Asignu Privacy Policy

Devix Portugal, Lda operates the Asignu Platform at app.asignu.com and the marketing website at asignu.com. Our registered office is Rua Comissão de Iniciativa, 2A 6.º Escritório 603, Edifício Torre Brasil, 2410-098 Leiria, Portugal, NIF 518796345.

Based on our current size (approximately five customers) and processing activities, we do not meet the GDPR Article 37 threshold requiring appointment of a mandatory Data Protection Officer. We have documented this assessment internally and will revisit it if we exceed approximately 100 customers, or begin large-scale or sensitive-category data processing.

This Policy applies to personal data processed through the Asignu Platform, including data relating to:

• Customers - natural or legal persons with an Account
• Users - individuals acting on behalf of a Customer
• Signers - individuals who sign Documents, whether or not they hold an Account
• Visitors to our public website (asignu.com)

3.1 Account and registration data

• Name and surname
• Email address and/or telephone number
• Employer / organisation name and position (for Business Accounts)
• Account credentials - passwords are stored hashed, never in plain text

3.2 Signing process data

• Signer name, email address, and/or telephone number
• Authentication method used (Basic link, Email OTP, SMS OTP, 2FA, or Government/Bank ID via eID Easy)
• IP address and browser/device information (user agent string) at each action in the audit trail
• Timestamps of each action - viewed, verified, signed, rejected
• Document content and metadata (file hashes, Document UUID, signer reference UUID)

3.3 Payment data

• Billing name, address and payment details - processed by Stripe; we do not store full card numbers

3.4 Website usage data (cookies and tracking)

Our marketing website (asignu.com) - separate from the Asignu Platform application itself - uses the following non-essential cookies and tracking technologies:

• Google Analytics - website usage analytics
• Meta Pixel - advertising performance tracking for Meta (Facebook/Instagram) Ads
• Google Ads pixel - advertising performance tracking for Google Ads
• Howuku - heatmap and session-recording analytics

We are currently reviewing and upgrading our cookie consent mechanism so that these non-essential tools only load after you actively consent, and will update this section once that is confirmed. You can manage cookie preferences via the cookie settings link in the website footer.

3.5 AI-assisted features

We use a self-hosted AI model (Qwen), running on our own infrastructure, to power the following optional in-app features. No Document content or personal data is sent to any third-party AI provider - all processing happens on our own servers and is secured via API key.

Document summary and Q&A

During signing or approval, the AI generates a summary of the Document and can answer questions about its content. The feature displays a disclaimer that it is AI-generated and may contain mistakes.

Signature field detection

Automatically detects and places signature fields on an uploaded Document.

Template variable detection

Automatically detects variable fields within a Document template.

In-app support chatbot

Answers user questions about how the Asignu Platform works. It does not process Document content, only the user’s support query.

These features use the data described in Sections 3.1–3.2 for the additional purpose of assisting the signing workflow. No new categories of personal data are collected, and no data is shared with external AI providers. Document summaries and related AI outputs are cached until the associated Document is completed, or for a maximum of 24 hours, whichever occurs first; the cached content is then deleted.

We retain an operational record of the AI feature used and the relevant Document identifier for 90 days, after which it is automatically deleted. This log does not contain Document content, prompts or generated output, and is accessible only in our office via a dedicated, access-controlled workstation. AI features assist Users and do not make decisions about whether a person should sign a Document. Users remain responsible for reviewing the original Document and any AI-generated output.

We share personal data with the following categories of recipients:

• Sub-processors engaged to provide the Platform (see the table below)
• Professional advisors - accountants, auditors, legal counsel - where necessary
• Public authorities, where required by law

Current list of sub-processors. This mirrors Annex 1 of our Terms & Conditions and is kept in sync so Customers only need to check one place.

Where a provider or its authorised personnel process personal data outside the EEA, we rely on an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where required.

Sectigo (United Kingdom)

Covered by the European Commission’s UK adequacy decision, renewed 19 December 2025 and valid until 27 December 2031 - no additional safeguard required.

Stripe and Twilio

Both are certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), and additionally rely on Standard Contractual Clauses as a backup transfer mechanism via their EU-based affiliates (Stripe Payments Europe Ltd., Twilio Ireland Limited). Consistent with each provider’s own published policies, personnel outside the EEA - including support staff under a follow-the-sun model - may access data as part of the ordinary provision of these services; this is disclosed by each provider and covered by the transfer mechanisms above.

Completed Documents and their audit trails are retained for as long as the associated Account remains active (see Article 13 of our Terms & Conditions), reflecting their ongoing evidentiary value in the event of a dispute over the underlying agreement. Once an Account closure becomes final, completed Documents and audit trails are deleted or anonymised within a defined period after closure - target 30 to 90 days - unless a longer period is required by law or separately agreed with the Customer.

If you instead ask us to erase your personal data directly - for example, by contacting support@asignu.com to exercise your GDPR erasure rights - rather than using the self-service account-closure flow, we will act on that request without undue delay and in any event within the statutory one-month period, regardless of the 14-day grace period.

Personal data is deleted or anonymised in our live systems within the periods described above. Backup copies used for disaster-recovery purposes are retained for a limited period as part of our normal backup rotation and are not separately purged on an individual request; we are working to move backups to a properly secured service and formalise a shorter rotation window.

Certain invoice, payment and transaction records may be retained for the period required by applicable tax or accounting obligations - 10 years under Portuguese law. Statistical information may be retained for longer only where it has been irreversibly anonymised.

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure, subject to our legal retention obligations
• Request restriction of processing
• Object to processing based on legitimate interest
• Receive personal data you have provided to us in a structured, commonly used and machine-readable format where the processing is based on consent or contract and is carried out by automated means, and request direct transmission to another controller where technically feasible
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with a supervisory authority - in Portugal, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt

We implement technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest where applicable, access controls, pseudonymisation where feasible, and regular testing of security measures, consistent with Article 12 of our Terms & Conditions and GDPR Article 32.

The Asignu Platform is intended for business and professional use and is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors.

We may update this Privacy Policy from time to time, in particular to reflect changes in our sub-processors, legal requirements, or platform functionality. Material changes will be communicated in accordance with Article 19 of our Terms & Conditions - at least 30 days’ notice before material changes take effect.