Undersign

Privacy Policy

Effective October 8, 2026
Updated October 8, 2026: drafts you never sent are deleted with your account (section 5).

Undersign is an electronic signature service, available at undersign.cc and in the Undersign mobile apps. It is operated by Suntree Inc. ((주)선트리, “we”). This policy explains what personal information we collect, why, who processes it, how long we keep it, and the rights you have.

1. Information we collect

• Account: your name, email address, mobile phone number and password. We store the password only as an Argon2 hash.
• Business details (optional): business or company name, business registration number and business type, if you add them to show on your contracts.
• Identity verification (optional): when you or a sender chooses identity verification, it runs through Danal, a licensed identity verification provider. We receive your verified name and date of birth. The connecting information (CI/DI) is stored only as a keyed hash, never in the clear.
• Your content: documents you upload, signatures and initials you draw or save, what you enter into document fields, and project names.
• People you send documents to: the name, email address and/or mobile number you enter for each signer, approver or viewer.
• Signing records: for each document, an audit trail of events (sent, opened, verified, signed and so on) with the time, IP address and browser or device type, plus fingerprints (hashes) of the document versions.
• Notifications: on Android, a device token from Firebase Cloud Messaging so we can send push notifications.

We do not collect your location, contacts, photo library, payment information or advertising ID.

2. How we use it

• To run your account and the service: sending documents, collecting signatures and approvals, and delivering completed documents.
• To verify signers’ identity at the level the sender requires.
• To send signing requests and updates by email, text message and push notification.
• To keep tamper-evident evidence of who signed which document and when.
• To keep the service secure, prevent abuse, and meet our legal obligations.

We don’t use your information for advertising or profiling.

3. Who can see it

Other parties to a document. A completed document comes with a certificate of completion. It lists each signer’s name, email address, title and role, the business they signed for (if any), how they were verified, and when they signed.

Service providers that process data for us under contract, only to provide Undersign:

We disclose information to authorities only when the law requires it. We never sell or rent personal information.

4. Transfers outside Korea

Our servers are located in India, and Twilio and Google process data in the United States. Your information is transferred to them over encrypted connections when you use the service. Each provider receives only the information its task needs, as listed above: the hosting provider stores everything you keep in Undersign; Twilio receives phone numbers and message text; Google receives email addresses, message text and device tokens. They keep it only as long as needed to provide their service to us. If you don’t want your information transferred, you can choose not to use Undersign or delete your account. That may mean you can’t use the service.

5. How long we keep it

• Account information is deleted as soon as you delete your account. This includes your profile, identity verification results, business details, saved signatures, uploaded files and device tokens.
• Drafts (documents you created but never sent) are deleted together with your account, including the files you uploaded to them.
• Documents you sent, with their signing records, are evidence of every party’s rights. We keep them separately from account data for 10 years from the day the contract was completed or ended (declined, voided or expired), in line with Article 33 of the Korean Commercial Act, and then destroy them. Their link to your account is replaced with “deleted user”. If you never sent a document, your account is deleted completely.
• Device tokens are removed when you sign out.

6. Cookies

We use one essential cookie to keep you signed in. We don’t use analytics or advertising cookies.

7. How we protect it

All traffic is encrypted with HTTPS. Passwords are stored only as Argon2 hashes, and identity connecting information only as a keyed hash. Each document’s audit trail is hash-chained, so any change to it can be detected. Access to production systems is restricted to authorized staff.

8. Your rights

You can ask to see, correct or delete your personal information, or to stop its processing. You can view and edit most of it in Settings → Profile. To delete your account, go to Settings → Profile → Delete account (설정 → 프로필 → 회원 탈퇴). Step-by-step instructions are at undersign.cc/ko/legal/account-deletion. If you can’t sign in, or for anything else, email allsign523@gmail.com. We will respond within 10 days.

9. Children

Undersign is a service for adults. We don’t knowingly collect personal information from children under 14.

10. Changes to this policy

When we update this policy, we will post the new version here with a new effective date. If the changes are significant, we will also tell you in the app or by email.

11. Contact

Operator

Suntree Inc. ((주)선트리) · Business registration no. 431-81-03312

Address

Room D210, 2F, 558-1 Gukchaebosang-ro, Jung-gu, Daegu, Republic of Korea

Privacy officer

이장형 (Representative Director)

Email

allsign523@gmail.com

Phone

+82 70-8019-0827

You can also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, phone 118).