Privacy should be understandable.Privacy should be understandable.

Maple eSign is operated by [LEGAL ENTITY NAME], located at [BUSINESS ADDRESS] ("Maple", "we", "us", or "our"). This policy explains how we handle personal information when you visit mapleesign.ca, use a Maple account or integration, receive a signing invitation, complete a document, or contact us.

Our privacy contact is [PRIVACY OFFICER TITLE], reachable at [PRIVACY EMAIL] or the address above.

For account administration, website operation, security, and our own support activities, Maple determines the purposes for handling personal information. When an organization uses Maple to send and manage agreements, that organization generally determines the document's purpose, recipients, and required information, and Maple processes that information on its behalf. Legal responsibilities depend on the activity and applicable law.

If you receive an agreement, the sender's privacy practices also apply. Ask the sender about its document requirements, use of your information, and retained copies. You may contact Maple about our own handling of your information or for help directing a request.

We use personal information for the purposes described above, to comply with legal obligations, and to investigate misuse or protect the rights and security of users and the Service. We limit collection and use to what is appropriate for those purposes.

Where consent is required, we seek consent appropriate to the information and its sensitivity. The sender is responsible for the notices and permissions needed to supply recipient information and request signatures. Signing consent is recorded in the signing process. Accepting terms or visiting a website does not by itself authorize every possible use of personal information.

You may decline to provide optional information or contact us to withdraw consent, subject to legal or contractual restrictions. If you withhold information required to authenticate access, deliver an invitation, or complete a document, that feature may not work. Withdrawing consent does not automatically invalidate a completed agreement or erase records that must lawfully be retained.

Any optional promotional communications must have the permissions required by applicable law and an unsubscribe method. Operational invitations, verification messages, and service notices are distinct from marketing. Contact the sender if you no longer wish to participate in a particular signing workflow.

We disclose information only for the purposes described in this policy, with appropriate consent or another lawful basis:

1. Senders, authorized organization administrators, signers, approvers, and copied recipients receive information appropriate to their role and the configured workflow. A completed agreement or certificate may contain personal information visible to other authorized participants. Ask the sender who will receive it before signing. 2. Service providers process information needed for hosting, storage, security, communications, support, and other service functions. Providers acting on our behalf must be subject to appropriate confidentiality, security, and purpose restrictions. 3. Integrations selected by an organization receive the information that organization authorizes, including configured webhook events and retrieved documents. The organization is responsible for its downstream use and connected services. 4. Authorities or other recipients may receive information where disclosure is required or permitted by law, including a valid legal process or a necessary response to fraud or a security threat. 5. Information may be involved in a proposed or completed business transfer where permitted by law, with safeguards limiting its use and any required notice or consent.

[CONFIRM AND INSERT THE POLICY ON SALE OF PERSONAL INFORMATION, ADVERTISING USE, AND USE OF DOCUMENT CONTENT FOR AI TRAINING.]

The website uses browser preferences for features such as theme selection and includes a Cloudflare analytics script. The application may require cookies or similar browser storage for authentication and session security. [CONFIRM THE ACTUAL COOKIE AND STORAGE INVENTORY, PURPOSES, LIFETIMES, AND AVAILABLE CONTROLS.]

You can manage cookies and stored website data through your browser. Blocking required storage may affect sign-in or signing. Any non-essential tracking that requires consent must remain optional and be controlled through [CONSENT SETTINGS OR OTHER ACTUAL CONTROL]. This draft does not claim that the site is cookie-free or free of analytics.

We retain personal information only as long as reasonably necessary for its identified purposes, legal obligations, and legitimate dispute or security needs. Retention must take account of the sender's instructions and agreement, subject to applicable law. Audit integrity alone is not a blanket reason to retain all personal information indefinitely.

[INSERT THE APPROVED RETENTION PERIODS OR CLEAR CRITERIA FOR DRAFTS, ATTACHMENTS, COMPLETED DOCUMENTS, AUDIT RECORDS, ACCOUNTS, SUPPORT RECORDS, SECURITY LOGS, AND BACKUPS, INCLUDING WHEN EACH PERIOD STARTS AND HOW DELETION IS CARRIED OUT.]

There is currently no self-service deletion or account-closure feature. Requests must be directed to [STAFFED PRIVACY REQUEST CONTACT]. Account closure does not automatically delete completed agreements, records subject to a legal hold, or copies already held by other participants.

Where deletion is required and permitted, information will be deleted or irreversibly anonymized through [CONFIRMED DELETION PROCESS AND BACKUP EXPIRY RULE]. If a legal obligation or justified hold prevents deletion, we will explain the applicable restriction where permitted and limit further use to the retained purpose.

We use technical and organizational measures appropriate to the sensitivity of the information. Published product controls include encrypted browser and API traffic, team-scoped access, optional recipient SMS verification, and tamper-evident signing records. Authorized access must be limited to the people and providers who need it for their duties.

No system guarantees complete security. Signing evidence and document hashes do not replace access controls or establish that a document is legally enforceable. If a security incident affects personal information, we will assess it and notify affected individuals, organizations, and regulators where required by applicable law.

Depending on applicable law, you may request access to your personal information, correction of inaccuracies, information about its use or disclosure, withdrawal of consent, or deletion where available. Additional rights may apply in your jurisdiction. These rights are subject to legal exceptions and do not necessarily require alteration of a historical signed agreement. Corrections may need to preserve the original record and document the correction separately.

Contact [PRIVACY EMAIL] with a description of your request and enough information to locate the relevant account or workflow. Do not include a complete document or active signing link. We may request proportionate identity verification through a secure method. We will respond within applicable legal time limits and explain any permitted extension, refusal, or applicable fee.

For information managed on a sender's behalf, we may coordinate with or direct you to that organization, while addressing our own legal responsibilities. You may raise a complaint with our privacy contact or the relevant privacy regulator, including the Office of the Privacy Commissioner of Canada (www.priv.gc.ca/en/report-a-concern/) where it has jurisdiction.

Maple account registration is intended for adults with legal capacity to use the Service. A sender must establish the appropriate authority and permissions before involving a minor's information or requesting action by a guardian. Contact our privacy officer if you believe information about a child has been provided without the required authority or consent.

We will publish revisions with an updated effective date and version. For material changes, we will provide notice through an appropriate channel and obtain fresh consent where required before using previously collected information for a new purpose.

Privacy contact: [PRIVACY OFFICER TITLE], [LEGAL ENTITY NAME], [BUSINESS ADDRESS], [PRIVACY EMAIL].