Like most other users here, I don't think the signing service is at any fault here.
The signing service provides a certain workflow, which is the same for any documents, whether it contains PII or not. To the signing service, the document being signed is just a blob. They have no idea whether a document contains business contracts, PII, top secret documents, or some saucy fanfics you wrote over the weekend.
It is the responsibility of whoever asked you to sign this document to choose the signing mechanism that satisfies their responsibility to protect their customer's private data or to choose what data to be embedded in the document that is to be signed. In this case, they choose a service that aren't designed to protect sensitive data adequately, to the level that is necessary for their document.
In addition, just because the document is sent over email does not necessarily mean it is sent in clear text. Mail server to mail server communication are often encrypted, and you are then responsible for the last hop of setting up to access your email via IMAP/POP with TLS or via HTTPS webmail client.
Depending on the sensitivity of the document, setting up GPG or S/MIME so they can send you end to end encrypted email may not be appropriate for the purpose. Part of the reason why online signing service is popular is because they are much easier to use than having to set up GPG/x509 key pair properly. And if you have to set these up to use the document signing service anyway, you might as well just skip the middlemen and sign the document yourself with these certificates.