Privacy Policy

Draft notice: This document is a draft and must be reviewed by a licensed Ontario lawyer before publishing.

Effective date: October 29, 2026

This Privacy Policy explains how Nezuna Technologies Inc. ("Nezuna", "we", "us") collects, uses, discloses, and protects personal information through docnez.com and the Docnez electronic signature service (the "Service"). We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Québec residents, the Act respecting the protection of personal information in the private sector as amended by Law 25.

1. Our Roles

• Account information (people who sign up and pay): Nezuna decides how it is handled and is responsible for it.
• Document content and signer information that Account Holders upload or enter: we handle it on behalf of the Account Holder, who is responsible for having a lawful basis and any required consent to share it with us and with signers. We process it only to provide the Service, keep it secure, and meet legal obligations. Signers with questions about a document should first contact the person who sent it.

2. Information We Collect

From Account Holders

• Name, email address, password (stored hashed), organization name.
• Billing details: plan, billing address, transaction history. Card data is collected and stored by Stripe; we receive only limited details such as card brand, last four digits, and expiry.
• Support communications and preferences.

From Signers (no account required)

• Name and email address provided by the sender.
• Signatures and initials you draw, type, or upload.
• Audit trail data: IP address, timestamps of viewing, signing, and other events, browser user agent, and approximate location derived from IP address, used only for security and fraud prevention.

Documents

• PDFs uploaded and the resulting signed documents and certificates of completion, which may contain any personal information the sender includes.

Automatically

• Device and log data (IP address, browser, pages visited, errors) and cookie data (see Section 9).

3. How We Use Information

• To provide the Service: upload, field detection, sending signing links, collecting signatures, and generating certificates of completion and audit trails.
• To bill you and manage subscriptions.
• To send transactional and service messages.
• To secure the Service, prevent fraud and abuse, and enforce our Terms.
• To maintain and improve the Service using aggregated or de-identified data. We do not use document content to train machine learning models.
• To comply with law and respond to lawful requests.
• With your consent, to send marketing messages.

We do not sell personal information.

4. Consent

By using the Service you consent to the collection, use, and disclosure described here. Where required, we obtain express consent (for example for marketing or non-essential cookies). You may withdraw consent, subject to legal and contractual limits; withdrawing may mean we cannot provide parts of the Service. Signers consent to the recording of the audit trail as a condition of signing through the Service.

5. Sharing and Subprocessors

We share personal information only:

• with the sender and other parties to a document, who receive the signed document, certificate of completion, and audit trail (including signers' IP addresses and timestamps);
• with service providers that process data for us under written agreements requiring confidentiality and security:

Provider	Purpose	Location
Stripe (to be confirmed)	Payment processing	United States and other countries
DigitalOcean (planned) (to be confirmed)	Hosting, storage, and databases	Toronto, Canada (to be confirmed)
Postmark (planned) (to be confirmed)	Delivery of signing links and transactional email	United States (to be confirmed)

• when required by law, court order, or to protect rights, safety, or the Service;
• in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality protections.

We will update this list before adding a new subprocessor by updating this Privacy Policy page; we have no obligation to send individual notice.

6. Transfers Outside Your Province or Canada

Some providers store or process personal information outside Québec and outside Canada, including in the United States. There it may be accessible to courts, law enforcement, and national security authorities under local law. Before transferring information outside Québec, we assess whether it will receive adequate protection, as required by Law 25, and we use contractual safeguards with providers.

7. Retention

Data	Retention
Account data	While the account is active, then deleted or anonymized within 90 days after closure, unless needed longer by law
Documents, signed copies, certificates, audit trails	Until the Account Holder deletes them or closes the account, then deleted within 30 days (backups within 90 days)
Billing and tax records	As required by tax law (generally 7 years)
Logs and security data	12 months
Marketing consent records	As long as needed to prove consent under CASL

Account Holders are responsible for downloading and keeping their own copies of signed documents and audit records. Deleted documents cannot be recovered.

8. Email Communications and CASL

• Transactional messages (signing requests, completion notices, receipts, security and account notices, changes to terms) are sent as part of the Service and do not require marketing consent.
• Signing request emails are sent at the request of the Account Holder; the Account Holder is responsible for having a lawful reason to contact each signer. We do not use signer emails for our own marketing.
• Marketing messages are sent only with your consent (express or implied as CASL allows), identify Nezuna with our contact details, and include a working unsubscribe link. We honour unsubscribe requests within 10 business days.

9. Cookies

We use only essential cookies for sign-in, security, and session management, which are required for the Service to work.

We do not currently use analytics, advertising, or tracking cookies. If we add non-essential cookies in the future, we will update this policy and ask for consent where required.

You can control cookies in your browser; blocking essential cookies may break the Service.

10. Security

We use reasonable administrative, technical, and physical safeguards, including encryption in transit (TLS), encryption at rest, access controls, and hashed passwords. No system is completely secure, and we cannot guarantee security. You are responsible for protecting your password and for sending signing links only to correct email addresses.

11. Privacy Incidents and Breach Notification

If a breach of security safeguards (or, in Québec, a confidentiality incident) creates a real risk of significant harm, or a risk of serious injury, we will notify the Office of the Privacy Commissioner of Canada and/or the Commission d'accès à l'information du Québec as required, notify affected individuals as soon as feasible, and keep a record of incidents as the law requires. Where an incident affects information we hold on behalf of an Account Holder, we will notify that Account Holder without undue delay so it can meet its own obligations.

12. Your Rights

Subject to legal limits, you may:

• access the personal information we hold about you and learn how it is used and disclosed;
• correct inaccurate or incomplete information;
• withdraw consent;
• request deletion, or (in Québec) de-indexing and cessation of dissemination;
• (Québec) request your computerized personal information in a structured, commonly used technological format (data portability);
• (Québec) be informed of decisions made exclusively by automated processing; we do not currently make decisions based solely on automated processing;
• file a complaint with the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.

Data export and deletion: Account Holders can download documents, certificates, and audit trails and delete documents or their account in Account Settings. To make any other request, email privacy@docnez.com. We may verify your identity and will respond within 30 days, or as the law allows.

Signers asking for access to or deletion of a signed document should contact the sender; deleting a signer's data from a completed document may affect its evidentiary value, and we may decline requests where the Account Holder or the law requires keeping it.

13. Language (Québec)

This policy is provided in English. Where Québec law requires, a French version is available on request at privacy@docnez.com.

14. Children

The Service is not intended for anyone under the age of majority, and we do not knowingly collect personal information from children under the age of majority in their jurisdiction (and in any case under 18). If you believe a child has given us personal information, contact us and we will delete it.

15. Privacy Officer

The person responsible for the protection of personal information (Privacy Officer under PIPEDA and Law 25) is:

Privacy Officer Nezuna Technologies Inc., 29 Hemlock Drive, Markham, Ontario L3P 4M5, Canada Email: privacy@docnez.com

16. Changes to This Policy

We may update this Privacy Policy. We will post the updated version with a new effective date and, for material changes, notify Account Holders by email or in the Service before they take effect.

17. Contact

Questions or complaints: privacy@docnez.com General enquiries: hello@docnez.com