Privacy Policy

This policy explains how Envision First, LLC ("we", "us") handles personal data on the PenMarker website and in the PenMarker app (together, the "Service").

What we collect on this website

Nothing by default. Pages are plain files. We don't set analytics cookies or load analytics until you accept them.
Your display choices. Your theme (light, dark or system) and your cookie choice are saved in your own browser's storage. They never leave your device.
Email subscription. If you subscribe, we keep your email address, the language and page you subscribed from, and the times you subscribed, confirmed (with the IP address at confirmation) and unsubscribed. This is our record of your consent.
Messages you send us, such as an accessibility report: your name, email address and message.

Google Analytics

With your consent, we use Google Analytics 4, a service of Google LLC, to understand how the website is used: which pages are visited, roughly where visitors come from, the device and browser type, and page speed measurements. We use Google's Consent Mode with every consent type off until you choose Accept in the cookie banner. We don't use advertising features, Google signals or user IDs, and we never send email addresses, names or links containing tokens to Google Analytics. Data is kept for 14 months.

You can change your choice at any time with Cookie settings at the bottom of every page. You can also block Google Analytics everywhere with Google's opt-out browser add-on. Google's own handling of the data is described in the Google Privacy Policy.

What we collect in the app

Account data: your name, email address, password (stored only as a hash), phone number if you add one, and your two-step verification settings.
Documents and signing data: the documents you upload, the fields and recipients you add, and for each signature the signer's name, email address, time, IP address and browser details, which go into the document's audit trail and certificate.
Contacts you add or import.
Security logs: sign-in times, IP addresses and devices, so we can protect your account.

On-chain records

If you choose to record a sealed document on the XRP Ledger, we write one SHA-256 hash of the document's manifest to the public ledger. The hash contains no readable personal data and the document never leaves PenMarker, but ledger records are public and permanent: they can't be deleted, including by us.

Why we use your data

To provide the Service you asked for (our contract with you), to keep it secure (our legitimate interest), to send emails you subscribed to (your consent, which you can withdraw at any time), and to meet legal obligations.

Service providers that host the Service or send email and text messages on our behalf, Google for analytics (only with your consent), and authorities where the law requires it. We don't sell personal data.

How long we keep it

Account data and documents are kept while your account is open and deleted within a reasonable time after it closes, unless the law requires us to keep them. If you unsubscribe from our emails, we keep a record of the unsubscribe so you aren't emailed again. Sign-ups that are never confirmed are deleted after 30 days.

Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict its use, and withdraw consent. Email support@penmarker.com. You can also complain to your local data protection authority.

Changes to this policy

We will post any change here with a new "Last updated" date, and tell you in the app or by email about material changes.