties to a document. Senders see their signers’ activity and entries. Every party receives the completed PDF, whose certificate lists each signer’s name, email, timestamps, IP address and device.
Service providers who host our servers, database and email delivery, under contracts that require them to protect the data and use it only for us.
Google, for analytics and, if you use it, Google sign-in, as described above.
ESS ENN Associates, who build and operate mndok, under the same obligations as this policy.
Authorities, when the law requires it.

We never sell personal data. The public verification page shows a document’s title, signer names, partly hidden email addresses and signing times only to someone who already has that document’s hash.

5. How long we keep it

We keep account data while your account is open. Sent documents and their evidence are kept while the sender’s account is open, so signatures can be proven later. Senders can discard unsent drafts at any time, and can ask us to delete documents or their whole account by emailing us. We then remove the data within a reasonable period, except where the law requires us to keep it longer.

6. Security

Connections use HTTPS, passwords are hashed, documents are stored outside the public website and served only to authorised people, and audit records are hash-chained so changes are detectable. See Security.

7. International transfers

Our servers may be in a different country from you. Where we transfer personal data internationally, we use safeguards the law requires.

8. Your rights

Depending on where you live, including under the EU and UK GDPR and India’s Digital Personal Data Protection Act, 2023, you may have the right to access, correct, update or erase your personal data, to object to or restrict some processing, to data portability, to withdraw consent, to nominate someone to exercise your rights, and to complain to a data protection authority. Some evidence of a completed signature may need to be kept even after a request, to protect the other parties to the document.

To make a request, email privacy@mndok.com. If you’re a signer, we may refer your request to the document’s sender.

9. Grievances

You can raise any privacy complaint or grievance with us at privacy@mndok.com. We’ll acknowledge it promptly and aim to resolve it within the time the law requires.

10. Children

mndok isn’t intended for anyone under 18, and we don’t knowingly collect their data.

11. Changes

We’ll update this policy when our practices change, and tell senders about significant changes before they take effect.

12. Contact

Email privacy@mndok.com.