Privacy Policy

Skyfalke Sign is an electronic signature platform operated by Skyfalke Limited, a company registered in Kenya with its principal place of business in Nairobi, Kenya (“Skyfalke”, “we”, “us”). For the purposes of the Kenya Data Protection Act 2019 and, where applicable, the EU General Data Protection Regulation (GDPR), Skyfalke Limited is the data controller for account data and a data processor for the documents our customers upload and send for signature.

Questions about this policy or your data can be sent to privacy@skyfalke.com.

We collect the following categories of personal data:

• Account data — name, email address, phone number, password (stored only as a salted hash), organization name, and billing details you provide when you register or manage your account.
• Documents and signature data — documents uploaded for signing, the signatures, initials, and form-field values applied to them, and the identities of the people you invite to sign.
• Signing evidence — to make signatures legally verifiable we record the signer’s IP address, device and browser information, timestamps, and cryptographic hashes of each signing event. This audit trail forms part of the signed document’s certificate of completion.
• Payment data — when you pay by M-Pesa we receive your phone number and the transaction receipt from Safaricom; when you pay by PayPal or card we receive a transaction reference from the payment provider. We never see or store full card numbers.
• Usage data — log data about how you use the service (pages visited, actions taken, errors) used to operate, secure, and improve the platform.

We process personal data on the following legal bases:

• Performance of a contract — providing the signing service you or your organization signed up for, including sending signing invitations, recording signatures, and issuing completed documents.
• Legal obligation — retaining signing evidence and audit trails so that signatures remain verifiable and legally enforceable under KICA and equivalent laws, and retaining invoices for tax purposes.
• Legitimate interest — securing the platform, preventing fraud and abuse, and improving the service.
• Consent — optional communications such as product updates, and non-essential cookies (see our Cookie Policy). You can withdraw consent at any time.

• Signed documents and audit trails are retained for as long as the owning account keeps them, because deleting signing evidence would undermine the legal validity of completed agreements. Document owners can delete their documents at any time.
• Account data is retained while your account is active and deleted or anonymised within 90 days of account closure, except where law requires longer retention.
• Invoices and payment records are retained for the period required by Kenyan tax law.

We do not sell personal data. We share it only with service providers who process it on our behalf under contract:

• Cloud hosting and storage providers, used to run the platform and store encrypted documents.
• Safaricom (M-Pesa) and PayPal, to process payments you initiate.
• Email delivery providers, to send signing invitations and account notifications.
• Professional advisers, regulators, or law enforcement where disclosure is required by law.

Where data is transferred outside Kenya or the European Economic Area, we ensure an adequate level of protection through contractual safeguards consistent with the Kenya Data Protection Act 2019 and, where applicable, GDPR standard contractual clauses.

• Documents are encrypted at rest (AES-256) and in transit (TLS 1.2+).
• Signed documents are sealed with SHA-256 hashes so any tampering is detectable.
• Access to production systems is restricted, logged, and protected by authentication.
• Passwords are stored only as salted hashes and are never visible to staff.

Under the Kenya Data Protection Act 2019 (and the GDPR where it applies), you have the right to:

• Be informed about how your data is used (this policy).
• Access a copy of the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data, subject to the retention duties described in section 4.
• Object to or restrict certain processing, and withdraw consent where processing is based on consent.
• Data portability — receive your data in a structured, machine-readable format.

To exercise any of these rights, email privacy@skyfalke.com. We respond within the timelines set by law. If you are unsatisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner of Kenya (ODPC) or your local supervisory authority.

If someone sends you a document to sign, we process your name, email address, signature, and signing evidence on behalf of the sender in order to complete the transaction they initiated. The sender is responsible for having a lawful basis to share your details with us. You may contact us or the sender to exercise your rights over this data.

Skyfalke Sign is a business tool and is not directed at children under 18. We do not knowingly collect personal data from children.

We may update this policy from time to time. Material changes will be announced by email or in-app notice before they take effect. The effective date at the top of this page shows when it was last revised.