About this policy
This policy explains how PurelySustain handles personal information when you use the PurelySustain website, document workspace, forms, approvals and electronic-signature features.
If an employer, school, NGO or another organization provides your workspace, that organization decides how its documents and participant information are used. Contact your workspace administrator about those decisions. We operate the service and handle account, support and security information needed to provide it.
Information we handle
- Account and organization details: name, email, account type, organization name, membership, department, role and workspace settings.
- Document and workflow information: document IDs, titles, status, versions, cloud references, participant details, approval activity, timestamps and audit records.
- Private content you provide: document text, form answers, uploaded files, private branding, attachments, signature content and expense reimbursement details, including payment references, that our application processes for your workflows.
- Cloud connection information: provider account details, permissions and encrypted authorization credentials needed to access the connected storage.
- Support and technical information: messages you send us and operational information such as request times, delivery status and security events. Hosting and delivery providers may also process IP addresses and device or connection information.
Only include personal information in documents when you have authority to use it. Avoid uploading information that is unnecessary for the workflow.
Where your information lives
| Information | Where it is stored |
|---|---|
| Private document files | The customer’s connected Dropbox, Google Drive, OneDrive or Box, including source files, prepared and completed PDFs, attachments and signature images. |
| Account and workflow records | Our Neon PostgreSQL database, including encrypted workspace content, document versions, form answers, reimbursement details, cloud references, audit history and encrypted OAuth credentials. |
| Explicitly published images | Cloudinary. These images are publicly accessible through their URLs. |
| Operational processing | Our application servers process content when you open, convert, approve, sign or download a document. |
Customer-controlled storage does not mean the platform cannot access content. The application uses your authorized connection to process files and carry out your requests. This is not end-to-end encryption against the platform operator.
Local development installations may use local storage. This policy’s customer-cloud storage description refers to our cloud-connected service.
How we use information
We use information to create and secure accounts, verify sign-in codes, manage workspace permissions, prepare and store documents, operate approvals and signing, record expense reimbursements, send requested notifications, respond to support requests and investigate service failures or misuse.
Expense reimbursement records describe payments made outside the service. We do not use them to transfer money. Notification emails exclude payment references, bank instructions and free-text revision feedback; message records retain recipients and delivery status.
Public document-verification links can disclose the document’s issued status and record details. Share verification and signing links only with their intended audience. The current application does not provide a ChatGPT connection or send documents to an AI drafting service.
Your choices and requests
You can update available profile and workspace settings, download documents you have permission to access and disconnect a cloud service through the application or revoke access through that provider. Disconnecting stops future authorized access; it does not delete files already stored in your connected drive.
For requests to access, correct or delete account information, contact office@purelysustain.com. We may need to verify your identity and authority before acting. For organization-managed records, we may direct the request to your administrator. Some records may need to be retained for security, dispute resolution or legal obligations.
Privacy rights and complaint options vary by your location and circumstances. You may contact the relevant data-protection authority where that right applies.
Retention and deletion
We keep account, workflow and operational information for as long as needed to provide the service and address security, support, disputes and applicable obligations. Retention depends on the type of record and the organization’s workflow; we do not promise an automatic deletion deadline for every category.
Your connected cloud provider may retain file versions, deleted files or backups under its own settings. Removing a workspace record or disconnecting a provider does not necessarily remove all cloud snapshots, issued artifacts or provider backups. Coordinate document retention with your workspace administrator and storage provider.
Published image URLs may remain available until the image is removed from the hosting provider. Contact us if you need help removing an image published through our service.
Security and access
We use controls such as passwordless email verification, workspace authorization, encrypted cloud credentials, request limits, signed provider callbacks and file-integrity checks. Encryption keys are maintained separately from database records.
These measures reduce risk but do not eliminate it. Keep your email account secure, review workspace membership and avoid sharing private signing links. Report a suspected security or privacy issue to office@purelysustain.com.
International processing
The service and its providers may process information in countries other than your own. Database location, hosting configuration and the connected provider’s infrastructure affect where information is handled. Customer-controlled storage does not guarantee that all processing remains in one country.
Children and school workspaces
Individual accounts are not intended for children to create independently. Schools and other organizations that manage information about children are responsible for providing required notices, obtaining appropriate permissions and limiting the information included in their workflows. Contact the organization’s administrator about a student record.
Updates and contact
We may update this policy when our service or practices change. The date at the top identifies the latest version. Review this page when connecting storage or adding sensitive information to a workflow.
A question about your information?
Contact PurelySustain. Include your workspace name and the nature of your request; please do not email passwords, sign-in codes or private document attachments.
office@purelysustain.com