Last updated: September 12, 2026
1. Who we are
VowSign ("we", "us") helps wedding professionals — photographers, videographers, florists, planners, venues and officiants — send contracts to their clients and collect electronic signatures. This policy explains what information we collect through our website and app, how we use it, and the choices you have.
Two groups of people use VowSign: vendors who create an account, and clients who receive a signing link. If you are a client, your vendor decides what information to enter about you and why — your vendor is the "controller" of your data and we are the "processor". If you want to access, correct or delete information a vendor entered about you, contact your vendor first; if a request reaches us we forward it to them.
2. Information we collect
Account information: when you create an account or start the 14-day free trial — your name, email address, password and business name. The trial requires no credit card.
Client information entered by vendors: your client's name, email address, event date and pricing, plus any details a client enters in contract fields.
Documents: the template you choose, the fields you fill in, and — on Pro — any PDF you upload.
Signature and audit data: when a client signs, we record the signature or initials, the signer's email and IP address, the date and time of each event (sent, viewed, signed) and the browser or device used. This is the evidence that makes the electronic signature legally reliable, so it cannot be opted out of.
Payment information: subscription charges are processed by Stripe. We never receive or store your full card number.
Automatic information: cookies, log data, device and browser type, and how you use the site.
3. How we use your information
We use your information to create and maintain your account; generate contracts and store your uploads; email signing links, reminders and completion confirmations to your clients; collect signatures and build the audit trail that proves each contract was signed; process your subscription payment; provide support; keep the Service secure and prevent fraud; and — only if you opt in — send product news. Opting out of marketing never stops transactional messages such as signing notifications.
4. Legal bases (where GDPR applies)
Where the GDPR applies, our legal bases are: performance of a contract (running the Service you signed up for), legitimate interests (security, fraud prevention, improving the Service, and maintaining the audit trail that proves the authenticity of signatures), legal obligation (keeping records we are required to keep, including data supporting the validity of signatures), and consent (marketing emails and non-essential cookies, where required). You can withdraw consent at any time, without affecting processing that already happened.
5. Your clients' data
When you enter your client's details or send them a contract, you are the controller of that information — you decide why and how it is collected. We process it on your instructions and only to provide the Service to you. You are responsible for having the necessary rights and permissions to collect and use your client's information, and for obtaining any parental or guardian consent if a contract involves a minor.
6. How we share your information
We do not sell your personal information, and we do not share your documents with anyone except the people you send them to. We share limited data with the service providers that run the Service: Stripe (payments), Supabase (accounts and contract records), Cloudflare (hosting and file storage) and Resend (transactional email). Each is contractually bound to use your information only to provide services for us and is forbidden from using it for their own purposes. We also disclose information when legally required, to protect safety or rights, or in a merger or acquisition.
7. How we store and protect your information
All traffic to and from VowSign is encrypted in transit (TLS), files and databases are encrypted at rest, and contract records are isolated per vendor with row-level access rules so no vendor can see another vendor's contracts. Uploaded files sit in access-controlled object storage reachable only by you, your client and anyone holding the signing link you sent. Our team accesses account and transaction metadata only on a strict need-to-know basis for support and security and does not read your contract contents unless you ask us to in a support request. Card data goes directly to Stripe and never touches our servers. No method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security — if a breach occurs we will notify affected users and regulators as required by law.
8. Retention
We keep your information only as long as we need it. Account data is kept while your account is active. Drafts and in-progress contracts are kept until you delete them or close your account. Signed contracts are different — a completed contract and its audit trail are legal evidence of a binding agreement, so we keep them for as long as your account is open, and if you delete a contract or close your account we offer the option of retaining the minimal audit record so the signature can still be attested to if it is challenged. We may also retain information as required by law, to resolve disputes or to enforce our agreements. Where deletion is not immediately possible (for example in backups), we securely store the data and isolate it from further use until deletion is possible.
9. Your privacy rights
Depending on where you live, you may have the right to know what we collect and how we use it, get a copy of your information, correct it, delete it, export it in a portable format, object to or restrict certain processing, and withdraw consent at any time. Most of this you can do yourself in the dashboard — edit your profile, delete a contract, download a signed PDF. For anything else email [email protected]. We verify identity through your account login before responding and respond within 30 days (we may extend by up to 60 days for complex requests, and we will tell you). If you are a client of a VowSign vendor, send your request to that vendor — we will support them in fulfilling it. If we cannot fulfil a request, we will explain why and how to appeal.
10. Deleting your account
You can delete your account from your dashboard at any time, or by emailing us. Deletion signs you out immediately and removes or anonymises your identifiable account information, and it deletes drafts and contracts still awaiting signature. Completed, signed contracts are the exception — before closing your account, download the signed PDFs you want to keep; they are yours. If you only want to stop paying, cancel your subscription instead of deleting the account and you keep full access to your existing contracts.
11. Cookies and tracking
We use a small number of cookies and similar technologies. Essential cookies keep you logged in, keep signing sessions secure and protect the site from abuse — the Service cannot work without them. Analytics cookies help us understand how the site is used; where the law requires consent we ask in a banner when you first arrive, and you can change that choice at any time. We do not deploy third-party advertising cookies inside the product, and your contract activity is never used for ad targeting. You can also block cookies in your browser, though parts of the site may then not work.
12. California privacy rights (CCPA/CPRA)
If you are a California resident you have the right to know what categories of personal information we collect and how we use them, to access a copy, to correct it, to delete it, and to receive it in a portable format. We do not sell your personal information, and we will never discriminate against you for exercising these rights. If our marketing pages use analytics or advertising cookies, California law can treat that as a "sale" or "share" — you can opt out at any time using the "Your Privacy Choices" link in the footer or by turning on the Global Privacy Control (GPC) signal in your browser. We verify identity before fulfilling requests, you may use an authorised agent with written permission, and if we deny a request we will explain why and let you appeal.
13. Children's privacy
VowSign is a business tool for wedding professionals and contracts are signed by adults. The Service is not directed to children and we do not knowingly collect personal information from children under 13. You must be at least 18 to create a vendor account. If we learn we have collected a child's information without verified parental consent, we delete it promptly. Vendors are responsible for obtaining any required parental or guardian consent if a contract involves a minor.
14. AI and automated processing
We do not currently use artificial intelligence to draft, review or process the contents of your contracts, and we do not use your documents or your clients' information to train AI models. No automated decision with legal effect is made about you — whether a contract is valid is determined by the parties and the law, never by an algorithm. If we add AI features in future we will update this policy before the feature touches your data.
15. Changes to this policy and contact
We may update this policy as the Service changes or the law requires. The current version is always posted on this page with its effective date, and if a change meaningfully reduces your rights we will notify you by email or in-app before it takes effect. Continuing to use VowSign after a change takes effect means you accept the updated policy. Questions, complaints or privacy requests: email [email protected] (clients should contact their vendor first — we will join the conversation from there).