Privacy Policy | SignCore

1. Data Controller

SignCore is a service operated by RBB SRL, a company registered in the Repubblica di San Marino.

Registered Address:
Via 3 settembre, 11, 47899 Serravalle, Repubblica di San Marino

Website: http://www.rbblab.com

Contact: [email protected]

2. Information We Collect

We collect information you provide directly to us and information generated by your use of the service, including:

Account information (name, email address)
Contract documents you upload to the service
Technical and usage data (IP address, browser type, device data, timestamps, and pages/features used)
Aggregate, anonymous usage data from our cookieless analytics (no personal profile or cross-site tracking)
Communications with us

3. Legal Bases for Processing (GDPR)

Where GDPR applies, we process personal data under one or more of the following legal bases:

Performance of a contract (to provide and operate SignCore)
Legitimate interests (security, fraud prevention, service improvement)
Legal obligations (compliance, accounting, law-enforcement requests)
Consent (for non-essential analytics and optional marketing communications)

4. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve the SignCore service
Process and analyze contract documents you upload
Send you service-related communications
Send marketing communications only where permitted by law and with unsubscribe controls
Respond to your requests and inquiries

5. AI-Assisted Analysis

SignCore uses AI-assisted analysis to extract information from contract documents. This analysis is performed to provide the service functionality. Your documents are:

Processed to extract dates, terms, and obligations
Not used to train AI models
Not shared with third parties except as necessary to provide the service

6. Data Sharing and Third-Party Processors

We do not sell your personal information. We may share information with:

Service providers acting as processors (hosting, cloud infrastructure, analytics, email, support tooling)
As required by law or to protect rights and safety
In connection with a business transfer or acquisition

Payment Processing — FastSpring

All payments for SignCore subscriptions are processed by Bright Market, LLC d/b/a FastSpring ("FastSpring"), which acts as our Merchant of Record. This means FastSpring is the seller of record for all transactions and is an independent data controller for the personal data it collects in connection with your purchase.

When you purchase a paid plan, FastSpring collects and processes the following personal data directly from you:

Name and billing address
Email address
Payment instrument details (credit/debit card number, expiry date — handled directly by FastSpring and not transmitted to us)
IP address (for fraud prevention and tax determination)
Transaction and order history

FastSpring processes this data on the following legal bases under GDPR:

Performance of contract (Art. 6(1)(b)): to execute the transaction and manage your subscription
Legal obligation (Art. 6(1)(c)): for tax compliance, invoicing, and financial record-keeping
Legitimate interests (Art. 6(1)(f)): for fraud detection and prevention

FastSpring's registered address is: 801 Garden Street, Suite 201, Santa Barbara, CA 93101, USA.

For questions about how FastSpring processes your payment data, or to exercise your data rights in relation to payment data, please refer to:

FastSpring Privacy Policy: fastspring.com/privacy
FastSpring contact: [email protected]

We receive from FastSpring a limited set of non-sensitive transaction data (e.g., subscription status, plan tier, renewal dates, and anonymised order identifiers) to manage your account within SignCore. We do not receive or store full payment card details.

7. Data Retention

We retain personal data for as long as necessary for the purposes described in this policy, including to provide the service, meet legal obligations, resolve disputes, and enforce agreements. You may request deletion of your account and associated data by contacting us.

8. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

Encryption in transit (TLS) and at rest (AES-256)
Access controls and authentication
Regular security assessments

9. Your Rights (GDPR)

Depending on your location, you may have rights regarding your personal information. For individuals in the EEA/UK/Switzerland, these include the right to:

Access your personal information
Correct inaccurate information
Object to processing based on legitimate interests
Restrict processing in specific circumstances
Request deletion of your information
Receive data portability for data you provided to us
Withdraw consent at any time where processing is based on consent
Lodge a complaint with your local data protection authority

To exercise these rights, contact us at [email protected].

10. International Data Transfers

RBB SRL is located in the Repubblica di San Marino. Some of our service providers and sub-processors, including FastSpring (USA), are based outside the European Economic Area (EEA). Where personal data is transferred to a country not recognised by the European Commission as providing an adequate level of protection, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, or we verify that the recipient participates in a recognised adequacy framework. FastSpring participates in the EU-U.S. Data Privacy Framework. You can request further information about these transfer mechanisms by contacting us at [email protected].

11. Cookies and Analytics

We don't use tracking or advertising cookies. We measure aggregate, anonymous traffic with Umami, a cookieless and privacy-friendly analytics tool that sets no cookies and builds no cross-site profile. See our Cookie Policy for details.

12. Children’s Privacy

SignCore is not intended for use by individuals under the age of 18. We do not knowingly collect information from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

14. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the Repubblica di San Marino, without regard to conflict of law principles.

15. Contact Us

If you have questions about this Privacy Policy, please contact us:

RBB SRL
Via 3 settembre, 11, 47899 Serravalle, Repubblica di San Marino
Email: [email protected]