Privacy Policy

Last updated: 23 October 2026

This Privacy Policy explains how MimicLabs ("MimicLabs", "we", "us", or "our") collects, uses, and shares personal information when you use the SignMe website, mobile applications and related services (the "Service"). MimicLabs is based in Sydney, New South Wales, Australia. If you have any questions, contact us at support@mimiclabs.au.

1. Information we collect

We collect the following categories of information:

• Account information. When you create an account, we collect your email address and a user identifier. If you sign in using a third-party sign-in option, we receive the information that provider shares with us, which may include your name and email address, or a private relay email address if you choose to hide it.
• Onboarding preferences. Optional answers you provide during setup, such as the kinds of documents you deal with and how you describe yourself. These are used to tailor the explanations you receive.
• Document work. The assistant workspace processes your messages, documents, answers and draft revisions without saving them as conversation history. The original reader and mobile reading tools separately store resulting analyses, including document names and supporting excerpts, under the retention rules below. We retain operational metadata such as processing time, input size, status, usage and cost.
• Device identifier. A randomly generated identifier stored on your device, used in hashed form to administer free trial eligibility. This is a pseudonymous identifier, separate from optional product analytics.
• Subscription information. Records of your subscription status and transactions, received from the app distribution and payment platform. We do not receive or store your full payment card details.
• Notification token. If you enable notifications, we store the device token issued by your device's operating system so we can deliver the alerts you have asked for. It is removed when your device unregisters or when you delete your account.
• Usage allowances. Counts of certain actions, such as documents sent and pages fetched, kept to apply fair-use limits.
• Technical and usage information. Information generated when you use the Service, such as IP address, device and operating system information, and server logs, used for security, diagnostics, and to operate the Service.
• Minimal product statistics. We automatically record bounded counts of feature use, completed operations, errors, processing time and API cost. These analytics exclude document text, conversations, generated analyses, document names, customer prices, names, email addresses, network addresses and full URLs. By default, analytics events have no user or device identifier attached. Security and account records described above are separate from product analytics.

2. The documents you submit

The assistant workspace is temporary. Messages, source material, answers and drafts stay in the current tab between requests. Clearing the task, reloading, leaving the page or signing out discards that workspace. Open tasks also expire before 24 hours; a suspended browser is cleared when it resumes. We do not save this content as assistant history.

Submitting sends the material needed for your request, including prepared images where applicable, to SignMe and OpenAI for processing. The original reader may temporarily keep source text in this browser tab's session storage; it expires within 24 hours and is discarded on clearing. Full reading input is not saved in the application database, while resulting analyses can include verbatim excerpts. Guest analyses are scheduled for deletion before 24 hours and access expires at 24 hours. Creating an account before guest cleanup can preserve the analyses under account retention. Signing uploads have separate storage below.

We do not use customer content for training. OpenAI processes API material under its applicable terms and data controls. Its standard abuse-monitoring logs may retain customer content for up to 30 days, with longer retention in the circumstances described in its policy. We do not promise zero provider retention. Clearing a task does not erase information already processed by providers or retained in service logs or backups.

2b. Documents you send for signature

Uploading a document for signing preparation stores it before it is sent. When you use this tool we store the PDF you upload, the fields you place on it, the name and email address you enter for each recipient, the signatures and text each recipient provides, and the completed copy. For each view, signature and decline we record the time, the network address and the browser used, and we include that record in the completion certificate attached to the signed copy. Recipients open the document from a link; they do not need an account.

Guest signing documents, signatures, field contents and related analyses expire under the 24-hour guest content rule. Their links stop working when that content expires. Minimal audit metadata, including identity, status, timestamps and document hashes, remains separate from document content. Clearing an assistant task does not delete a signing upload.

When you send a document through SignMe, its text is read once at send time by OpenAI, in the same way as a document you read yourself, to produce the plain-language explanation shown to you and to each recipient of that document on their signing page. That explanation follows the guest or account reading-retention rules and is not used for anything else. If the PDF contains no readable text, no explanation is produced.

2a. Photos and location when you snap something

The app includes a feature for photographing real-world things you want explained (for example, parking signs, labels, meters, and notices). When you use it, the photo is sent to OpenAI to generate the explanation. The photo is processed in memory and is not stored by MimicLabs. Resulting analyses may include short transcriptions of visible text and follow the guest or account retention rules.

If you grant the app location access, a single approximate location reading is taken at the moment you snap, converted on your device to a short street-level description, and sent with that one request so the analysis can reflect where and when the sign applies. Your location is used only for that request. It is not stored by MimicLabs, is not used to track you, and is never collected in the background. Location access is optional: you can decline the permission or turn it off in your device settings, and the feature still works without it. The time and time zone shown on your device are sent the same way, so the analysis can say whether a rule applies at that moment.

3. How we use information

We use the information we collect to:

• provide the Service, including processing your documents and returning the analysis;
• create and manage your account and administer your subscription and any free trial;
• maintain a history of your analyses so you can return to them;
• apply fair-use limits;
• operate, secure, debug, and improve the Service, and enforce our Terms and usage limits;
• respond to your requests and provide support;
• comply with legal obligations.

We do not sell your personal information. We do not use your information for third-party advertising, and we do not share your documents or your identity with advertisers or merchants.

Optional return measurement

On the web, the Privacy choices control lets you choose whether we may link assistant activity across days using a protected account pseudonym to understand return use. This optional measurement is off unless you choose to allow it. We keep your choice, without an analytics identifier, in this browser for 180 days. You can turn it off through the same control at any time; future requests will then stop carrying analytics linkage. Previously recorded events expire under the retention period below. No customer content is included, and we do not use customer content for training.

4. How we share information

We do not sell your personal information, and we do not share it with advertisers. We share information only with the service providers that operate the Service on our behalf, and only to the extent needed for them to perform their function. These include:

• a processing provider, OpenAI, which processes the text of your documents, and for the photo feature the photo together with the optional location description and local time, to generate the explanation. We do not use customer content for training; provider processing and retention are described in Section 2;
• a database and authentication provider, which stores your account, preferences, and reading history in the Sydney, Australia region;
• the app distribution and payment platform through which the app is offered, which processes subscription purchases and supports sign-in;
• an email delivery provider, which sends account emails such as confirmation and password-reset messages, and supports sign-in;
• a notification delivery service operated by your device's platform, which delivers the push notifications you enable using the device token described in Section 1;
• a hosting provider, which hosts and delivers our backend service.

We may also disclose information if required by law, to enforce our Terms, or to protect the rights, property, or safety of MimicLabs, our users, or the public. If MimicLabs is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

5. International data transfers

The Service is available worldwide, and some of our providers are located outside your country of residence. Material needed for your request may therefore be processed internationally. Where we transfer personal information across borders, we take steps to ensure it is protected in a manner consistent with this Policy and applicable law.

6. Data retention

Guest document content, extracted text, conversations and analyses are scheduled for deletion before 24 hours. Access to overdue original-reader analyses and signing documents expires. Transient assistant content is not saved as history. These rules concern active application content; provider processing, service logs and backups have separate retention and are not erased by clearing a task.

Account information and account reading history remain while the account is active. For account signing requests, files and signatures are kept until request deletion or the configured cleanup 90 days after completion; the request's audit record remains. When you delete your account we delete your account, your reading history, your SignMe requests, your notification tokens, and your usage records. Content-free service statistics can remain; previously consented pseudonymous analytics events expire under the 90-day policy rather than being erased immediately by account deletion. Some limited information may remain to comply with legal obligations, resolve disputes, or enforce our agreements.

Product analytics events are kept for at most 90 days under the scheduled deletion policy. Monthly statistics without user-level records are kept for 24 calendar months. Optional pseudonyms remain protected data; they are not treated as anonymous simply because they do not contain your name. We do not run third-party advertising trackers or session replay.

7. Security

We use reasonable technical and organisational measures to protect personal information, including encryption in transit and database access controls, including row-level security. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your rights

Depending on where you live, you may have rights in relation to your personal information, including the right to access, correct, delete, or obtain a copy of it, and to object to or restrict certain processing. You can delete your account and reading history at any time from within the app. To make any other request, contact us at support@mimiclabs.au. We will respond within the time required by applicable law.

Users in the European Economic Area and the United Kingdom

If you are located in the EEA or the UK, our legal bases for processing are the performance of our contract with you, our legitimate interests in operating and securing the Service, your consent where applicable, and compliance with legal obligations. You have the right to lodge a complaint with your local data protection authority.

Users in California

If you are a California resident, you have the right to know what personal information we collect, to request its deletion, and not to be discriminated against for exercising your rights. We do not sell or share personal information as those terms are defined under California law. If a future feature would meet California's definition of sharing, we will update this Policy and provide any required opt-out before it launches.

9. Children

The Service is not directed to, and is not intended for use by, anyone under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

10. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will update the date at the top of this page and, where appropriate, provide notice within the app. Your continued use of the Service after the changes take effect constitutes acceptance of the updated Policy.

11. Contact

For any question or request regarding your personal information, contact us at support@mimiclabs.au.