Privacy Policy

This is a courtesy translation. The binding version of this Policy is the Portuguese one, available at verumsign.com.br/privacidade. In case of divergence, the Portuguese text prevails.

This Policy explains how Verum Sign handles personal data. The controller is MMBX Software e Sistemas Ltda., CNPJ 69.677.745/0001-96, which operates the platform. We follow Brazilian Law 13.709/2018 (LGPD).

1. Two different roles

It matters to separate two situations, because the rules differ:

• When you hire Verum Sign, we are the controller of your registration and usage data.
• When you send a document for someone to sign, you are the controller of that signer's data and we are the processor: we handle it following your instruction and what the law requires.

2. What data we handle

• Registration: name, company name, tax ID, e-mail, phone and address.
• Platform usage: date and time of access, IP address, browser, pages visited and actions taken.
• Documents: the files you send and their metadata.
• Signature evidence: the signer's name, e-mail and/or phone, IP, connection provider, approximate city, location where the signer allows it, official date and time of each step, and the result of the code check.
• Billing: the data needed to issue an invoice and record payment.

3. Why we handle it

• Performance of the contract — providing the service, collecting signatures, sealing and delivering documents.
• Legal obligation — keeping access logs for the period required by the Brazilian Internet Civil Framework and meeting tax obligations.
• Legitimate interest — platform security, fraud prevention and service improvement.
• Consent — site measurement through non-essential cookies and, where applicable, the geolocation a signer provides when signing.

Signature evidence is processed to perform the contract and to constitute proof — that collection is precisely what gives the document its validity. For that reason it cannot be switched off on a document you have already chosen to sign.

4. Who we share it with

We do not sell personal data and we do not pass it to third-party advertising. We share only what is necessary with:

• the cloud infrastructure provider, for hosting and storage;
• the e-mail and messaging provider, to deliver links and codes;
• the certification authority and timestamp service, to seal documents;
• public authorities, where there is a legal or judicial order.

5. Where it is kept and for how long

Data is stored in Brazil. We keep documents and their trails while the account is active. After closure we make the full export available and delete the data permanently, except for records the law requires us to keep — such as access logs and tax documents.

6. Security

We use encrypted connections for all traffic, per-account data isolation, role-based access control, hash-chained audit logging and backups. Internal access to data is restricted to what is needed to operate and support the service.

7. Your rights

You may request confirmation of processing, access, correction, anonymisation, portability, information on sharing and, where applicable, deletion or withdrawal of consent. We respond within 15 days.

If you are a signer and wish to exercise rights over your data, speak first to the company that sent you the document — it controls that processing. We can mediate where necessary.

8. Cookies

On the site we use essential cookies, which need no consent, and measurement and advertising cookies, which are only switched on if you accept. You may change your choice at any time by clearing the site data in your browser.

9. Data protection officer

To exercise rights or ask about privacy: [email protected].

10. Changes

Material changes to this Policy are announced by e-mail and on the platform at least 30 days in advance.