Privacy policy

Who is responsible

The data controller is Color Vivo Internet, S. L., the company that develops and publishes PDFsigna. You can reach us at support@pdfsigna.com. Tax ID (NIF): B13340724. Address: Calle Sierra del Segura, 26, 13640 Herencia (Ciudad Real), Spain. More in the legal notice.

The website

What we don’t do

• We set no cookies at all. The detail is in the cookie policy.
• We use no analytics of any kind, first-party or third-party.
• There are no tracking pixels, no social buttons, no embedded video.
• We load no external fonts: a font served from another domain is a request to a third party with your IP address inside it.
• The only form is the support form, and it is described just below.

The support form

If you write to us through the support form, or by email to support@pdfsigna.com, this is what happens with it:

• What we collect: the email address you give us to reply to, the topic you choose, your message and, only if you fill them in, the app version and your operating system. Nothing else: no IP address is stored with the message and no cookie is set.
• What for: to answer your question, and for nothing else. We don’t add you to any list and we don’t send you anything you didn’t ask about.
• On what legal basis: your consent, which you give by ticking the privacy box before sending (Article 6(1)(a) GDPR) and, to the extent needed to deal with the question you asked, our legitimate interest in answering it (Article 6(1)(f)). You can withdraw your consent at any time by writing to the address above.
• For how long: while we deal with your question and, after that, for at most 12 months from our last reply, in case you come back about the same thing. Then it is deleted.
• Who else sees it: the message is delivered by email through Cloudflare (its email routing service), which acts as our processor under its data processing agreement. It is not shared with anyone else.
• International transfers: Cloudflare, Inc. is based in the United States. Its data processing agreement covers transfers out of the European Economic Area through the EU–US Data Privacy Framework, in which Cloudflare participates, and through the European Commission’s standard contractual clauses if that certification ever lapses.

To protect the form against spam without JavaScript or third parties, the server checks a time stamp it writes into the page, a field hidden from people, and how many messages arrive from the same connection in a short time. That count is kept in memory for a few minutes and is not stored.

The only thing that gets logged

The site is served from Cloudflare’s network. Like any web server, their infrastructure logs the requests it serves — IP address, time, page requested, user agent — in order to serve them, protect them from abuse and detect faults. Those logs belong to the provider, they are operational, and we do not cross-reference them with anything or use them to profile anyone. It is mentioned here because it exists, not because we make use of it.

The applications

What stays on your machine

All the work on the document. Reading, annotation, the signature and stamp library, placement and signing all happen locally. Your private key is never exported: the signature is produced by your operating system’s key store and the app only receives the result — which is also what reinforces the “sole control” requirement of Article 26(c) of the eIDAS Regulation.

What does go out to the network, and why

A signing application cannot be entirely offline and still do its job. These are the connections it makes, all of them to third parties that are not us:

• Timestamping. When you sign with a timestamp, the app requests one from a timestamping authority. What travels is the cryptographic digest of the signature — not the document.
• Revocation checking. To find out whether a certificate was still valid, the app queries OCSP or downloads revocation lists (CRLs) from the certificate’s issuer. The certificate identifier travels; the document does not.
• Trusted lists, on Windows only. To classify the legal level, the Windows app downloads the European trusted list (LOTL) from the European Commission and, through it, the Spanish trusted list from the body that publishes it. It does this at start-up, keeps the lists on your machine and does not request them again until they are more than a day old. They are public information: nothing of yours and nothing from the document travels in those requests. The Mac app does not make this connection yet; this page will be updated on the day it does.

In all three cases the request goes to the relevant provider under its own policy. None of those connections passes through any server of ours, because we have none in the signing path.

What there isn’t

• Accounts, sign-up and passwords: they don’t exist.
• Telemetry, usage statistics and automatic crash reports: not sent.
• Advertising and profiling: none.
• Selling or sharing data with third parties: does not happen, and will not.

Your rights

The GDPR (Regulation (EU) 2016/679) gives you the right to access your personal data, rectify it, erase it, restrict or object to its processing, and to data portability, as well as to complain to a supervisory authority.

There is very little here to exercise them over, and that is deliberate: apart from what you send us through the support form, we do not process your personal data through this site or the applications, because we do not collect any. To exercise any of these rights, write to support@pdfsigna.com; in Spain the supervisory authority is the Agencia Española de Protección de Datos (aepd.es). If that changes — for instance the day the product is sold from this website and there is billing — this page changes first, not afterwards, and it will say what is collected, what for, and for how long.

Children

The product is not directed at children, and the support form is not meant for them. If we learn that a message came from a child, we delete it.

Changes to this policy

If it changes, the date at the top changes and we say what changed. One text is not quietly swapped for another.

12 October 2026 — the support form. The website now has a support form, and this page says what it collects, why, on what basis, for how long and who delivers it (“The support form”, above). Until this date it said the website had no forms and collected nothing; that stopped being true with the form, so it was changed in the same release. The contact address, support@pdfsigna.com, is published.

12 October 2026. The trusted-list connection is now stated precisely: the Windows app makes it — the Commission’s European list and the Spanish list, at start-up and at most once a day — and the Mac app does not yet. This page used to attribute it to “the app” without distinguishing.