Privacy policy
Last updated 15 August 2026
Who we are
Hubnexa Sign is a product of DACLAN Investment Limited (“we”, “us”), a company registered in New Zealand. We are the agency responsible for personal information collected through this service under the Privacy Act 2020. You can reach us at support@hubnexa.net.
Information we collect
If you hold an account with us, we collect your name, email address, and optionally your job title, company name and phone number. We also record the documents you upload and the actions you take in the service.
If you have been sent a document to sign, we collect your name and email address from the person who sent it, and we record your IP address, the date and time you open and sign the document, the signature you draw, type or upload, and whether you sign or decline. This information forms the audit trail that makes an electronic signature legally reliable.
Envelopes you upload are stored so they can be signed and retrieved. We do not read them, and we do not use their contents for any purpose other than providing the service.
If you give us a recovery email address, we hold that address so we can help your firm regain access if the main account holder cannot get in. We use it for nothing else, and we do not add it to any mailing list.
If you invite a colleague, we hold the address you gave us until the invitation is accepted or expires, so that we can send the invitation and check it when it is used.
When you sign in, we create a six-digit code and send it to your email address. The code is held until it is used or expires, along with the number of attempts made against it. If you mark a device as trusted, we store a random token in that browser and a matching record here, so we know not to ask again for thirty days. Neither the code nor the token tells us anything about you beyond the fact that you signed in.
Why we collect it
We collect this information to deliver documents for signature, to record who signed what and when, and to produce a certificate of completion that stands up as evidence. Signature and audit data is collected specifically to satisfy Part 4 of the Contract and Commercial Law Act 2017, which sets out when an electronic signature is legally valid.
Where your information is stored
Your information is not stored in New Zealand. We use the following providers:
- Database and document storage — Supabase, hosted in Sydney, Australia
- Application hosting — Vercel, United States
- Email delivery — Resend, United States
Before using these providers we satisfied ourselves that they are subject to privacy safeguards comparable to those in the Privacy Act 2020. Each encrypts data in transit and at rest.
Who we share it with
We do not sell personal information and we do not share it for advertising. Signers’ details are visible to the person who sent the document and to anyone else they added as a signer, since a signed document necessarily records who signed it. We disclose information to third parties only where the law requires it.
How long we keep it
Signed documents, certificates and audit trails are retained while your account is open, and for at least seven years after a document is completed, reflecting standard New Zealand business record retention. Draft documents can be deleted by their owner at any time. Completed documents cannot be deleted, because doing so would destroy the record that makes the signature meaningful — they can be archived instead.
How we protect it
- All connections use HTTPS
- Database access is restricted per account using row-level security
- Signing links are single-purpose tokens that can be revoked or expire
- Every completed document is fingerprinted with a SHA-256 hash so alteration is detectable
- Every material action is written to an immutable audit trail
These controls are aligned with recognised information security practice. DACLAN Investment Limited is not currently certified to ISO/IEC 27001.
Your rights
Under the Privacy Act 2020 you may ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. Write to support@hubnexa.net and we will respond within 20 working days.
If you signed a document and want a copy, you should already have received one by email when it was completed. We can resend it on request.
Complaints
If you believe we have mishandled your information, contact us first at support@hubnexa.net. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.
Changes
We will update this page if our practices change, and will revise the date at the top. Material changes affecting existing users will be notified by email.