CloudRaker Privacy Policy

Version 2026.1. Effective and last updated: 29 October 2026.

Who we are

CloudRaker Inc. is a Québec corporation at 1300 Sherbrooke St. W, 6th Floor, Montréal, Québec, H3G 1H9, Canada.

This policy explains how we collect, use, and disclose personal information through our websites, products, and business relationships. It includes RakeSign and our other CloudRaker services.

Our Privacy Officer handles questions and privacy requests at privacy@cloudraker.com. You can also write to the postal address above, addressed to the Privacy Officer.

When this policy applies

We are responsible for information that we handle independently of customers' instructions, including for our own account administration, billing, communications, security, and business operations.

We also process documents and other content on behalf of our business customers. Customers can act as controllers or as processors for another organization. We act as processor or subprocessor under their instructions and our Data Processing Addendum. This policy does not replace the DPA or change a customer's contractual rights.

If an organization sends you a document to sign, contact that organization about its use of your information and the applicable privacy notice. We assist customers with privacy requests as the DPA requires.

Information we collect and its sources

The information depends on the services you use and what you or your organization provide.

Category	Examples	Sources
Identity and contact information	Name, email address, organization, role, and contact details	You, your organization, and people who invite you or send documents to you
Account and authentication information	Account identifiers, organization membership, sign-in records, and verification status	You, your organization, and authentication providers
Billing and transaction information	Billing contacts, plan, invoices, payment status, and service usage	You, your organization, payment providers, and use of our services
Documents and service content	Files, messages, prompts, outputs, recipient details, signatures, and information in connected services	You, customers, authorized users, recipients, and integrations that customers enable
Technical and activity information	IP address, browser and device information, timestamps, requests, errors, and audit events	Your device and use of our websites and services
Communications	Support requests, feedback, business correspondence, and privacy requests	You and people acting for your organization

You can choose not to provide information. We may then be unable to create an account, verify a recipient, complete a transaction, or provide the requested service.

Sensitive information

Customer content can contain sensitive personal information. Our Terms of Service restrict health information, biometric identifiers, children's information, and other restricted data unless an Order expressly authorizes it.

We do not use biometric identifiers to identify people. An uploaded image, recording, or drawn signature does not authorize us to create a biometric identification system.

Where we need consent to process sensitive information for our own purposes, we obtain the consent required by law. Customers must establish the authority required for information they submit.

Why we use information

We use personal information to:

• Create accounts, authenticate users, and manage organization access.
• Provide requested services, including document preparation, delivery, signature verification, and audit records.
• Process customer content and run integrations or AI features that customers choose.
• Manage subscriptions, invoices, payments, and usage.
• Respond to support requests and communicate about services or business relationships.
• Maintain reliability, diagnose errors, prevent fraud and misuse, and protect accounts and systems.
• Improve services using operational information and aggregated data, within our contractual commitments.
• Handle privacy requests, meet legal obligations, resolve disputes, and enforce agreements.

Where applicable law requires a legal basis, we rely on consent, contract performance, legal obligations, or permitted legitimate interests.

We do not use Customer Content, Input Data, or Output Data to train or develop machine-learning models made available to anyone other than that customer. Our Terms govern this commitment.

How we disclose information

We disclose information only as needed for the purposes described in this policy, with consent, or as law permits or requires. Recipients can include:

• Service providers for hosting, storage, authentication, payments, email, customer support, monitoring, and requested AI processing.
• The customer's authorized administrators, users, document recipients, and integrations, according to the customer's configuration and instructions.
• Professional advisers, auditors, insurers, and authorities where needed for legal, security, or business obligations.
• Parties to a proposed or completed business transaction, subject to applicable confidentiality and privacy safeguards.

Authorized personnel in operations, engineering, security, finance, support, and legal functions can access information when their responsibilities require it. We limit access to the relevant purpose.

Our Trust Center lists subprocessors that handle customer data. Customers control any separate third-party services they connect. Those services have their own privacy terms.

Sale, advertising, and profiling

We do not sell personal information, share it for cross-site targeted advertising, or operate as a data broker. We do not currently use marketing trackers on our websites.

Customers may use our tools in their own workflows. They are responsible for their decisions, notices, and legal obligations.

Where an applicable opt-out right exists, you can exercise it through the request channels below. We do not require an opt-out to receive the no-sale and no-targeted-advertising protections above.

Cookies and website controls

Our services use cookies and similar storage for sign-in, security, preferences, and service operation. We also collect the technical information described above.

You can manage cookies through your browser. Blocking cookies can prevent sign-in or other essential features. A Global Privacy Control signal does not need to disable essential authentication cookies to preserve our no-sale and no-targeted-advertising practices.

Links to other websites do not make their practices part of this policy. Review the notices of those websites before providing information.

Where information is processed

We and our service providers may process information outside Québec, including elsewhere in Canada, the United States, and other countries where providers operate. Foreign authorities may access information under local law.

We apply the assessments and safeguards required for the relevant transfer. For customer content, contractual transfer terms and any agreed location requirements are set out in the DPA and the applicable Order.

Retention and security

We keep personal information for the time needed for its stated purposes, subject to legal and contractual requirements. Relevant factors include account activity, the service requested, security needs, recordkeeping duties, and disputes.

Customer content follows the retention, return, and deletion terms in the customer's agreement and DPA. A signature audit record may need a different retention period from a temporary verification code.

When information held for our own purposes is no longer required, we delete it or anonymize it as applicable law permits. This does not change our customer-directed deletion obligations under the DPA. If legal obligations require retention, we restrict its use to the relevant purpose.

We use administrative, technical, and physical safeguards appropriate to the information and risks. Our Security Program provides more information. No system can guarantee absolute security.

Your privacy rights

Depending on the law that applies and our role, you may have rights to:

• Know whether we hold or process your personal information and obtain access to it.
• Correct inaccurate or incomplete information.
• Request deletion, restriction, portability, or cessation of certain disclosures.
• Withdraw consent or object to certain processing, subject to legal limits.
• Opt out of activities covered by applicable sale, targeted advertising, or profiling rules.
• Receive information about a refusal, appeal it where available, and complain to a privacy regulator.

We will not unlawfully discriminate against you for exercising a privacy right. Withdrawing consent does not invalidate earlier lawful processing. It can affect services that need the information.

Requests, responses, and appeals

Email privacy@cloudraker.com or use Privacy Requests in our Trust Center. Describe your request and your relationship with CloudRaker. Do not send passwords or unnecessary sensitive information.

We may need proportionate information to verify your identity or an authorized agent's authority. For requests about content processed on a customer's behalf, we notify that customer and direct you to it, unless instructions or law require otherwise. We assist the customer as the DPA requires.

For requests we handle directly, we respond within the deadline required by applicable law. For access requests subject to a 30-day deadline, we use that deadline. We use an extension only where the law permits it and provide the required notice.

If we decline a request, we explain the reason and available review options as required by law. You can ask our Privacy Officer to review the decision by emailing the same address with the subject "Privacy appeal". We respond to appeals within the applicable legal deadline.

You can also contact the Commission d'accès à l'information du Québec, the Office of the Privacy Commissioner of Canada, or your competent privacy regulator.

Children and minors

Our services are intended for business users aged 18 or older. We do not knowingly collect children's information for our own consumer services. Contact our Privacy Officer if you believe a child provided information directly to us.

Customers must follow the restrictions and any express authorization in their Order before providing children's information as customer content.

Changes to this policy

We review this policy and update it when our practices or legal requirements change. We update the version and date above when we revise it. We take reasonable steps to communicate material changes and obtain any new consent required by law.

Definitions and contact

Personal information means information about an identified or identifiable individual, including information reasonably linkable to that individual. Sensitive information means personal information that receives heightened protection under applicable law.

For questions, requests, or complaints, contact the Privacy Officer, CloudRaker Inc., at privacy@cloudraker.com or the postal address in "Who we are".

---

Adapted from the Open Agreements Consumer Privacy Policy by Open Agreements, licensed under CC BY 4.0. CloudRaker changed the scope, disclosures, request procedures, and optional clauses for its services and jurisdiction. No endorsement by the template authors is implied.