Privacy Policy

Last updated: October 27, 2026

1. Introduction

White Sun Private Limited ("White Sun," "we," "us," or "our") operates MV Sign. This Privacy Policy explains what information we collect, how we use it, and the choices you have — whether you're a Company admin, an Authorized User, or a Signer with or without an MV Sign account. By using MV Sign, you agree to this Policy.

2. Information We Collect

From Company admins & Authorized Users

Account details: full name, work email, job title, company name, and an optional mobile number.
Your password — we only ever store a salted hash of it, never the password itself.
The signature you register (drawn, typed, or uploaded), used to sign documents on your behalf.

From Signers

If you have an MV Sign account, the same account details above, plus your registered signature.
If you sign through a one-time secure link without an account (an "external" signer), only the signature you draw or type for that specific document, and — if the document requires it — the mobile number a one-time WhatsApp verification code is sent to.

From the iPhone and Android apps

The same account details and signature as on the web. A signature you draw in the app is saved to your account and works on the web too.
If you allow notifications, a device token that lets us send you a push notification when a document needs your attention. We remove it when you log out.
A sign-in token kept in your phone's secure storage (iOS Keychain or Android encrypted storage). The apps do not use advertising identifiers, location, contacts, or analytics, and do not track you across other apps or websites.

Automatically collected

IP address, browser/device information, and timestamps, recorded against actions like viewing, signing, or declining a document — this forms the document's audit trail.

From Company admins who pay for a plan

MV Sign does not process card payments and we never see your card or online-banking details. Plans are paid by bank transfer made directly at your own bank. When you submit that payment on the Billing page, we collect and store:

The plan and billing period you chose, and the tax invoices we issue you for it (invoice number, your company name and contact email, the amount, GST and total).
The bank transfer reference you enter, and any note you add.
The copy of your transfer receipt that you upload (PDF, JPG or PNG). A receipt can show the sender's name and account details, so upload only what proves the transfer.
Who on your Company submitted it, and when White Sun reviewed it and what was decided.

This billing information is visible to the admins of your Company and to White Sun staff who verify payments. We keep it as a financial record for as long as we need it for accounting and legal purposes.

3. How We Use Information

To provide the service: preparing, sending, signing, and verifying documents.
To verify a signer's identity via a one-time WhatsApp code, where a document requires it.
To send transactional emails — signature requests, reminders, and completion notices.
To maintain the audit trail each completed document relies on for its integrity.
To verify bank-transfer payments and activate, renew, or pause your Company's plan.
To keep the service secure — for example, detecting and rate-limiting abusive login attempts.

We don't use your information for advertising, and we don't sell it.

We share data with the following categories of service providers, only as needed to run MV Sign:

Cloud storage — where uploaded documents and signature images are stored.
Email delivery — to send signature requests, reminders, and notifications.
WhatsApp Business API — to deliver one-time identity verification codes, where used.
Push notification delivery — Apple (APNs) and Google (Firebase Cloud Messaging) deliver notifications to the iPhone and Android apps; they receive the device token and the notification text.
Network and security — Cloudflare sits in front of mvsign.app and handles website traffic (including IP addresses) for security and performance.
Other White Sun products — only if your Company connects MV Sign to WS People, WS Ledger or DPMi360. A Company admin must approve each connection, and only the document data the connection is scoped to is shared. The admin can disconnect at any time.
Google / Microsoft — only if your Company chooses to enable "Sign in with Google" or "Sign in with Microsoft" for its users.
Database hosting — where your Company's account and document records are stored.

We may also disclose information if required by law, such as in response to a valid legal request. We do not sell your data to third parties.

5. Cookies

MV Sign uses a single cookie to keep you signed in — no analytics or advertising cookies. See our Cookie Policy for details.

6. Data Security

All traffic to MV Sign is encrypted in transit (HTTPS/TLS).
Passwords are hashed, never stored in plain text.
Every completed document gets a SHA-256 integrity hash, checked whenever it's verified.
Access to a Company's documents is restricted by role and, where configured, by department.
Login and identity-verification endpoints are rate-limited against automated guessing.

7. Data Retention

Once every required signature has been collected, a document's file and signature images are kept for your Company's configured retention period, then permanently deleted from storage — we'll email a warning 7 days before that happens. For disaster recovery, stored documents are copied to a separate backup bucket every night; a file deleted from live storage remains in that backup for up to 90 days before it is permanently removed. The document's record, its audit trail, and its verification record are kept afterwards, so a verification link never breaks and the history of who signed what stays intact.

8. Your Rights

You can review and update your own profile information (including your registered signature) directly in MV Sign at any time. Self-service account deletion isn't built into the product yet — to request access to, correction of, or deletion of your data, email [email protected] and we'll handle it directly. A Company admin can also remove a user from their Company's account.

9. International Transfers

Depending on how your Company's MV Sign account is deployed, your data may be processed or stored on servers outside your own country. We only work with providers that maintain appropriate security safeguards.

10. Children's Privacy

MV Sign is a business tool and isn't directed at children. We don't knowingly collect information from anyone under 16.

11. Policy Updates

We may update this Privacy Policy from time to time. We'll notify registered users of material changes by email or an in-app notice, and update the "Last updated" date above.

12. Contact Us

Questions about this Policy, or a request about your data? Email [email protected].