Privacy Policy

OneSignature is an email signature add-in for Microsoft 365. It automatically applies your organization's approved email signature to every message you send from Outlook. This policy explains what information we process, where it lives, and the choices you and your organization have.

The short version: the signature on your messages is built on your own device from data in your own Microsoft 365 account, and it is stored in your own mailbox. Our servers deliver your organization's template and policy settings and hold the administrative data your organization needs to run the service (described below) — nothing about your personal signature or email content, unless your organization explicitly opts in to the one optional exception described below.

The short version

• We do not store your signature, your profile photo, your job title, your email content, or your contacts on our servers.
• Your signature is generated on your device from Microsoft Graph data and kept in Outlook's roaming settings — which live in your own Microsoft 365 mailbox, not on our infrastructure.
• By default, no personal data about you passes through our servers at all. An optional setting your administrator can enable is described under On-behalf-of profile refresh below.
• What we do hold is administrative: the templates and images your administrators create, policy settings, a log of administrative changes, and billing records. Each is described below and is tied to your organization, not to your personal communications.
• We never sell personal data and we do not use it for advertising.
• Your organization is the data controller for the service; we act as a processor on its instructions.

Information we process

OneSignature processes the following categories of information. We intentionally process as little as possible — the product is designed around that principle.

Account and tenant identifiers

When the add-in runs, it authenticates you against Microsoft 365 using the single sign-on already available in Outlook. To deliver the correct company template, we receive your email address (user principal name) and your organization's Microsoft 365 tenant identifier in the course of that authentication. We use these solely to identify your organization and its policy settings.

Directory metadata for administration

The administrator portal signs in with a Microsoft 365 administrator account. With your organization's one-time administrative consent, the portal reads directory metadata — such as the names and identifiers of groups, and counts of licensed users — to let administrators assign different signatures to different groups and track deployment. We receive only this aggregate directory metadata; we do not receive individual users' profile details through this channel.

Templates and media your administrators create

The service stores what your administrators deliberately create in the portal: signature template HTML (for new messages, replies, and per-group variants, with full revision history) and any images they upload to the media library for use in signatures. These are stored in our managed database and object storage until an administrator deletes them or your organization's account is closed. Template and media data is content your organization provides and controls; it is never combined with individual users' personal data on our servers.

Reset directives (optional administrative feature)

An administrator may enter an email address to reset that user's signature. We store the email address and a reset token so the directive can be delivered to the right person's device. The reset itself deletes data from the user's own mailbox, on the user's own device. Directives are ignored after fourteen days and are automatically deleted shortly thereafter.

Billing and payment data

When your organization subscribes, we record billing configuration (billing frequency and any negotiated pricing) and issue invoices that capture the billing period, the amount, and the licensed-user count at the time of billing. Payments are processed by Stripe. Card details are entered in a Stripe-secured field and go directly to Stripe from your browser — they never pass through or touch our servers. We store only a Stripe customer reference, the card brand, and the last four digits, so we can identify and display the payment method on file.

Audit log of administrative actions

For security and accountability, we keep an append-only log of changes made through the administrator portal: who (an administrator's name and work email, or OneSignature support staff), what was changed, and when. The log covers settings, template revisions, reset directives, media uploads and deletions, and billing changes. It records only metadata about changes — never template content, message content, or user profile data. Log entries are retained for twelve months by default and are then automatically deleted.

Support inquiries

If you contact our support team, your request (name, email, organization, and your message) is stored in our managed database as a support ticket so it can be worked by our team. Replies and status changes are recorded on the ticket, and customer-facing emails are sent through Postmark, a transactional email provider. Tickets are kept for as long as needed to resolve and follow up on your request, and are deleted on request.

Information we do not collect

• Your email messages and their contents
• Your personal signature, its HTML, or your profile photo
• Your contacts, calendar, or mailbox contents
• Your profile data — name, title, phone number, or photo (unless your organization has enabled the on-behalf-of feature below)
• Your card number, expiration date, or security code (those go only to Stripe)
• Browsing data from third-party sites, or advertising identifiers

In short, we do not read, copy, or retain your personal communications, and we never see the signatures that are generated on your device. The only signature-related content we hold is what your administrators deliberately create in the portal (templates and media), as described above.

Where your signature lives

The add-in builds your signature on your device from data Microsoft already has about you (your name, title, phone number, photo), then stores the finished signature in Outlook's roaming settings. Roaming settings are stored by Microsoft within your organization's Microsoft 365 tenant — the same place your email lives. This is why your signature follows you across Outlook on Windows, Mac, the web, and mobile, and why your organization can clear it at any time.

Your organization can update the company template at any time. When it does, the add-in regenerates signatures for users who have not customized theirs — again, on-device and within the mailbox.

On-behalf-of profile refresh (optional)

OneSignature offers an optional feature that your organization's administrator can enable: on-behalf-of (OBO) profile refresh. When enabled, our servers may, on your behalf and with Microsoft's authorization, refresh your profile data (such as a changed job title) at most daily so your signature stays current even if you never open the add-in again. Refreshed data is written back to your mailbox's roaming settings and is not retained on our servers beyond what is needed for the refresh itself.

This feature is off by default. Your organization must explicitly enable it, and your organization can turn it off at any time. If it is off, your profile data never passes through our servers — it is fetched directly on your device when you first open the add-in.

Our servers, hosting, and subprocessors

Our application is hosted on Vercel (United States). We use a managed MongoDB database and Backblaze B2 object storage (via its S3-compatible API) for the administrative and billing data described above. Payments are processed by Stripe. Support-ticket emails are sent through Postmark. Each of these providers receives only the minimum data needed for its role, and each is bound by its own data-processing obligations.

The customer data stored on our hosting infrastructure is limited to: tenant and policy configuration, administrator-created templates and media, reset directives, the administrative audit log, billing records, and operational data such as error logs. We do not store your signature or profile data there.

Microsoft 365 and Graph

OneSignature is an add-in for Microsoft 365 and relies on Microsoft's services (Azure Active Directory / Microsoft Entra ID, Microsoft Graph, and Outlook) for authentication, data, and storage. Microsoft's processing of that data is governed by the Microsoft Products and Services Data Protection Addendum and the Microsoft Privacy Statement. Where we process personal data at your organization's direction, we enter into appropriate data-processing terms with your organization.

Retention

• Reset directives: ignored after fourteen days and automatically deleted shortly thereafter.
• Audit log: retained for twelve months by default, then automatically deleted. Entries can also be anonymized under a verified erasure request.
• Templates and media: kept until an administrator deletes them or the account is closed.
• Invoices and billing records: kept as long as required by applicable tax and accounting law.
• Support tickets: kept as long as needed to resolve and follow up on your request, and deleted on request (see Your rights and choices).
• Operational logs: retained on a rolling basis for security and reliability purposes, and anonymized where reasonably possible.
• Your signature and profile data: stored by Microsoft in your mailbox's roaming settings and removed whenever your organization clears it or removes the add-in.

Security

We follow industry-standard security practices: encrypted connections everywhere, least-privilege access to the limited data we hold, and no access to your mailbox beyond the roaming-settings keys the add-in itself needs. Payment details are handled entirely by Stripe under its PCI-compliant infrastructure — they never enter our systems. Our code base is deliberately small and privacy-focused, which keeps the attack surface small too.

Your rights and choices

Depending on where you live, you may have rights under laws such as the GDPR (Europe), the UK GDPR, or the California Consumer Privacy Act (CCPA/CPRA) — including rights to access, correct, export, or delete personal data we hold about you. Because we hold so little, exercising these rights is straightforward:

• To see or delete your signature data, contact your organization's administrator — it lives in your mailbox, and they (or you, in the add-in) can remove it.
• To exercise rights over the small amount of data we hold (administrative and billing records), contact us through our support page and we will respond within the time required by law.
• Your organization controls the service-level settings (templates, the optional on-behalf-of feature, resets). Questions about how your organization uses OneSignature should first go to your administrator.

We do not sell personal data, and we have no plans that would ever change that.

Children

OneSignature is a business product intended for organizations and is not directed at children. We do not knowingly process personal data of children.

Changes to this policy

We may update this policy as the service evolves. If we make material changes, we will revise the “Last updated” date above and, where practical, notify administrators. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

Contact

Questions about this policy or your data? Contact us through our support page and we will respond within the time required by law.