This policy explains what personal data Scriptia handles, why, and what rights you have. Scriptia is an electronic signature service at app.scriptia.eu, run from Portugal.
Who is responsible
For account data, the controller is José Nunes (Scriptia), Viana do Castelo (“Scriptia”, “we”). Contact: support@scriptia.eu.
For the documents you upload and the people you send them to, you are the controller, and Scriptia processes that data on your behalf only to provide the service.
What we collect
- Account data: your name, email address, a hashed password, and your settings.
- Documents: the files you upload, the fields you add, and the signed PDFs.
- Signer data: names, email addresses and signatures of the people who sign your documents.
- Audit data: when a document was sent, opened and signed, with IP address and browser type, kept as evidence of the signature.
- Technical data: server logs needed to keep the service secure.
We do not sell personal data, show advertising, or use tracking cookies. The only cookies are the ones needed to keep you signed in.
Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account and the signing service | Contract (Art. 6(1)(b)) |
| Audit trail as proof of signature | Legal obligations and legitimate interest (Art. 6(1)(c) and (f)) |
| Security, abuse prevention and the sign-up check | Legitimate interest (Art. 6(1)(f)) |
| Service emails (invitations, reminders, receipts) | Contract (Art. 6(1)(b)) |
Where the data lives and who helps us
| Provider | What for | Location |
|---|---|---|
| Oracle Cloud Infrastructure | Servers, database and file storage | Frankfurt, Germany |
| Brevo (Sendinblue SAS) | Sending service emails | France, EU |
| Cloudflare Turnstile | Checking that sign-ups come from a person | Global network, under EU data protection terms |
| Porkbun | Domain name and forwarding of support@ and hello@ email | United States, under Standard Contractual Clauses |
How long we keep it
- Account data: while your account exists, then deleted within 30 days of closing it.
- Documents and audit data: until you delete them or close your account. Encrypted backups are overwritten within 30 days.
- Server logs: up to 90 days.
Your rights
You can ask to access, correct, export or delete your data, or object to how we use it, by writing to support@scriptia.eu. We answer within one month. If you signed a document someone sent you, contact that sender first: they control that document.
You can also complain to the Portuguese data protection authority, the CNPD (cnpd.pt), or to the authority in your own EU country.
Security
All traffic uses HTTPS. Signed PDFs are sealed with a digital certificate. The database is backed up daily in encrypted form. Only the operator has access to the servers.
Changes
If this policy changes in a way that matters, we will tell account holders by email before it takes effect.