Privacy Policy
Last updated November 2, 2026
This Privacy Policy explains how Dan Zilberman ("Hereby", "we", "us") collects and uses personal data when you visit usehereby.com, use the Hereby application, or open a data room or signing page hosted on Hereby.
1. Who is responsible for your data
Hereby plays two different roles:
- Hereby as controller. For our website, our customers' accounts (names, email addresses, sign-in and billing records) and our own business communications, we decide how personal data is used. This policy covers that use.
- Hereby as processor. The documents, data rooms and signing envelopes in a workspace, and the personal data of the people a workspace shares with or asks to sign (viewers and signers), are controlled by the workspace's organisation, our customer. We process that data only on the customer's instructions, under our Data Processing Agreement. If you were invited to view or sign something, the organisation that invited you is responsible for that data; please contact them first. We will help them answer your request.
Contact: Dan Zilberman, Israel. Email: [email protected].
2. What we collect
Account and workspace data. Your email address, the name you give, the workspaces you belong to, your role, and your settings.
Content. Files you upload, folders, versions, data room settings, envelopes, signature images, typed names, field values, questions and answers. (Processed for the customer, see above.)
Sign-in and security data. One-time code requests and attempts (codes are stored only as hashes), session records, IP addresses, browser user agent, and timestamps. We use these to sign you in, to rate-limit abuse and to protect accounts.
Audit and evidence records. Workspaces keep a tamper-evident audit log of actions such as sign-ins, sharing, document views, downloads and signing steps. For each signer, the certificate of completion records the email address, authentication method, IP address, browser and the time of every step.
Data room activity. When you view a document in a data room, the workspace that shared it can see which documents and pages you opened, for how long, and what you downloaded. This is a core feature of data rooms and is processed for the workspace.
Billing data. Our Merchant of Record, Polar, collects payment details directly. We receive the customer's email, plan, subscription status and invoice records, not full card numbers.
Communications. Messages you send to us and the emails we send you (for example sign-in codes, invitations, signing requests and receipts), including delivery status.
Website. Our servers and our network provider, Cloudflare, process standard request data (IP address, user agent, requested page, time) to deliver and protect the site. We do not use advertising or third-party analytics trackers.
3. Why we use it and our legal bases (GDPR)
| Purpose | Legal basis |
|---|---|
| Providing the Service you signed up for, including sign-in and email delivery | Contract (Art. 6(1)(b)) |
| Processing workspace content, viewer and signer data on the customer's behalf | Customer's instructions under the DPA (Art. 28) |
| Security, fraud and abuse prevention, rate limiting, audit logs | Legitimate interests in a secure service (Art. 6(1)(f)) |
| Keeping signing evidence so signed documents can be proven | Legitimate interests and the customer's legal obligations (Art. 6(1)(f), 6(1)(c)) |
| Billing, tax and accounting records | Contract and legal obligation (Art. 6(1)(b), 6(1)(c)) |
| Service emails about your account, changes to terms and security | Contract and legitimate interests |
| Product announcements by email (only if you opt in) | Consent (Art. 6(1)(a)); you can withdraw it at any time |
We do not sell personal data, do not share it for cross-context behavioural advertising, and do not use customer content to train AI models.
4. AI processing
If a workspace has AI features turned on and a member uses them, the document's pages and text are sent to our AI sub-processors (Anthropic and TypeSafe) to find signature fields and roles. They process it only to return the result to us and, under their terms, do not use it to train their models. We log that an AI run happened and its size, not the document content. Workspace admins can turn AI off in settings.
5. Who we share it with
We share personal data only with:
- Sub-processors that help us run the Service, listed on our sub-processors page, under contracts that require them to protect it.
- The workspace that invited you, when you are a member, viewer or signer: they see your activity in their workspace, as described above. Signers' details appear on the certificate of completion, which is sent to every party of the envelope.
- Authorities, when the law requires it, and only after checking the request is valid.
- A successor, if our business is merged or sold, with notice to you.
6. International transfers
Hereby is operated from Israel, which the European Commission recognises as providing an adequate level of data protection. Our servers and file storage are in the European Union (Germany). Some sub-processors may process data outside your country, including in the United States. Where data from the European Economic Area, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on the EU Standard Contractual Clauses (and the UK Addendum) or the EU-U.S. Data Privacy Framework where the recipient is certified.
7. How long we keep it
- Account data: while your account exists. When you delete your account, we remove or anonymise your personal data within 30 days.
- Workspace content: while the workspace exists. Deleted items stay in trash for the workspace's retention window (30 days by default) and are then purged. Backups roll over within 30 days.
- Signing evidence and audit logs: kept for the life of the workspace, because signed documents must stay provable. When a user deletes their account, their name and email in audit events are anonymised instead of the events being deleted.
- Billing records: as long as tax law requires (typically up to 10 years).
- Security logs: up to 12 months.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. In the app you can export your data and delete your account from your account settings. For anything else, email [email protected]. We will answer within one month.
If you are in the EEA or UK, you can also complain to your local data protection authority. If you are in Israel, you have the rights in the Protection of Privacy Law, 5741-1981, and can complain to the Privacy Protection Authority. California residents have the rights described in the CCPA/CPRA; we do not sell or share personal information as those laws define it, and we will not discriminate against you for using your rights.
9. Security
We use TLS for all traffic, hashed one-time codes and tokens, strict tenant isolation, a hash-chained audit log, sealed signed documents and encrypted backups. More detail is in the security section of our Data Processing Agreement. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.
10. Cookies
We use only cookies that the Service needs to work. See our Cookie Notice.
11. Children
Hereby is a business service and is not meant for children under 16. We do not knowingly collect their data.
12. Changes
We will post changes here and update the date at the top. If a change is material, we will tell account holders by email before it takes effect.