PricingSign inStart free trial
HomeAll featuresOutlook add-inMicrosoft 365Google WorkspaceServer-side signaturesPricingSecurityContactSign inStart free trial

Privacy centrePrivacy policy

Privacy policy

Last updated 12 October 2026

1. Introduction

This Privacy Policy explains how Swyft Software Limited ("Swyft Software", "we", "us", "our") collects, uses, shares and protects personal data when you visit swyftsignature.com, use the Swyft Signature platform, or contact us. Swyft Signature is a product of Swyft Software Limited.

Swyft Software Limited, whose registered office is at 77 Lower Camden Street, Dublin 2, D02 XE80, Ireland, is the data controller for the personal data described in this policy, except where section 2 says we act as a processor for your organisation.

This policy is governed by the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Data Protection Acts 1988 to 2018 (Ireland), the ePrivacy Regulations (S.I. No. 336 of 2011) and any applicable successor legislation.

2. Data We Collect

We collect and process the following categories of personal data:

  • Contact information: Name, email address and telephone number provided through our contact form.
  • Account information: Microsoft Entra ID account details (name, email, job title, tenant ID) provided when you sign in to the admin portal with your Microsoft account, or Google account details (name, email address, Google account ID and Google Workspace domain) provided when you sign in with Google.
  • Billing information: Your organisation's name, billing address, VAT number and subscription details. Card details are collected and held by Stripe, never by us.
  • Usage data: Information about how you use the platform, including pages visited, features used and actions performed.
  • Technical data: IP address, browser type, device type and operating system, for security and fraud prevention.
  • Website analytics: If you accept analytics cookies, how you use this website, measured by Google Analytics (see section 6 and our Cookies Policy).
  • Synced employee data (customers only): If your organisation connects a Microsoft 365 tenant, we process Microsoft Entra ID profile attributes (name, job title, department, phone numbers and similar) as a data processor on behalf of your organisation, which is the data controller. If your organisation connects Google Workspace, we process the equivalent Google Workspace directory data in the same way, as described in section 7.

3. Lawful Basis for Processing

We process your personal data on the following lawful bases:

  • Contract (Article 6(1)(b) GDPR): Processing needed to provide the Swyft Signature service to you or your organisation.
  • Consent (Article 6(1)(a) GDPR): Analytics and advertising cookies on this website, which are only set if you accept them. You can withdraw consent at any time using "Cookie settings" at the bottom of every page.
  • Legitimate interest (Article 6(1)(f) GDPR): Answering enquiries, security, fraud prevention, improving the platform and running the service, where our interests are not overridden by your data protection rights.
  • Legal obligation (Article 6(1)(c) GDPR): Where processing is required by law, for example keeping billing records for tax purposes.

4. How We Use Your Data

We use your personal data to:

  • Provide, operate and improve the Swyft Signature platform and website.
  • Respond to contact form messages and support requests.
  • Process and manage your subscription and billing.
  • Send transactional emails, such as account notifications and billing receipts.
  • Monitor security, prevent fraud and detect abuse.
  • Understand how this website is used, where you have agreed to analytics cookies.
  • Comply with legal and regulatory obligations.
  • Enforce our Terms of Business.

We do not sell your personal data. Data from the Swyft Signature platform, including your organisation's directory data, is never used for advertising.

5. Where Your Data Is Kept

The Swyft Signature platform runs on Microsoft Azure in the European Union. The application runs in the West Europe region (the Netherlands) and the database in the Germany West Central region (Frankfurt), where it can only be reached over a private network. Microsoft Azure is independently audited against ISO/IEC 27001 and SOC 2; see our Security page for details.

6. Data Sharing and Third-Party Processors

We share personal data with trusted third parties only where needed to deliver the service. Our processors are bound by data processing agreements and provide appropriate safeguards.

  • Microsoft (Azure, Entra ID and Graph): Hosting, storage, database, sign-in and Microsoft 365 directory sync.
  • Google: Sign in with Google, Google Workspace directory sync and setting Gmail signatures (see section 7). If you accept analytics cookies, Google Analytics and Google Tag Manager measure how this website is used. If advertising is switched on for this website and you accept advertising cookies, Google AdSense may show and measure ads; for this, Google acts as an independent controller under Google's Privacy Policy.
  • Stripe: Payment processing and subscription management.
  • Resend: Sending our emails, including contact form replies.
  • Cloudflare: The Turnstile spam check on our contact form, and DNS.

Some of these providers are based in, or may access data from, the United States. Where personal data leaves the European Economic Area (EEA), we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses, in line with Chapter V of the GDPR.

7. Google Workspace and Google User Data

If your organisation uses Google Workspace, a Google Workspace super administrator authorises Swyft Signature, either by installing it from the Google Workspace Marketplace or by adding it under domain-wide delegation in the Google Admin console. Swyft Signature then uses Google APIs as follows, and for nothing else:

  • Sign in with Google: your name, email address, Google account ID and Google Workspace domain, to sign you in to the admin portal and to match you to your organisation. Personal Google accounts cannot sign in.
  • Directory (read only): your organisation's name and domains, and for each person their name, email address, job title, department, phone numbers, office location, manager and employee ID, plus the groups they belong to and whether their account is active. We store these to fill in each person's email signature and to apply your signature rules.
  • Gmail settings: we set each person's Gmail signature to the one your organisation designed in Swyft Signature, and remove it if it no longer applies. We do not read, send, delete or store any email, and we do not access any other Gmail data or settings.

Google user data is stored in our database in the EU (Microsoft Azure, see section 5), encrypted in transit and at rest, and is only accessible to your organisation's Swyft Signature administrators. Our staff do not view it except where your organisation asks us to for support, where it is needed for security, or to comply with the law. We do not sell Google user data, use it for advertising, transfer it to data brokers or information resellers, use it to train artificial intelligence models, or use it to decide creditworthiness. When your organisation leaves Swyft Signature, the data is deleted as set out in section 8; an administrator can also remove Swyft Signature's access at any time in the Google Admin console.

Swyft Signature's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Data Retention

We keep personal data only for as long as we need it for the purposes in this policy:

  • Contact form messages: Up to 2 years from the date you contact us.
  • Account and organisation data: For the length of the subscription, plus 90 days after it ends so you can ask for an export.
  • Audit logs: For the period your subscription plan includes (30 to 365 days).
  • Billing records: 7 years, to meet Irish tax and accounting obligations.
  • Website analytics: Google Analytics data is kept for 14 months.

9. Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, change, disclosure or destruction. These include encryption in transit and at rest, Azure Key Vault for secrets, private networking for the database, a web application firewall, access controls, tenant isolation and audit logging.

No method of transmission over the internet or electronic storage is completely secure. While we work hard to protect your personal data, we cannot guarantee absolute security.

10. Your Rights

You have rights under the GDPR including access, rectification, erasure, restriction of processing, objection and portability, and the right to withdraw consent at any time. See Your data rights for how to use them.

11. Cookies

This website uses cookies that are strictly necessary, and analytics or advertising cookies only if you accept them. For full details, see our Cookies Policy.

12. Children's Data

Swyft Signature is a business-to-business platform and is not directed at children under the age of 18. We do not knowingly collect personal data from children.

13. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified to registered users by email. The date of the latest revision is shown at the top of this page.

14. Contact

To use your data protection rights or raise a privacy concern, please use our contact form, choose "Something else, including privacy requests" and tell us which right you want to use. You also have the right to complain to the Data Protection Commission, the supervisory authority in Ireland (dataprotection.ie).