Privacy notice · version 6 · 3 October 2026

No server of ours can read a document.

The file — a PDF, an image or any other kind — is read, fingerprinted and sealed in your browser. What reaches the database is sealed pieces, and what the parties sign is the file’s fingerprint, never the file.

Who is responsible

The data controller is Valnivo Labs, based in Luxembourg, which develops and runs Valnivo Sign. Valnivo Labs is a trade name, not a registered company: if you need the controller named for a formal request or a complaint to a supervisory authority, ask at the address below and it will be given to you.

Write to support@valnivosign.eu for anything about your data; it reaches Valnivo Labs directly. Valnivo Labs has not appointed a data protection officer.

What we hold

RecordWhat it holds, and whyReadable by us

Your accountcontractYour e-mail address, an id, when it was created and last signed in, and — if you set one — your password, which Firebase keeps only as a salted hash: to sign you in, by a link that proves the address or by the password, and to name you on documentsYes

DocumentscontractThe file, its title, the parties’ names and how each signs — sealed in the sender’s browser, for the people it namesNo

Signature imagescontractThe picture each party chose, sealedNo

The recordcontract · legitimate interestThe parties’ addresses and roles, status, who has signed, the times our server recorded, fingerprints, a sign-by date, what it corrects — so the right people can open it and the database can refuse what they may not doClear fields only

Historycontract · legitimate interestEvery step, signed on the device of whoever took it, with their address and the time; no step can be changed once writtenYes

Sealslegitimate interestThe document’s id and fingerprint, every step’s hash and, for a replaced document, its correction’s fingerprint — public, so a saved copy can be checked without an account, also once the document is deleted. No address, name or contentHashes only

BoxescontractEach address’s public box key, so documents can be sealed for it; any signed-in account that knows the address can read itPublic key

Device vaultcontractOnly if you use several devices: your box key, sealed by a key only your recovery code yields, and each passkey’s id and label, with that code sealed by the passkey — so any of your devices can open your documentsNo — ids and labels only

Completion statementscontractOnce everybody signed: the document’s id and fingerprint, each address and when it signed — signed by Valnivo Sign’s key sign-1Yes

E-mail preferencecontractWhether an address wants only the e-mails that need itYes

Access listlegitimate interestWho may send a document, while sending is by invitationYes

Service logslegitimate interestA document’s id, how many steps were handled and the first characters of an account id — never an address — to find faultsYes

Basis: GDPR art. 6(1)(b), the contract, and 6(1)(f), the legitimate interest of the parties in a document reaching them and in a record that can be checked. Nothing is used for advertising or profiling, and nothing is sold. Give only the addresses the people you send to would expect you to use.

What stays on your device

Your keys

Box and signing keys, in your browser’s IndexedDB, where they cannot be exported. With several devices, your box key travels only sealed — by your passkey, kept by your own passkey manager, or your recovery code, which only you hold.

Your sign-in

Kept by Firebase Authentication in IndexedDB, and your address while a sign-in link is on its way.

Invitation secrets

After the # in the link, which a browser never sends to a server — kept here until your own key takes over.

It also remembers which version of this notice and the terms you accepted. No cookies for analytics or advertising, no tracking; fonts and code come from this site. All of it is strictly necessary, so there is no consent banner. Files from Valnivo pass tab to tab, never between servers.

Who processes it

Google · Firebase: Hosting, sign-in by e-mail link, and the database. Receives your address when you ask for a link, and sealed data.
Google Cloud, europe-west1: Runs the notifier and the issuer; Cloud KMS holds sign-1 and receives only a digest; Cloud Logging keeps the services’ logs.
Scaleway · France: Sends the e-mail after each step. No tracking, no link rewriting.
Porkbun · Gmail: Registrar and DNS for valnivosign.eu; forwards mail sent to its addresses, such as support@valnivosign.eu, to the mailbox where it is read.

E-mail

From noreply@valnivosign.eu · A signature was addedtom@studio-ost.de signed your document on Valnivo Sign. 1 signature still to come.

Who acted, never the content: the notifier cannot read the document. Valnivo Sign keeps no copy. You can limit it to the messages that need you to act.

Where it is kept

The records, sealed documents and images, history and seals: Cloud Firestore, europe-west10 (Berlin). A record can be read only by the parties it names; its sealed parts open only with a key wrapped for each party’s device — never ours. Valnivo Labs can see the clear fields through the database’s console, to run the service and answer your requests.

Transfers outside the EU

The documents and records stay in the EU. Firebase Authentication and Gmail are run by Google worldwide, under Google’s data processing terms, which rely on the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses. Porkbun, which forwards mail sent to valnivosign.eu, is in the United States.

How long it is kept

WhatHow long

Documents, signature images, the record, history, completion statements30 days after the document was sent, signed or not; then a daily job deletes them together. Until then no step can be changed or deleted. Download your signed copy before: it carries its own proof

SealsAs long as Valnivo Sign runs, so a copy saved before the document was deleted can still be checked; they hold no address, name or content

Your account, box key, device vault, e-mail preferenceUntil you ask us to delete them

Service logs30 days

E-mailsValnivo Sign keeps no copy; mail you send us, as long as it takes to answer

What your browser keepsUntil you clear it

Your rights

You may ask for a copy of what we hold about you, for it to be corrected or deleted, for its use to be restricted, to receive it in a form you can take elsewhere, and you may object to a use based on legitimate interest. Write to support@valnivosign.eu from the address concerned; you will have an answer within one month.

A signed document is also the other parties’ proof: a request to erase your part of it is weighed against their rights, and you are told what was removed, what was kept and why. You may complain to the Commission nationale pour la protection des données (CNPD) in Luxembourg, or to the authority where you live.

Price and children

Valnivo Sign is free and asks for no payment details. It is not meant for anybody under 16.

Archived versions

A new version is published here with its date, and you are asked to read it before you go on using Valnivo Sign.

Version 6 · 3 October 2026 Any kind of file may be sent, not only a PDF: it is sealed in your browser the same way, and its type is recorded with it, sealed.
Version 5 · 1 October 2026 Valnivo Sign is said to be free, no longer "free for now"; earlier versions are listed under the document.
Version 4 · 1 October 2026 A document, its history, images and completion statement are deleted 30 days after it was sent; only its seal, which holds no address, is kept.
Version 3 · 1 October 2026 Signing in with a password you set: Firebase keeps it only as a salted hash.
Version 2 · 1 October 2026 Several devices: the device vault, what it holds and how long, and where your keys travel sealed.
Version 1 · 1 October 2026 First version.