Effective October 8, 2026
Updated October 17, 2026: what identity verification returns, and keeping it with sent documents (sections 1 and 5).
Updated October 12, 2026: signing in with Google and Apple (section 1).
Updated October 8, 2026: drafts you never sent are deleted with your account (section 5).
Undersign is an electronic signature service, available at undersign.cc and in the Undersign
mobile apps. It is operated by Suntree Inc. ((주)선트리, “we”). This policy explains what personal information we
collect, why, who processes it, how long we keep it, and the rights you have.
We never collect your resident registration number (주민등록번호).
We don’t sell personal information, show ads, or track you across other apps and websites.
All data is sent over encrypted HTTPS connections.
You can delete your account at any time from within the app.
1. Information we collect
Account: your name, email address, mobile phone number and password. We store the
password only as an Argon2 hash. If you sign up with Google or Apple, there is no password until
you create one.
Google sign-in (optional): if you sign in with Google, Google tells us your Google
account ID, email address and name, and that the email address is verified. We use them only to
sign you in and to show which Google account is connected. We never receive your Google password
or anything else from your Google account, and you can disconnect it in your profile.
Sign in with Apple (optional): if you sign in with Apple, Apple tells us your Apple user
ID, your email address (which may be a private relay address if you choose Hide My Email) and,
the first time only, your name. We also keep a token from Apple, encrypted, only so we can ask
Apple to revoke it when you disconnect Apple or delete your account. We never receive your Apple
Account password.
Business details (optional): business or company name, business registration number and
business type, if you add them to show on your contracts.
Identity verification (optional): when you or a sender chooses identity verification, it
runs through Danal, a licensed identity verification provider. We receive your verified name, date
of birth and gender, the mobile number you verified and its carrier, whether you are a Korean
national or a foreign resident, and Danal’s transaction number. We also record when and from which
IP address and browser the check was completed and used. The connecting information (CI/DI) is
stored only as a keyed hash, never in the clear. We never receive your resident registration number.
Your content: documents you upload, signatures and initials you draw or save, what you
enter into document fields, and project names.
People you send documents to: the name, email address and/or mobile number you enter for
each signer, approver or viewer.
Signing records: for each document, an audit trail of events (sent, opened, verified,
signed and so on) with the time, IP address and browser or device type, plus fingerprints (hashes)
of the document versions.
Notifications: on Android, a device token from Firebase Cloud Messaging so we can send
push notifications.
Signed-in devices: for each device or browser you are signed in on, its browser or device
type, when it last opened the service, and which version of our app screens it runs — so we can
support you and know when older versions are still in use.
We do not collect your location, contacts, photo library, payment information or advertising ID.
2. How we use it
To run your account and the service: sending documents, collecting signatures and approvals,
and delivering completed documents.
To verify signers’ identity at the level the sender requires.
To send signing requests and updates by email, text message and push notification.
To keep tamper-evident evidence of who signed which document and when.
To keep the service secure, prevent abuse, and meet our legal obligations.
We don’t use your information for advertising or profiling.
3. Who can see it
Other parties to a document. A completed document comes with a certificate of completion.
It lists each signer’s name, email address, title and role, the business they signed for (if any), how
they were verified, and when they signed.
Service providers that process data for us under contract, only to provide Undersign:
Provider
What they do
Location
Hostinger International Ltd.
Hosts our servers and database, including uploaded documents
India
Danal Co., Ltd.
Identity verification
Republic of Korea
Twilio Inc.
Sends text messages (verification codes, signing links)
United States
Google LLC
Sends email (Gmail) and Android push notifications (Firebase Cloud Messaging)
United States
We disclose information to authorities only when the law requires it. We never sell or rent personal information.
4. Transfers outside Korea
Our servers are located in India, and Twilio and Google process data in the United States. Your
information is transferred to them over encrypted connections when you use the service. Each provider
receives only the information its task needs, as listed above: the hosting provider stores everything
you keep in Undersign; Twilio receives phone numbers and message text; Google receives email
addresses, message text and device tokens. They keep it only as long as needed to provide their
service to us. If you don’t want your information transferred, you can choose not to use Undersign or
delete your account. That may mean you can’t use the service.
5. How long we keep it
Account information is deleted as soon as you delete your account. This includes your
profile, business details, saved signatures, uploaded files and device tokens.
Identity verification results are evidence of who sent or signed a document. If you sent
documents, the result of your account’s identity verification is kept with them for the same
10 years described below. A check you complete while signing someone’s document is kept with that
document. If you never sent a document, the result is deleted with your account.
Drafts (documents you created but never sent) are deleted together with your account,
including the files you uploaded to them.
Documents you sent, with their signing records, are evidence of every party’s rights. We
keep them separately from account data for 10 years from the day the contract was completed
or ended (declined, voided or expired), in line with Article 33 of the Korean Commercial Act, and
then destroy them. Their link to your account is replaced with “deleted user”. If you never sent a document, your
account is deleted completely.
Device tokens and the signed-in device record are removed when you sign out of that device.
6. Cookies
We use one essential cookie to keep you signed in. We don’t use analytics or advertising cookies.
7. How we protect it
All traffic is encrypted with HTTPS. Passwords are stored only as Argon2 hashes, and identity
connecting information only as a keyed hash. Each document’s audit trail is hash-chained, so any
change to it can be detected. Access to production systems is restricted to authorized staff.
8. Your rights
You can ask to see, correct or delete your personal information, or to stop its processing. You can
view and edit most of it in Settings → Profile. To delete your account, go to
Settings → Profile → Delete account (설정 → 프로필 → 회원 탈퇴). Step-by-step instructions are at
undersign.cc/ko/legal/account-deletion. If you can’t sign in, or for
anything else, email allsign523@gmail.com. We will respond within 10 days.
9. Children
Undersign is a service for adults. We don’t knowingly collect personal information from children
under 14.
10. Changes to this policy
When we update this policy, we will post the new version here with a new effective date. If the
changes are significant, we will also tell you in the app or by email.
11. Contact
Operator
Suntree Inc. ((주)선트리) · Business registration no. 431-81-03312
Address
Room D210, 2F, 558-1 Gukchaebosang-ro, Jung-gu, Daegu, Republic of Korea