[ Legal ](https://sendnda.com/legal) Privacy Policy ============== What personal data Send NDA processes, why, for how long, and your rights over it. Steddle Group B.V. is in oprichting (in formation). 02 For everyone ------------ Document 3 of 5 This policy explains what personal information we collect when you use [sendnda.com](https://sendnda.com), why we collect it, who we share it with, how long we keep it, and the rights you have. "We", "us" and "our" is the controller under the General Data Protection Regulation (GDPR): The controller is Steddle Group B.V. in oprichting (in formation), Keizersgracht 520H, 1017 EK Amsterdam, reachable at [hello@sendnda.com](mailto:hello@sendnda.com). Requests about your data: [privacy@steddle.com](mailto:privacy@steddle.com). Information we collect ---------------------- ### When you create an agreement To generate and send an agreement we collect the details you enter: your name, email address, postal address and, where you act for a company, its name and registration number; the name and email address of the other party; and the options you choose (who discloses, purpose, duration, optional clauses). The other party adds their own postal address and, if applicable, company details when they sign. If you enter another person's details, you are responsible for having a lawful basis to do so. We use their details only to send them the agreement and to operate the signing process. This policy applies to them as well, and we point them to it in the email they receive. If you received an agreement, we obtained your name and email address from the sender who created it. We use them to send you the agreement and run the signing process, and record your signing details as described below; your name, company, email address and the time and IP address of your signature appear in the completed document and its signing certificate, which both parties receive, and the certificate also shows the IP address from which you first opened the agreement. ### When you sign When the recipient first opens an agreement we record the date and time and the IP address. When a party signs it we record the date and time, the IP address and user agent (browser and device) used, the typed signature, and a cryptographic hash of the document as signed. When a party signs we also record which credential was used (a one-time sign-in link, a passkey, or an API or OAuth token used by an AI agent), by reference only and never the credential itself. When an agent signs, the IP address and user agent are the agent's, not the party's device. We keep a chained log of events (created, sent, resent, viewed, amended, redlined, notified, approved, signed, completed, frozen, certified) so that the history of an agreement can be verified later. An amendment event records the values before and after the change. A redlined event records that the sender was shown which clauses the other party's own law changed. A notified event records what a party was shown about the law of their own country, in the wording they were shown, before they signed. An approved event records that a party approved the clauses their governing law asks them to approve apart from the rest. We also record whether our emails about the agreement were delivered or bounced. This is the signing record both parties rely on as evidence of what was agreed. When an agreement is completed we issue a signing certificate with the signed PDF. For each party it shows the name, company and email address and the time and IP address of signing. It also shows the events in the signing record, among them the browser each party signed with and the IP address from which the recipient first opened the agreement, including any changes made before signing with the old and new values, and the hashes of the documents. Both parties receive the certificate, so each party's details on it are shared with the other party. When you are signed in and we show you the text of an agreement, the preview while you draft one included, we record that we showed it to you, and we mark that copy of the text with an identifier for that record. The mark is invisible and changes nothing the agreement says. It lets a copy of the text that turns up elsewhere be traced back to the account it was shown to. A copy you download before anyone has signed is printed with your name on it. Each agreement also words a few of its phrases in one of several equivalent ways, chosen for that agreement alone. Both parties sign that wording and the sealed PDF carries it, so a copy of the agreement found elsewhere can be traced to the agreement and its parties. ### When you have an account Sending an agreement, or opening one you received, creates an account for your email address. We store your name, email address, and a hash of any API tokens you create (we cannot read the token itself), together with when they were last used. Agreements you sent or received at your email address appear in your account. ### Your Steddle account You sign in to Send NDA with a Steddle account: one account for every Steddle product, kept at [account.steddle.com](https://account.steddle.com). It holds your name, your email address, the language you chose, the public key of any passkey you register, and which Steddle products you have signed in to, with when you first and last did. There is no password. When you sign in, your Steddle account tells Send NDA your name, email address and language, and how you signed in, with a passkey, a link by email or a remembered session, or with the passkey you confirmed because Send NDA asked for one, identified by reference and never the credential itself. Send NDA keeps its own copy of those details. It does not learn which other Steddle products you use. In your Steddle account you can change your name or email address, and the change reaches every product you have signed in to. You can leave Send NDA, which deletes your account here; sign out of every product at once; or delete your Steddle account, which deletes your account in every product you have signed in to. What stays of your use of Send NDA after you leave is described in the rest of this policy. ### When you use the API or MCP server We record when each API token was last used, and when an agent last used your account. The Agents page in your account lists every token and every connected app, and you can revoke either there. AI agents you connect act on your account with the details you give them; we do not receive your conversations with them. ### Automatically The platform Send NDA runs on and Cloudflare, which stands in front of it, log standard request data (IP address, browser, pages requested, timestamps) for security and troubleshooting. If an error occurs we record technical details about it, which may include the request and the account involved. Website analytics count visits, except on sign-in pages and an agreement's own page, where you sign (see Cookies below). Why we process it and on what basis ----------------------------------- - **To provide the service** (generate, send, sign and store agreements; run accounts and the API): performance of our contract with you, and for the other party our legitimate interest in completing the agreement they were sent. - **To keep the signing record and issue the signing certificate**: our and both parties' legitimate interest in being able to prove what was signed, by whom and when. - **Security, abuse prevention and troubleshooting**: our legitimate interest in running a secure and reliable service. - **To count visits to the site**, on the pages where our analytics run: our legitimate interest in knowing which pages are read and how fast they load, measured as the Cookie Policy describes. Turn on Global Privacy Control or Do Not Track in your browser and the script sends nothing. - **Service emails** (signing links, signature notifications, completed documents): performance of our contract. We do not send marketing email. - **Legal obligations**: where we must keep or disclose information by law. Providing the details requested when creating or signing an agreement is necessary to generate and execute it; without them we cannot provide the service. We do not make automated decisions with legal or similarly significant effects. Who we share it with -------------------- We share personal information only with providers that help us run Send NDA, under data processing agreements. Resend delivers our email: signing links, notifications and completed documents. | Party | What it does | Where, and on what ground | |---|---|---| | Laravel Cloud | Hosts Send NDA and its database, and keeps the platform's access log for [seven days](https://laravel.com/cloud/docs/pricing), the period of the plan Steddle runs on | Frankfurt (`eu-central-1`); Laravel, a company in the United States, is certified under the EU-US Data Privacy Framework (article 45 GDPR), its [trust centre](https://trust.laravel.com/?product=cloud) states, which also holds its data processing agreement | | Cloudflare | Stands in front of the site, sets `__cf_bm` and keeps an access log of its own, for as long as the criteria in its [privacy policy](https://www.cloudflare.com/privacypolicy/#11-data-retention) say | Data centres in the EU and the United States; the EU-US Data Privacy Framework (article 45 GDPR) and the standard contractual clauses (article 46 GDPR), as its [GDPR page](https://www.cloudflare.com/trust-hub/gdpr/) states | | Steddle account | Signs you in and holds your name, email address, language and passkeys | Frankfurt, on Laravel Cloud | | Resend | Delivers Send NDA's mail | United States; the EU-US Data Privacy Framework and the standard contractual clauses in its [data processing agreement](https://resend.com/security/gdpr) | | Visitors | Counts visits, as above | Visitors Now LLC, a US company, processes the analytics data in the EU, at Hetzner, according to its [data processing agreement](https://visitors.now/dpa), and names no basis for a transfer | | Cloudflare R2, through Laravel Cloud | Object storage for the agreements, their sealed PDFs and certificates | Where Cloudflare places it under its default jurisdiction, which can be outside the European Economic Area; the same ground as Cloudflare above | We may also disclose information where required by law, court order or a competent authority, to establish or defend legal claims, or to a successor if Send NDA is transferred to another operator, who will remain bound by this policy. We do not sell personal information and we do not use your agreements to train AI models. Where it is stored ------------------ The application and its database run in the European Union, in Frankfurt. The agreements, their sealed PDFs and certificates sit in Cloudflare's object storage, attached by Laravel Cloud, where Cloudflare places it under its default jurisdiction, which can be outside the European Economic Area. Where a provider can reach data from outside the EEA, the table under Who we share it with says on what ground. How long we keep it ------------------- - **Drafts** that were never sent are deleted 7 days after creation if they were never confirmed, and 90 days after they were last changed if they are saved in an account. - **Sent but incomplete agreements** are deleted 90 days after they were sent, or earlier if the sender deletes them from their account or through an agent. - **Completed agreements**, their signing records and signing certificates are kept until five years after the end of the confidentiality period stated in the agreement, which matches the ordinary limitation period for claims under it. Each party keeps its own sealed copy after that. Because the other party relies on the same record to establish or defend legal claims, a request by one party to delete a completed agreement will normally be refused on that ground (GDPR Article 17(3)(e)); we delete earlier where both parties ask us to or where the law requires it. - **Account data** is kept while your account exists. Leaving Send NDA or deleting your Steddle account deletes it at once, with your tokens and connected apps; agreements you are a party to stay subject to the rules above. - **Records of who was shown an agreement** are kept while your account exists and are deleted with it. They outlive the agreement itself, so that a copy of the text found later can still be traced to the account it was shown to. - **Sign-in links and session data** are deleted within 30 days, and records of failed background tasks, which can contain email addresses and agreement details, within 14 days. - **Error records** are kept for up to 14 days. How long the platform and Cloudflare keep their access logs is stated under Who we share it with. Security -------- Traffic is encrypted in transit. Sign-in and signing links carry a single-use token that cannot be guessed and that expires: after 15 minutes for the link that confirms an agreement sent from the home page and after 7 days for the link in an agreement email. Completed documents are frozen: the rendered document and PDF are stored with a hash that is recorded in the event chain, so a later change to the template does not affect what was signed, and a change to the stored document or log would no longer match the PDF and certificate each party received. Access to the platform is restricted to the people who operate Send NDA. No method of storage or transmission is completely secure; if a breach affects your data we will tell you and the supervisory authority as the law requires. Your rights ----------- You have the right to access the personal information we hold about you, to have it corrected, to have it deleted, to restrict or object to its processing, and to receive it in a portable format. You can exercise these rights by emailing us. We may ask you to verify your identity. Deletion of a completed agreement is subject to the retention rules above, because the other party has the same interest in the record as you do. You also have the right to complain to a supervisory authority; in the Netherlands this is the Autoriteit Persoonsgegevens. Children -------- Send NDA is not intended for anyone under 18 and we do not knowingly collect information from children. Cookies ------- We set only the cookies needed to run the site; Cloudflare, which stands in front of it, sets one of them. Our analytics keep no cookie. See our [Cookie Policy](https://sendnda.com/legal/cookies). Changes ------- We update this policy when our processing changes, and publish the new version on this page with a new date. For material changes we notify account holders by email. Contact ------- Privacy questions and requests: [privacy@steddle.com](mailto:privacy@steddle.com). This version is in force from 20 October 2026. Until Steddle Group B.V. is incorporated, it applies to Steddle Group B.V. in oprichting and whoever acts on its behalf. [ Every document ](https://sendnda.com/legal)Questions: [hello@sendnda.com](mailto:hello@sendnda.com)