Docusign (US)

Privacy Notice Overview — DocuSign

Version date: October 9, 2025

> This is a practical summary, not legal advice. The notice contains some formatting gaps and references sections that are not fully reproduced, so users should review the complete version and any applicable customer agreement.

1. Data Collection and Use

DocuSign may collect:

• Identity and contact data: name, email, phone number, address, job title, employer, country, electronic signature, and profile information.
• Account and transaction data: account details, documents and envelope information, payment or commercial information, timestamps, parties involved, and records of who initiated, viewed, or signed a document.
• Device and usage data: IP address, device identifiers and attributes, browser information, usage patterns, cookies, web beacons, pixels, and similar tracking data.
• Location data: approximate location based on IP address or Wi-Fi, and potentially precise GPS location with consent and device permission.
• Communications and user content: support requests, comments, survey responses, community posts, and information submitted about other people.
• Information from other sources: publicly available professional contact details and data from partners or other sources.

DocuSign uses this information to:

• Provide, maintain, secure, troubleshoot, and improve its Services.
• Process payments and manage accounts.
• Record and validate electronic transactions and signatures.
• Prevent fraud, unauthorized access, and other misconduct.
• Meet legal, regulatory, retention, and litigation obligations.
• Conduct analytics, research, product development, marketing, tailored advertising, surveys, contests, and referral programs.

Processing may rely on contract performance, legitimate interests, legal obligations, or consent, depending on the circumstances and applicable law.

Important customer-relationship distinction

When an organization uses DocuSign and uploads documents, DocuSign generally acts as the organization’s data processor, while the organization is the data controller. In that situation, users should usually direct privacy requests to their employer, customer, or the party requesting their signature. DocuSign may forward requests to that organization.

2. User Rights and Choices

Subject to local law, users may have the right to:

• Access personal information and obtain details about its sources, uses, recipients, and retention.
• Correct inaccurate, incomplete, or outdated information.
• Delete information.
• Restrict or object to processing.
• Receive or transfer data in a portable format.
• Withdraw consent where processing is consent-based.
• Opt out of direct marketing.
• Opt out of “sales” or targeted/cross-context behavioral advertising through the “Your Privacy Choices” link.
• Submit complaints to a local data protection authority and, where applicable, appeal a denied request.

DocuSign may require identity verification or authorization documents for requests. Deletion may make some Services unavailable, and certain information may be retained for legal, contractual, security, or technical reasons.

California residents receive additional CCPA rights, including access, deletion, correction, opt-out of sale/sharing, authorized-agent requests, and nondiscrimination for exercising rights.

3. Third-Party Sharing

Information may be disclosed to:

• Other transaction participants and DocuSign users who are given access to documents or profiles.
• Employers or organizations associated with a business email account, which may be able to find or affect the account.
• Affiliates, service providers, customer-support providers, payment processors, and security or legal-service providers.
• Advertising, analytics, marketing, and remarketing partners.
• Parties involved in a business sale, merger, asset transfer, legal claim, fraud investigation, or law-enforcement matter.
• Others with the user’s consent.

Comments, forum posts, and certain profile information may be public or visible to other users. Third-party websites and apps linked through DocuSign are governed by their own policies.

Data may be transferred internationally, including to the United States and other countries, using mechanisms such as Binding Corporate Rules or Standard Contractual Clauses where required.

4. AI and Machine-Learning Training

DocuSign states that it generally avoids training AI models with personal information entered by customers. However, it may use de-identified Customer Data, usage data, and transactional data to build, train, and maintain AI models that power certain Services with customer consent or where otherwise permitted by law.

De-identification reduces identification risk, but the notice does not guarantee that re-identification is impossible. Customers should review their contracts and consent settings, particularly for sensitive documents.

5. Key User Responsibilities and Restrictions

Users should:

• Provide accurate information and maintain account security.
• Obtain appropriate permission before submitting information about others.
• Avoid posting confidential information in public comments or forums.
• Review and manage cookie, marketing, profile, location, and privacy settings.
• Not use the Services if under 18 or the applicable age of majority.
• Understand that refusing required data, electronic signatures, cookies, or permissions may limit functionality.

6. Liability and Disputes

This Privacy Notice contains no detailed warranty disclaimer, liability cap, indemnity provision, arbitration clause, governing-law clause, or dedicated dispute-resolution process. It states that DocuSign may use information to establish, exercise, or defend legal rights and resolve disputes.

Those issues may instead be governed by DocuSign’s Terms, customer agreements, Master Services Agreement, or other contractual documents. Security measures are described, but the notice does not promise that data breaches or unauthorized access can never occur.

7. Changes to the Notice

DocuSign may change the Notice because of legal, business, Service, processing, or technology changes. It may notify users by posting the revised version on the same webpage. The applicable notice is generally the one in effect when information is used, so users should periodically review it.

DocuSign Terms: Key User Takeaways

*This summary is informational, not legal advice. The Terms primarily target business customers; consumer rights may differ by country.*

1. Data Collection and Usage

The Terms do not provide a complete list of personal data collected. Instead, they incorporate DocuSign’s Privacy Notice and, for DocuSign Services, a Data Protection Attachment. Those documents should be reviewed for details such as account, contact, usage, device, payment, communications, and document-related data.

Key points in these Terms:

• You are responsible for ensuring that data you provide or process through DocuSign complies with applicable laws and that you have the necessary permissions and consents.
• “Customer Data” means data uploaded to the DocuSign Services. It is treated as the Customer’s confidential information.
• DocuSign may collect and use Usage Data, including diagnostic information, operational information, and insights derived from use of the Services.
• DocuSign owns Usage Data and may use it for support, account management, analytics, benchmarking, industry analysis, and developing or improving products and services. Disclosed Usage Data must be de-identified and aggregated.
• DocuSign may monitor or review Site activity for service operation, fraud prevention, risk assessment, investigations, customer support, analytics, advertising, enforcing the Terms, and legal compliance.
• DocuSign may retain information from terminated accounts for fraud prevention, dispute resolution, investigations, and legal compliance.

2. User Rights

The Terms themselves provide limited direct data rights. They generally direct users to the Privacy Notice and Data Protection Attachment for applicable rights and procedures.

Depending on jurisdiction and whether you are a consumer or business user, those documents and local law may provide rights to:

• Access, correct, delete, or restrict processing of personal data;
• Object to certain processing or withdraw consent;
• Request data portability; and
• Complain to a data-protection regulator.

The Terms expressly allow electronic communications, including email, SMS, push notifications, and in-product notices. Marketing emails may be stopped through DocuSign’s preference center, but service and account communications may still be sent.

3. Third-Party Sharing

DocuSign may share information:

• With affiliates, attorneys, auditors, consultants, and service providers subject to confidentiality obligations;
• With law enforcement, courts, government agencies, or other organizations when reasonably necessary to comply with legal process, investigate suspected illegality, protect safety, enforce the Terms, or protect DocuSign, users, or the public;
• With resellers or program partners for account management, support, benefit eligibility, and related usage verification;
• Through third-party integrations, app stores, or linked services, which may have their own terms and privacy practices.

The Terms do not promise that all data remains within a particular country or region. Review the Privacy Notice and Data Protection Attachment for transfer and processor details.

4. AI/ML Training

AI training is not categorically prohibited. Section 4.3 states that Services using or integrating with AI may be governed by an AI Attachment that can include consent to use Customer Data to improve DocuSign and AI Services, including training AI and machine-learning models.

Users may be able to opt out through DocuSign’s AI Data Controls Settings FAQ. The exact default, scope of training, retention, and opt-out effect are not stated in these Terms, so customers should verify those separate AI terms and settings before uploading sensitive information.

Separately, users may not use DocuSign’s systems, models, outputs, or other derived information to build, train, test, or improve competing or substantially similar AI systems.

5. Key Obligations and Restrictions

Users must:

• Be legally eligible and comply with export controls and sanctions laws;
• Use the Site only for authorized internal business purposes;
• Protect account credentials and promptly report unauthorized use;
• Use unique accounts and comply with subscription limits, usage metrics, and reasonable-use policies;
• Ensure uploaded documents and data are lawful and do not infringe others’ rights.

Prohibited conduct includes scraping, reverse engineering, bypassing security, transmitting malware, impersonation, unauthorized account access, unlawful or abusive content, benchmarking, commercial resale, and competitive use.

Customers are responsible for activity through their accounts, potentially including unauthorized third-party use.

6. Liability and Disputes

DocuSign provides the Site generally “as is” and “as available”, disclaims broad warranties, and disclaims responsibility for outages, errors, unauthorized access, viruses, data loss, and third-party content to the fullest extent permitted by law.

Generally:

• Consequential, incidental, punitive, special, and similar damages are excluded.
• DocuSign’s aggregate liability is capped at amounts paid for the relevant Services during the preceding 12 months, or $100, whichever is greater.
• Customers must indemnify DocuSign for third-party claims arising from their use, breach, uploaded content, or infringement.
• Most disputes require informal resolution followed by binding JAMS arbitration in San Francisco, with no jury trial or class action. Intellectual-property claims are excluded. Certain consumer and country-specific exceptions apply.

7. Changes and Cancellation

DocuSign may revise the Terms by posting an updated version and date. Continued use after the effective date constitutes acceptance; users are expected to check regularly.

Subscription prices and features may change, generally with at least 30 days’ notice before changes take effect. Subscriptions automatically renew unless canceled at least five business days before the term ends. Payments are generally nonrefundable, and overage charges may apply.

Free-trial data may be permanently lost unless the user converts to an eligible paid plan or exports it before the trial ends.

DocuSign Terms of Use: Key User Takeaways

> Scope: These Terms primarily target business customers and business use. Additional service schedules, corporate agreements, the Privacy Notice, Data Protection Attachment, AI Attachment, and country-specific terms may change the result. This is a practical summary, not legal advice.

1. Data Collection and Usage

• You are responsible for ensuring that data you provide or upload complies with applicable privacy and data-protection laws.
• Information collected or provided through the Site is generally processed under DocuSign’s separate Privacy Notice and, for DocuSign Services, the Data Protection Attachment.
• “Customer Data” includes data uploaded to the DocuSign Services. It is treated as the customer’s confidential information, subject to the confidentiality provisions.
• DocuSign may collect, generate, store, and use Usage Data, including diagnostic information, service-operation information, account-management information, analytics, and insights derived from use of the Services.
• DocuSign owns Usage Data and may use it for support, account management, industry analysis, benchmarking, analytics, and developing or improving products. Disclosed Usage Data is stated to be de-identified and aggregated.
• User-posted content—such as public comments, feedback, ideas, or questions—is treated differently from uploaded documents. Posting it grants DocuSign a broad, worldwide, royalty-free, sublicensable license to use, reproduce, modify, publish, distribute, and create derivative works from it.

Practical risk: The Terms do not themselves provide a complete description of categories of personal data, retention periods, international transfers, or all data rights. Users should review the linked Privacy Notice and applicable Data Protection Attachment before uploading sensitive information.

2. User Rights Regarding Data

The Terms do not establish a detailed standalone data-access, correction, deletion, portability, or objection process. Those rights, if available, are principally governed by:

• Applicable privacy law;
• The Privacy Notice;
• The Data Protection Attachment; and
• Any Corporate Terms or service-specific terms.

DocuSign may retain certain information after terminating an account where it believes retention is necessary for fraud prevention, dispute resolution, investigations, or legal compliance.

Users may opt out of email marketing through DocuSign’s preference center. However, the Terms broadly authorize electronic service communications, including email, SMS, push notifications, and in-product notices. Marketing opt-out does not necessarily stop operational or account-related messages.

3. Sharing with Third Parties

DocuSign may access, preserve, or disclose information when reasonably necessary, in good faith, to:

• Investigate or prevent suspected illegal activity;
• Comply with subpoenas, court orders, or other legal process;
• Address threats to someone’s physical safety;
• Investigate violations of the Terms or Privacy Notice;
• Protect DocuSign, its users, employees, or the public; or
• Respond to alleged third-party rights violations.

Information may be shared with law enforcement, government agencies, courts, and other organizations. Confidential information may also be disclosed to affiliates, attorneys, auditors, consultants, and service providers on a need-to-know basis under confidentiality duties.

If a subscription is purchased through a reseller or program partner, DocuSign may share account information and selected Usage Data for account management, support, or benefit eligibility.

4. AI/ML Training

The Terms do not provide a universal “no training” promise.

For DocuSign Services using or integrating AI, the separate AI Attachment may authorize use of Customer Data to improve DocuSign and AI Services, including training AI algorithms and machine-learning models. The Terms state that users can opt out through DocuSign’s AI Data Controls Settings FAQ.

Practical step: Customers handling confidential, regulated, or personal data should confirm the default AI setting and opt out where appropriate.

5. Key User Obligations and Restrictions

Users must:

• Be legally eligible and authorized to bind their business;
• Use the Services only for lawful, internal business purposes;
• Protect account credentials and promptly report unauthorized access;
• Use unique accounts for individual Authorized Users;
• Stay within subscription limits and pay overage charges;
• Obtain appropriate confidentiality and privacy permissions for uploaded data and non-employee users.

Prohibited conduct includes unauthorized access, scraping, reverse engineering, security circumvention, malware, impersonation, infringement, harassment, commercial misuse, benchmarking, competitive use, and using DocuSign outputs or systems to create, train, test, or improve competing AI systems.

Subscriptions generally auto-renew unless cancelled at least five business days before the term ends. Payments are generally non-refundable.

6. Liability and Disputes

• Services are provided largely “as is” and “as available.”
• DocuSign disclaims many warranties and responsibility for outages, errors, unauthorized access, data loss, viruses, and third-party content.
• Liability is generally capped at the greater of amounts paid for the relevant Services during the preceding 12 months or $100.
• Consequential, incidental, punitive, lost-profit, business interruption, and similar damages are broadly excluded, subject to mandatory local law.
• Users must indemnify DocuSign for many third-party claims connected with their use, breaches, uploaded content, or infringement.
• U.S. disputes generally require informal negotiation followed by binding JAMS arbitration in San Francisco, with no jury trial or class action. Country-specific consumer protections may override these provisions.

7. Changes to the Terms

DocuSign may revise the Terms by posting updated terms and a “last updated” date. Continued use after the effective date constitutes acceptance, so users are expected to check the Site regularly. Subscription fee or feature changes generally require at least 30 days’ advance notice. Certain jurisdictions, including Germany, the UK, and Australia, provide stronger notice or termination rights for adverse changes.