Privacy

Privacy Policy

Last updated 24 May 2026

Placeholder copy pending UK lawyer review. This document is a working draft for the Reeve Sign demo. The launched version will be reviewed for UK eIDAS, UK GDPR, the Electronic Communications Act 2000, and the Consumer Rights Act 2015 before public release.

This Privacy Policy explains what personal data Reeve Sign collects, how we use it, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The data controller is Reeve Consult Ltd ("Reeve", "we", "us"), registered in England and Wales (Company № 14872319).

1. What we collect

Account data

Name, email address, password (hashed), profile photo, language, time zone, role within your workspace.

Envelope data

Document title, document contents (as you upload), recipient names and email addresses, field placements, audit events (IP address, user-agent, timestamps for opened, consented, signed, declined).

Operational data

Sign-in times, device type, browser, error logs. Cookies as described in our Cookie Policy.

2. Why we use it

To provide the Service — process envelopes, deliver signing requests, produce audit chains. Lawful basis: performance of a contract.
To maintain security — detect fraud, prevent abuse, comply with statutory record-keeping. Lawful basis: legitimate interest and legal obligation.
To communicate with you — service notifications and security alerts. Lawful basis: performance of a contract.
To improve the Service — aggregated, anonymised analytics. Lawful basis: legitimate interest.

3. Retention

Envelope and audit data are retained for at least seven years to support the evidentiary value of signed documents. You may export your data at any time. Account data is retained for the lifetime of the account and for a further 30 days after closure.

4. Sharing

We do not sell personal data. We share with sub-processors only as needed to deliver the Service — hosting, transactional email delivery, error monitoring. A current list of sub-processors is available on request from privacy@reeveconsult.co.uk.

5. International transfers

Personal data is processed in the United Kingdom and the European Economic Area. Where we transfer data outside the UK / EEA, we rely on the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or other approved safeguards.

6. Your rights

You have the right to access your data, request correction, request erasure, object to processing, request portability, and withdraw consent where consent is the lawful basis. To exercise any of these rights, email privacy@reeveconsult.co.uk. You may also complain to the ICO at ico.org.uk.

7. Public verify URL

Reeve Sign publishes a public verify page for each completed envelope at app.reevesign.com/verify/<envelope-id>. Per design decision D9, this page intentionally exposes only the envelope ID, document title, completion timestamp, and content hash — never signer names, emails, or IP addresses. See Cookie Policy for cookie usage on these pages.

8. Contact

Reeve Consult Ltd. Email: privacy@reeveconsult.co.uk.