Last updated 4 September 2026
Privacy Notice
TapSign is operated by Sawang Tech (“we”). This notice explains what personal data we collect when you use tapsign.sawangtech.com, why, how long we keep it, and the rights you have – including under the EU and UK General Data Protection Regulation (GDPR) and Malaysia’s Personal Data Protection Act 2010.
1. Who is responsible
If you have a TapSign account, Sawang Tech is the controller of your account data. Contact us at admin@sawangtech.com.
If you were asked to sign a document, the person or business that sent it (the “sender”) decides why your data is collected and is the controller. We process your data on the sender’s behalf under our Data Processing Agreement. Requests about a document you signed should go to the sender first; you can also write to us and we will pass the request on and help resolve it.
2. What we collect
| Data | Who it is about | Why | Legal basis (GDPR) |
|---|---|---|---|
| Name, email, password (hashed) | Account holders and team members | To create and secure your account | Contract, Art. 6(1)(b) |
| Documents you upload, the fields you place on them, templates | Account holders; people named in the documents | To provide the signing service | Contract, Art. 6(1)(b) |
| Signer name, email, phone (when the sender asks for it), the values you type and your drawn or typed signature | Signers | To complete the document and produce the signed PDF | Sender’s contract or legitimate interest; Art. 6(1)(b)/(f) |
| IP address, browser user-agent, timestamps of opening, signing and declining | Signers and senders | Audit trail that shows who signed what and when (evidence of the agreement) and abuse prevention | Legitimate interest, Art. 6(1)(f) |
| Plan, invoices, payment reference | Account holders on a paid plan | Billing | Contract and legal obligation, Art. 6(1)(b)/(c) |
| Email address on the landing-page form | Subscribers | To send product news you asked for | Consent, Art. 6(1)(a) – withdraw any time via the unsubscribe link |
We do not use analytics or advertising trackers. We do not sell personal data.
3. How long we keep it
Retention is enforced automatically by a daily job. The defaults are:
| Data | Kept for |
|---|---|
| Completed signed PDFs and their audit trail | As long as the sender keeps them in their account. Senders can delete a document at any time. |
| IP address and user-agent on signers and audit events | 90 days after the event, then removed. The rest of the audit trail (who, what, when) is kept with the document. |
| Raw signature images stored in our database | 30 days after the document is completed, then removed. The signature stays visible in the signed PDF. |
| Declined or expired signing requests | 180 days, then deleted together with the signer data. |
| Uploads that were never sent or saved as a template | 30 days, then deleted. |
| Account data | Until you delete your account (Account → Privacy & data → Delete account). Deleting an owner account removes the whole workspace immediately. |
| Server backups, where enabled | No longer than 30 days. |
4. Who else sees your data (sub-processors)
| Provider | Purpose | Location |
|---|---|---|
| Hostinger International Ltd. | Hosting of the API, database and document storage | Kuala Lumpur, Malaysia |
| Vercel Inc. | Hosting of the web application | United States |
| Resend Inc. | Sending signing invitations, reminders and completion emails (which carry the signed PDF as an attachment) | United States |
| CHIP (CHIP IN Asia Sdn Bhd) and Billplz Sdn Bhd | Card and online-banking payments for paid plans. They receive your name and email only when you pay. | Malaysia |
Each provider is bound by a data-processing agreement. We will update this list before adding a provider.
5. International transfers
Our servers are in Malaysia and some providers are in the United States. Neither has an EU adequacy decision. Where we process personal data of people in the EEA, the UK or Switzerland, transfers rely on the EU Standard Contractual Clauses (Module 2, controller-to-processor) and the UK International Data Transfer Addendum, which are incorporated in our Data Processing Agreement, plus the equivalent clauses in our providers’ terms. You can request a copy of the safeguards by email.
6. How we protect it
- All traffic uses TLS (HTTPS). Passwords are stored as bcrypt hashes.
- Signature images and everything a signer types are encrypted at rest in our database.
- Links to document page images expire after 24 hours and are signed so they cannot be guessed. Signing links use 40-character random tokens.
- Sign-in tokens expire after 30 days and are revoked when you change your password or sign out.
- Every completed PDF is digitally sealed and fingerprinted (SHA-256); any later change is detectable.
- Access to production systems is limited to the people who operate the service.
No system is perfectly secure. If we become aware of a breach that affects you, we will notify you and, where required, the supervisory authority within 72 hours of becoming aware of it.
7. Your rights
You can ask us to access, correct, delete, restrict or export your personal data, object to processing based on legitimate interest, and withdraw consent where consent is the basis. Two of these are self-service:
- Export – Account → Privacy & data → “Download my data” gives you a JSON file with everything in your workspace.
- Delete – Account → Privacy & data → “Delete account” removes your account, and for workspace owners every document, template, signing request and team member, immediately and permanently.
For anything else, email admin@sawangtech.com. We answer within 30 days. If you are in the EEA or UK you can also complain to your local data-protection authority.
Signers: a signed agreement is evidence of a contract between you and the sender. We may keep it, and the audit trail that proves it, while the sender needs it for the contract or a legal claim (GDPR Art. 17(3)(e)). Everything else – IP address, raw signature image, unfinished requests – is removed on the schedule above.
8. Cookies and local storage
We set no analytics or advertising cookies. When you sign in, the app keeps your session token in your browser’s local storage; it is strictly necessary and is removed when you sign out. Our hosting provider may set a technical cookie for load balancing.
9. Children
TapSign is not intended for people under 18. Senders are responsible for not sending documents to minors without the authority to do so.
10. Changes
We will post changes here and update the date at the top. For material changes we will email account holders in advance.