Privacy Policy

1. Who we are

Data controller: Signatta Technologies Lda, Rua Zeca Afonso 14, 3.º, fração A, Santa Iria de Azoia, 2690-395 Loures, Lisboa, Portugal. Contact: info@chegatta.com.

Signatta provides electronic signature services to small businesses. This policy explains what personal data we process, why, and your rights under the EU General Data Protection Regulation (GDPR).

2. Data we process

Account data: name, email, password hash, language preference, organization membership and role.

Envelope data: documents you upload, signer names, emails and phone numbers, signature placements, and the audit trail (views, signatures, timestamps, truncated IP addresses).

Verification data: one-time codes are stored hashed, never in plain text; identity assertions keep only minimal attributes.

Technical data: truncated IP addresses (anonymized after 90 days) and hashed device identifiers for security.

We do not process biometric templates, full payment card numbers, or Qualified Signature private keys.

3. Purposes and legal bases

Contract performance (Art. 6(1)(b)): creating accounts, sending and signing envelopes, delivering evidence packs.

Legal obligation (Art. 6(1)(c)): statutory retention of signed documents and accounting records.

Legitimate interests (Art. 6(1)(f)): fraud prevention, abuse blocking, service security and integrity verification.

Consent (Art. 6(1)(a)): marketing communications only — never pre-ticked, withdrawable at any time.

4. Retention

General contracts: 20 years after completion. Commercial documents: 10 years. Employment contracts: 5 years after termination. Identity proofing artifacts: 5 years, then reduced to hashes. Raw IP data: anonymized after 90 days. Backups: 14 days rolling. A legal hold suspends all deletion.

Deletion itself is logged as erasure proof, kept for 3 years.

5. Subprocessors

Hosting and infrastructure (EU region), Stripe (billing), Resend (email), Vonage (SMS), and a timestamping authority (RFC 3161 timestamps). Timestamps are not qualified; see the Trust section. An up-to-date list with data-processing agreements is available on request. No data is sold, ever.

6. International transfers

Data is hosted in the EU. Where a subprocessor operates outside the EEA, transfers rely on an adequacy decision or Standard Contractual Clauses.

7. Your rights

Access, rectification, erasure, restriction, portability, and objection, plus the right to withdraw consent and to lodge a complaint with the CNPD (Portugal, cnpd.pt) or your local authority. Exercise them from Settings → Your data, or by email. Statutory retention and legal holds may limit erasure — we will explain, not just refuse.

8. Where signer data comes from

If you sign a document (rather than send one), your name, email and phone number were provided to us by the sending customer, not collected from you (GDPR Art. 14). We use them solely to run the signing ceremony and its evidence, tell you this in the invitation itself, and never add you to any marketing list on that basis.

9. Providing data, and automated decisions

An account requires name, email and password — without them we cannot provide the service. Signers decide per invitation. We take no automated decisions with legal effect and do no profiling.

10. Changes to this policy

Material changes are announced actively (email or prominent in-app notice) at least 14 days before taking effect. Purely editorial fixes are versioned without notice. The version date above always shows the current edition.

11. Security

Encryption in transit and at rest, hashed credentials and codes, per-organization key separation, append-only audit logs, and single-use signing tokens. No system is impregnable; report issues to the contact above.