1.Introduction
Welcome to Pagestro ("we," "our," or "us"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, process, and disclose your information when you access or use our website (pagestro.com) and our tools for PDFs, images, contracts and e-signatures, invoices, QR codes, short links and email design.
This policy tells you what we collect, why, who helps us handle it, how long we keep it and what your rights are. If you have questions, write to us (see “Contact us”). We are the controller of your account data: Sigma Studio (Dhaka, Bangladesh), the operator named in our Terms. For documents you send, sign or invoice, see “People who sign or receive documents”.
2.Data processing & privacy-first architecture
Processed in your browser: Our PDF, image and conversion tools, including OCR (text recognition), run inside your browser. The files you open in them are not uploaded to our servers.
Stored only when you choose to: When you save something to your account, we store it so you can use it again: contracts, invoices, email designs, QR codes and short links, signature requests (the document, signatures and audit trail), and images you upload (such as your logo or profile photo).
- Everything is encrypted in transit (HTTPS). Files are kept in our database and in cloud file storage.
- You can delete any saved item, download a copy of your data, or delete your account in Settings. Deleting your account removes your saved documents, except signature requests and their audit trail (see “Retention” and the next paragraph).
- For e-signatures we keep a tamper-evident audit trail (signer name, email, time, IP address and device), because it is the record of who signed and when. Because it is evidence for everyone involved, we keep it while the sender’s account is open. If the sender deletes their account, we keep it until 7 years after the request ended (completed, declined, cancelled or expired) and then delete it. See “People who sign or receive documents”.
- We do not sell your documents, read them for advertising, or use them to train AI models. Pagestro does not use AI on your documents. OCR text recognition runs in your browser.
3.Information we collect
We collect information that you directly provide to us and information automatically collected when using our site:
- Account Data: If you register an account, we collect your email address, name, and profile credentials. An account is optional for most tools.
- Payment Data: We use Paddle as our Merchant of Record to process subscriptions. We never store or collect your complete credit card credentials or bank details. Our payment processors collect payment details, email, and billing address to comply with tax and anti-fraud regulations.
- Sign-in and Security Data: When you sign in we record the device and browser, the IP address and the approximate location it maps to (city and country). We use it to recognise your approved devices, show you where you are signed in, warn you about sign-ins from new places, limit how many devices can use one account at the same time, and stop fraud. You can see your devices, locations and security activity in Settings → Security. IP addresses are visible only to our staff. Location is estimated from the IP address and is never exact; we use IP Geolocation by DB-IP.
- Usage Data (only with your consent): If you accept analytics cookies, we record the pages you visit, the site or campaign that sent you, your device type, browser and approximate country and city. We do not store IP addresses for this. If you accept marketing cookies, we also remember the campaign or website that first brought you to Pagestro and credit it when you create an account. We use this to improve the product and to understand which marketing works; we do not sell it. The help search on our site runs in your browser; when it can't answer a question and you have accepted analytics cookies, we keep that question, with email addresses and numbers removed and nothing that links it to you, to write better answers. We also count how often each tool is used, as anonymous daily totals by tool, campaign and country. This uses no cookies, stores nothing on your device and keeps no IP address, and we keep the totals for 25 months. If you choose “Reject all” in the cookie banner, your visits are not counted.
4.Payment gateways & compliance
Your privacy and financial security are protected under strict cardholder compliance rules. When you purchase our subscriptions, transaction processing is handled by our Merchant of Record (MoR), Paddle.
These billing processors comply with the Payment Card Industry Data Security Standard (PCI-DSS) and leverage encrypted tokens to process payments. We receive only transaction metadata (such as license key, invoice ID, status, and subscription tier) for service activation.
6.Emails we send
- Account and service emails: confirmation and sign-in links, security alerts, receipts, and messages about documents you send or sign. They are part of the service, so they arrive whether or not you subscribe to anything.
- Product updates and offers (only with your consent): we send these only if you opt in: by ticking the box when you create an account (it starts unticked), by answering yes after signing up with Google, by joining our newsletter, or by switching on “Product updates and offers” in Settings → Profile. We record when and where you gave or withdrew consent.
- Getting started: after you create an account we may send a few emails on using Pagestro. They stop if you unsubscribe or turn product updates off.
- Newsletter statistics: newsletters count link clicks. Opens are counted only for some issues, with a small image; most don’t.
- Some newsletters are also published on pagestro.com/newsletter, without any personal details.
- Every marketing email has an unsubscribe link. You can also turn product updates off at any time in Settings → Profile.
- People you send documents or invoices to: they are never added to a mailing list and never get marketing emails from us. The emails and pages you send through Pagestro show a small “Sent with Pagestro” line with a link to our site.
8.Assistants you connect
You can choose to connect an assistant app, for example Claude by Anthropic or ChatGPT by OpenAI, to your Pagestro account. It is your choice: nothing is shared until you approve the connection on our sign-in screen.
- Once connected, the assistant can read the account data its permission allows:
- your account email address, plan, this month's usage and your plan limits;
- the names of your saved contracts, invoices and email designs, and the text of a saved contract with its signer roles;
- for a saved invoice: the invoice number, issue and due dates, currency, the client's name and email address, line items, totals and notes, and the last 4 digits of the bank account, routing or sort code, and IBAN on it (never the full numbers, your logo, signature image or tax IDs);
- for invoices you have sent: the client's name and email address, amount, currency, due date, status, when it was viewed and paid, and the private link to the invoice;
- your signature requests: title, status, dates, each signer's role, name, email address, status, when they viewed, signed or declined and any decline reason, and the audit trail of events (without IP addresses or devices);
- your email designs: name, subject, preview text and the email's content;
- your QR codes and short links: name, type, short link, destination, status and scan statistics (totals, unique visitors, recent days, and counts by device type, operating system, browser and country).
- What the assistant reads is sent to the company that runs it and is handled under that company's terms and privacy policy. Pagestro doesn't control it.
- Pagestro itself uses no AI, and we don't send your data to AI companies unless you connect one.
- We keep the list of connected assistants (the app's name, when it was connected and last used), access tokens stored only as a one-way hash, and a record of the changes and emails made through connected assistants. Your most recent security events, including these, appear in Settings → Security.
- You can disconnect an assistant at any time in Account → API & MCP. Changing your password disconnects all of them.
9.Why we use your data
We need a lawful reason (a “legal basis”) to use personal data. Ours are:
- Contract: to run your account, save your documents, take payment through Paddle and send the emails the service needs.
- Legitimate interests: to keep Pagestro secure, prevent fraud and abuse, keep the signature audit trail, fix problems and improve the service, where this is not outweighed by your rights.
- Consent: for marketing emails, and for analytics and marketing cookies. You can withdraw consent at any time.
- Legal obligation: for example tax and accounting records, and answering lawful requests from authorities.
10.How long we keep data (retention)
- Account data and saved documents: until you delete them or your account.
- Signature requests and their audit trail: while the sender’s account is open. After the sender closes their account, until 7 years after the request ended (completed, declined, cancelled or expired), then deleted (see “People who sign or receive documents”).
- Copies of emails we send: up to 30 days, so we can retry delivery and investigate problems.
- Sign-in and security records (devices, IP address, approximate location): 12 months.
- Connected assistants: a connected assistant stays on your list until you disconnect it or it goes unused for 90 days; a disconnected one is deleted within 30 days. The record of changes and emails made through an assistant or API key is a security event and is kept for 12 months.
- Analytics page views: 13 months.
- Unanswered help questions: 90 days.
- Anonymous tool-use totals: 25 months.
- QR code and short-link scan statistics: until the owner deletes the code or their account.
- Records of your marketing consent: while your account exists and for up to 3 years after, as proof of consent.
- Backups: we keep backup copies for a limited time and then delete them, so deleted data can remain in a backup until that copy is deleted.
- Payment and tax records: as long as the law requires. Paddle keeps its own records as the Merchant of Record.
11.International transfers
Pagestro is run from Bangladesh, and our service providers work in several countries (for example the United States). When personal data of people in the EEA, UK or Switzerland is sent to a country without an adequacy decision, we rely on standard contractual clauses or an equivalent safeguard with the provider where the law requires it. Ask us if you want details.
12.People who sign or receive documents
If someone sent you a document to sign, an invoice or a payment link through Pagestro, that person (the sender) chose to send it to you and is responsible for what it says. Pagestro handles your details for the sender, and also keeps a record of the signing for everyone involved.
- What we record: your name, email address, IP address, device and browser, the time of each step (opened, viewed, signed), your signature image, and the values you fill in. If you request changes to a document, your suggestions and comments, and the sender’s decisions on them, are kept with the signing record as evidence, together with the time, IP address and device. Everyone signing the same document can see them.
- Why: as evidence of who signed what and when, for the sender and for you. Our legal bases are legitimate interests and the establishment or defence of legal claims.
- How long: while the sender’s Pagestro account is open. If the sender deletes their account, until 7 years after the request ended (it was completed, declined, cancelled or expired). After that the audit trail is deleted.
- Who sees it: the sender and their team, you (through your signing link) and our staff when needed to run the service. Our service providers handle it for us (see “Sharing & disclosure of data”). You are never added to a mailing list and never get marketing emails from us. The emails and pages you receive show a small “Sent with Pagestro” line with a link to our site.
- Your rights and who to contact: you can ask the sender first. You can also write to gdpr@pagestro.com to ask for access or correction, or to object. Because the record is evidence of a signed agreement, we may have to keep it for the period above.
People who scan a QR code or open a short link: if you scan a Pagestro QR code or open a Pagestro short link, we record the time, device type, operating system, browser, country and a visitor code that changes daily (no IP address is stored). The person who made the code sees these statistics and can download them. Our legal basis is legitimate interests (giving the code owner simple statistics).
Businesses that send documents are controllers of their signers’ and recipients’ data and we are their processor; see the Data Processing Addendum.
13.Your rights and how to use them
Wherever you live, you can ask us to access, correct, delete or export your data, to restrict or stop how we use it, and to stop marketing. If you are in the European Economic Area (EEA), the UK or Switzerland, the General Data Protection Regulation (GDPR) and similar laws give you these rights by law. Many of them you can use yourself in Settings. Otherwise email gdpr@pagestro.com. We reply within one month. If your request is complex we may need up to two more months, and we will tell you why.
You also have the right to complain to a supervisory authority (a data protection regulator), for example in the country where you live or work. We would appreciate the chance to fix the problem first. Read our GDPR statement for more, and our Data Processing Addendum if you use Pagestro for your business.
14.Changes to this policy
We may revise this Privacy Policy periodically. We will update the "Last updated" date at the top of this page, and tell you by email or in Pagestro if a change is important.
15.Contact us
If you have any questions or feedback regarding this privacy policy or our document processing architecture, please get in touch:
Pagestro, a service of Sigma Studio (Dhaka, Bangladesh).
Email: support@pagestro.com
Address: Sigma Studio, Dhaka, Bangladesh
