AssinaJá Privacy Policy
This is an English translation provided for convenience. The Portuguese version is the legally binding text and prevails in case of any discrepancy.
Version: 2.0
In force since: 10 October 2026
This Policy explains what personal data we process when you use the assinaja.pt website, the AssinaJá platform (web application, API, add-ins, extensions and applications) or when you receive a document to sign through it, for what purposes, on what legal basis, with whom we share it, how long we keep it and what rights you have.
1. Who the controller is
RMB Sistemas de Informação, Lda. ("RMB"), Tax ID (NIF) PT507175794, Rua das Hortas, 434, 4415-650 Lever, Vila Nova de Gaia, Portugal.
- Contact for privacy matters and for exercising your rights: [email protected] (subject "Proteção de Dados" — Data Protection).
2. When we are the controller and when we process data on behalf of a customer
- We are the controller for your account data, billing data, security and fraud prevention data, platform usage data, the communications we send you and the evidence that the law requires us to keep.
- We process data on behalf of our customer (we are a "processor") as regards the content of documents and the recipients' data that an organisation uploads or enters on the platform. In that case, the organisation that sent you the document is the controller and must inform you; we follow its instructions, under the Data Processing Agreement (Annex I to the Terms of Use).
3. What data we process, for what purpose and on what legal basis
3.1 Registered users
| Purpose | Data | Legal basis (GDPR, Art. 6(1)) |
|---|---|---|
| Creating and managing the account, authentication (including sign-in with Microsoft or Google) | First name, surname, email, language, password (encrypted), authentication provider identifiers | Performance of the contract — point (b) |
| Providing the service: uploading, preparing, sending, signing and archiving documents | Documents and their content, fields, saved handwritten signatures, data of the recipients you enter | Performance of the contract — point (b) |
| Signing with the Digital Mobile Key (Chave Móvel Digital, CMD), SCAP or your own certificate | Name, civil identification or tax number shown in the certificate, mobile phone number, public certificate and professional attributes | Performance of the contract — point (b) |
| Billing and payments | Organisation's name, email, Tax ID (NIF), address and telephone number; purchase history. Card details are processed directly by Stripe and never reach us | Legal obligation — point (c) and performance of the contract — point (b) |
| Mobile phone verification on the Free Plan and abuse prevention (including Cloudflare Turnstile) | Mobile phone number, verification code, IP address | Legitimate interest in preventing fraud and abuse — point (f) |
| Security, audit logs and incident investigation | IP address, user-agent, date and time of actions, technical identifiers | Legitimate interest in protecting the platform — point (f) |
| Operating and improving the platform on the basis of technical data | Usage data (timings, errors, features used, file type and size) — no document content | Legitimate interest — point (f) |
| Service management communications (security, billing, contractual changes, account notices) | Name, email, plan | Performance of the contract — point (b) |
| Marketing communications about paid plans and services and usage suggestions, based on account usage | Name, email, plan, aggregated account usage | For those who have never purchased: consent — point (a). For customers who have already purchased: legitimate interest in promoting similar services — point (f). You can opt out free of charge in each message |
| Audience measurement (Google Analytics) and storing in the browser the campaign through which you arrived | Cookie identifiers, pages visited, origin of the visit (campaign parameters) | Consent — point (a), given in the cookie banner |
| Recording on the account the campaign of the link you registered with (for example, "linkedin"), to measure the effectiveness of our campaigns | Campaign source, medium and name indicated in the registration link — nothing is stored in your browser for this purpose | Legitimate interest — point (f) |
| AI features you choose to use (document explanation, automatic editor) | Text of the selected document and the conversation | Performance of the contract — point (b), after acceptance of the feature's own terms |
| Searching by document content (when you enable it) | Text extracted from pages and thumbnails | Performance of the contract — point (b) |
| Improvement Programme (only if you join) | Documents you choose to share | Consent — point (a), revocable at any time |
| Proof of signatures and defence of rights | Signature evidence and audit logs | Legal obligation — point (c) and legitimate interest in the establishment, exercise or defence of legal claims — point (f) |
3.2 Signers and recipients without an account
If you have received a document to sign or view, we process your name, email, mobile phone number (when provided), identification number (when required by the signature method), IP address, user-agent, the date and time of each action, the consent you gave when signing and your signature.
This data was provided to us by the person or organisation that sent you the document, which is the controller for its processing. We use it to send you the document, authenticate you, collect the signature and generate the evidence and the completion report that prove the signature. The evidence is kept as set out in section 6.
3.3 Website visitors
We process the technical data needed to show you the website (IP address, device type and browser) and, only with your consent, audience measurement and campaign data. If you contact us, we process the data you send us in order to respond to your request (legitimate interest or pre-contractual steps).
3.4 Mandatory data
Data marked as mandatory at registration, at purchase or in the chosen signature method is necessary to enter into and perform the contract or to comply with legal obligations; without it, the requested service cannot be provided. All other data is optional.
3.5 What we do not do
- We do not sell personal data.
- We do not use the content of your documents for advertising or to train artificial intelligence models, unless you join the Improvement Programme.
- We do not take decisions based solely on automated processing that produce legal effects concerning you. Automatic security limits (for example, a maximum number of verification attempts) may temporarily block an operation; you can always contact us for human review.
4. Who we share data with
We share data only with those who need it to provide the service, comply with the law or defend rights:
- Recipients and signers of a document, to the extent defined by whoever sent it.
- Service providers (processors), bound by contract to confidentiality and security:
| Provider | Service | Data location |
|---|---|---|
| Microsoft Azure | Hosting, database, file storage, queues, monitoring, key management | European Union (Netherlands and France) |
| Cloudflare | Content delivery network, protection against attacks, anti-abuse verification (Turnstile) | Global network; headquartered in the USA |
| Agência para a Modernização Administrativa (AMA) | Digital Mobile Key and SCAP | Portugal |
| Qualified time-stamp providers: Sectigo (Europe) S.L., IZENPE, BOSA and BalTstamp | Qualified time stamps (they receive only the cryptographic digest of the document, never the document or personal data) | European Union (Spain, Belgium and Lithuania) |
| ZeptoMail (Zoho) | Sending emails | Data centre in the European Union |
| Clickatell | Sending SMS | European Union (Ireland, Amazon Web Services infrastructure); headquartered in the USA |
| Stripe | Payments | EU and USA |
| InvoiceXpress | Issuing invoices | European Union (Ireland) |
| Audience measurement (only with consent) and Google authentication | USA | |
| Microsoft | Microsoft authentication | EU and USA |
| Anthropic | AI features, only when you use them (does not use the content to train models) | USA (storage); processing may take place in other regions |
- Public authorities, courts and regulatory bodies, where required by law or for the defence of rights.
- Acquirer or successor of the business, in the event of a merger or transfer, with the same safeguards.
Technical application logs are also stored on RMB's own servers, with restricted access.
5. Transfers outside the European Economic Area
Some providers are headquartered or have infrastructure outside the European Economic Area, in particular in the USA. In those cases, the transfer is based on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework, for certified companies) or on standard contractual clauses approved by the Commission, with supplementary measures where necessary. You can ask us for a copy of the applicable safeguards.
6. How long we keep the data
| Data | Period |
|---|---|
| Account data | For as long as the account exists. When the account is deleted, the first name, surname, email, mobile phone number, identification number and saved signatures are deleted or anonymised immediately, except as indicated below |
| Documents | For as long as they are in the account. Deleted documents can be recovered for 15 days; after that period they are archived and, 30 days later, permanently deleted (the document and its files). Only the audit trail and the completion report are kept, as proof of the signature |
| Signature evidence, completion reports and audit logs | For as long as the document exists and, afterwards, for the limitation period of the rights they may prove |
| Billing data | For the legal retention period for tax documents |
| SMS or email verification codes | From minutes to 24 hours after they expire |
| Signing sessions (IP, user-agent) | 30 days |
| Technical and monitoring logs | Up to 90 days |
| Conversations with AI features | Not stored by AssinaJá: they remain only in your browser while the tab is open, and disappear when you close it. The AI provider may retain them temporarily, under its own policy, without using them to train models |
| Campaign attribution | In the browser, 30 days and only with consent; on the account, for as long as it exists |
| Accepted consents | For as long as the account exists and for the applicable limitation period, to prove acceptance |
| Documents shared in the Improvement Programme | Until you leave the Programme and for a maximum of 24 months |
7. Your rights
You may, at any time and free of charge:
- access your data and obtain a copy;
- rectify inaccurate data;
- erase your data, where it is not necessary for the purposes indicated or to comply with the law;
- restrict processing;
- receive your data in a structured format (portability), where the processing is based on contract or consent;
- object to processing based on legitimate interest, including follow-up communications;
- withdraw consent (measurement cookies, Improvement Programme), without affecting processing already carried out.
On the platform, under Settings, you can download your personal data, view the consents you have accepted and delete your account. For other requests, write to [email protected]. We respond within one month, extendable in the cases provided for by law. We may ask you to confirm your identity.
If you received a document from an organisation, requests about that document should be addressed to that organisation; if you contact us, we will forward the request.
You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority — www.cnpd.pt.
8. Cookies and browser storage
| Name | Purpose | Duration | Requires consent |
|---|---|---|---|
| Application session cookie | Keeping you signed in, at your request | Up to 150 days | No (essential) |
aj_sign_session |
Signing session for a document | End of session | No (essential) |
.AspNetCore.Culture |
Remembering the language | 1 year | No (functional) |
| Application local and session storage | Authentication, display preferences, shopping cart | Until the session ends or you clear the browser | No (essential/functional) |
assinaja-ga-consent |
Storing your cookie choice | Until you clear the browser | No |
aj_campaign (local storage) |
Remembering which campaign you came from | 30 days | Yes |
_ga, _ga_* (Google Analytics) |
Audience measurement | Up to 2 years | Yes |
| Cloudflare Turnstile | Distinguishing people from bots | Session | No (security) |
You can change your choice at any time through the "Cookie preferences" link in the footer.
9. Security
We apply technical and organisational measures appropriate to the risk, including encryption of communications (in transit), encryption of storage (at rest) by the hosting provider, role-based access control, audit logs, backups and separation of data between organisations. No system is completely invulnerable; in the event of a personal data breach that poses a risk, we will notify the CNPD and, where required, the affected data subjects.
10. Minimum age
The platform is intended for persons over 18 years of age with legal capacity to enter into contracts. Minors may only use it through their legal representatives.
11. Changes to this Policy
We may update this Policy. Material changes are communicated by email or on the platform before they take effect. The version in force is always available at assinaja.pt/privacy_policy.