Last updated: September 2026
At Subnoto SAS ("Subnoto", "we", "us", "our"), we take your privacy seriously. This Privacy Policy explains how we collect, use, and protect your personal data when you use our e-signature platform (the "Service").
Subnoto is operated by Subnoto SAS, based in France. We are subject to the General Data Protection Regulation (GDPR).
You can reach us at Contact
We collect:
Account information: Name, email address, organization, and credentials when you create or use your account.
Usage data: Logs, IP address, browser/device info, and interaction data.
Document Metadata: Operational envelope data such as sender and recipient contact details used for notifications, timestamps and signature status. Document contents and certain other metadata remain encrypted inside secure enclaves.
Support Data: Messages sent to our support or feedback channels.
For beta users, we may collect additional feedback and usage data to help us improve the product.
Document contents and certain envelope metadata are processed inside secure enclaves and remain encrypted at all times. They are not visible in plaintext to Subnoto, its hosting provider or third parties, including for support. Operational metadata needed to run the Service (for example recipient email addresses used to send notifications) may be processed outside the enclave.
We process your data based on:
Contractual necessity: To provide you access to the Service
Legitimate interest: To improve the experience
Consent: For optional email updates (you can unsubscribe)
We use your data to:
Deliver and improve the Service
Respond to support inquiries
Comply with legal obligations
Analyze anonymized usage patterns
We never sell your personal data or document contents.
We use third-party services to operate Subnoto:
Scaleway: hosting, EU-based
Cloudflare: security and performance
Brevo: email delivery
SMS Partner: SMS delivery
Grafana Cloud: observability; logs sent to Grafana Cloud do not contain customer data
We will update this list as new subprocessors are added. All subprocessors are GDPR-compliant or covered by appropriate data processing agreements.
User data is stored in France.
We use TLS encryption, secure infrastructure, and strict access controls.
Your data is retained for as long as your account is active or legally required.
You may request deletion at any time by contacting Contact
Under GDPR, you have the right to:
Access your data
Correct inaccurate data
Request data deletion
Object to processing in certain cases
Contact us at Contact
We use encryption in transit and at rest, and secure enclaves for document contents and certain metadata. Those data remain encrypted and are not visible in plaintext to Subnoto, its hosting provider or third parties. While no system is 100% secure, we take reasonable technical and organizational measures to protect your data.
Subnoto uses minimal cookies necessary for authentication and performance. We do not use tracking or advertising cookies.
We may update this Privacy Policy over time. If significant changes occur, we will notify you via email or through the platform.
Subnoto SAS, France
ContactFor GDPR-related requests (access, correction, deletion...), please use the following request form:
GDPR Request Form
Privacy-friendly e-signatures made in France 🇫🇷
© 2026 Subnoto. All rights reserved.
