Privacy Policy

1. What we collect

• Account data: your name, email and authentication details.
• Documents you upload and the fields, recipients and signatures attached to them.
• Signing evidence: IP address, browser user agent and timestamps for consent, viewing and signing events.
• Billing data processed by Paystack - we never store card numbers.

2. Why we collect it

To operate the service, to build the tamper-evident audit trail that makes electronic signatures defensible, to bill for paid plans and to send the transactional email the signing process requires. This is lawful processing to perform a contract and to pursue our legitimate interests in a secure, auditable service. We do not sell personal information, and we do not use your documents to train any model.

3. Responsible party and operator

For your account data, Bonang Technologies is the responsible party. For the contents of the documents you send, you (or your organisation) are the responsible party and we act as operator, processing that personal information only on your instructions. You are responsible for having a lawful basis to send each document and to involve each recipient.

4. Children's data

Lucid Signing is a business tool intended for users aged 18 and over. We do not knowingly create accounts for children. If a document you send happens to contain a minor’s personal information, you are responsible for obtaining any parental or guardian consent required under POPIA before sending it.

5. Storage and security

Documents and signatures are stored encrypted at rest, with access controlled per row at the database layer, and all traffic is protected with TLS. Signing links are unique per recipient, expire automatically and are invalidated after use. See our Security overview for detail.

6. Who we share it with

We do not sell or rent personal information to anyone. It is shared only with the operators we need to run the service:

• Supabase - hosts our database and encrypted file storage.
• Paystack - processes payments for paid plans; card details go to Paystack directly and never touch our servers.
• Our email provider - delivers the transactional email the signing process requires, such as signing links and completion notices.

Each processes personal information only to provide its service to us. Beyond these, we disclose personal information only where the law requires it - for example a court order - and then only what is required.

7. Marketing communications

Signing-related email (signing links, reminders, completion notices) is part of the service and cannot be switched off while a document is in flight. Product updates and tips are separate: they are opt-in, every message carries a working unsubscribe link, and you can turn them off any time in Settings.

8. Where your data is hosted

We use Supabase for our database and file storage and Paystack for payments. Depending on region configuration, some processing may occur on servers outside South Africa. Where personal information is transferred cross-border, we rely on the conditions in section 72 of POPIA, including that the recipient is subject to laws or binding agreements providing an adequate level of protection.

9. Retention

Executed documents and their audit trails are retained while your account is active, because their value is long-term evidence. You may delete any document at any time, and you may close your account yourself from Settings, under Sign-in & security - which deletes your documents, signed copies, certificates and audit trail immediately. You can also ask us to do it at info@lucidsigning.com.

10. Your rights

You may request access to, correction of, or deletion of your personal information, and object to certain processing. Deletion you can also carry out yourself, without asking us, from Settings. For anything else, contact our Information Officer at info@lucidsigning.com. You may also lodge a complaint with the Information Regulator of South Africa (enquiries@inforegulator.org.za).

11. Breach notification

If a security compromise affects your personal information, we will notify you and the Information Regulator as soon as reasonably possible after becoming aware of it, in line with section 22 of POPIA.

12. Information Officer

Information Officer: Bonang Technologies, Eglin Road, Sandton, 2196, South Africa. Reach the Information Officer at info@lucidsigning.com or by post at the address above.

13. Changes to this policy

If we change this policy, the date at the top changes with it, and if the change meaningfully affects how your personal information is handled we will tell you by email or in the app before it takes effect. Earlier versions are available on request.