Privacy Policy
Last updated 5 November 2026
360 SaaS Pty Ltd (ABN 79 681 731 840) ("we", "us") provides eSign 360. This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
1. Two roles
Customers. For the people and organisations that open an eSign 360 account or use the API, we decide how their information is used, and this policy describes it.
Signers. When a customer sends a document, we handle the signer's details and the document only to provide the signing service for that customer. The customer decides what is sent and why. If you are a signer and have a question about a document, contact the person who sent it. You can also contact us.
2. What we collect
| Who | Information |
|---|---|
| Customers | Name, work email, organisation, country, login details (passwords are stored only as one-way hashes), two-factor settings, plan and billing details, API credential records, usage records and support messages. Card details are collected and held by our payment provider, not by us. |
| Signers | Name, email address, mobile number where an SMS PIN is used, the signature and field values entered, consent records, and technical information such as IP address, device and browser details, and the time of each action, kept in the audit trail. |
| Documents | The files customers upload and the signed copies. They may contain any personal information the customer chooses to include. |
| Website visitors | Basic technical data in server logs. The marketing site uses no advertising or analytics cookies. Fonts load from Google Fonts, which receives your IP address when you view a page. |
3. Why we use it
- To provide, secure and support the Service, including sending signing invitations, reminders and PINs.
- To keep an audit trail that helps show who signed what and when.
- To bill customers and meet tax and accounting obligations.
- To prevent fraud and abuse, and to meet legal obligations.
- To tell customers about changes to the Service. We do not sell personal information and we do not use document content for advertising or to train AI models.
4. Who we share it with
We use these providers to run the Service. They process information only to provide their services to us.
| Provider | Purpose | Location |
|---|---|---|
| DigitalOcean | Hosting, database and file storage | Sydney, Australia |
| Microsoft Azure | Encryption key management and the website | Australia East (keys); the website is served from Microsoft’s global network |
| Twilio | Sending SMS PINs | United States and its global network |
| SendGrid (Twilio) | Sending email | United States |
| Stripe | Card payments | Global, including the United States |
| Cloudflare | DNS and network protection | Global |
This means some personal information, such as a signer's email address or mobile number, is disclosed to providers overseas when needed to deliver an email or text. We take reasonable steps to make sure those providers handle it consistently with the Australian Privacy Principles. We also disclose information to a customer's authorised users, where the law requires, and to our professional advisers.
5. How long we keep it
Documents and signed files are deleted 90 days after a transaction finishes. After that we keep a summary record: identifiers, status, timestamps, signer names and email addresses, outcomes, document fingerprints and billing records. We keep billing records for at least seven years as tax law requires. Customer account information is kept while the account is open and for a reasonable time afterwards.
6. Security
Information is encrypted in transit and at rest. Each transaction has its own encryption key, which is destroyed when the files are deleted. Access to production systems is restricted and logged. If we have a data breach likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
7. Your rights
You can ask to access or correct the personal information we hold about you. If you are a signer, we may refer your request to the customer who sent you the document. We will respond within a reasonable time, normally 30 days. To make a request, or to ask a question or make a complaint, contact us below. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
8. Changes
We may update this policy and will post the new version here with the date it was last updated.
9. Contact
Privacy contact, 360 SaaS Pty Ltd, 368 Sussex St, Sydney NSW 2000. Email: support@portal360.ai.