Privacy Policy — Assinatura Digital

Updated October 28, 2026.

Application and responsible organization

This policy explains how Assinatura Digital, identified in the Market as assinafy.assinafy, processes data in the managed service at bitrix24.assinafy.com.br. The service is operated by Assinafy Gestão de Documentos LTDA., CNPJ 44.890.439/0001-02, located at Av. Santos Dumont, 1665, Caixa Postal 570, Santa Bárbara, Criciúma/SC, CEP 88804-342, Brazil.

This document supplements the Assinafy Privacy Policy, which describes legal bases, retention criteria, suppliers, international transfers and the data protection contact. The customer determines the purpose and authorization for processing document and signer data; Assinafy processes it according to the customer's instructions and acts as controller for its own purposes described in that policy.

Integration data and purposes

The application processes identifiers for the Bitrix24 account, user, workspace and selected deals; names, emails and phone numbers of selected contacts, companies and external signers; signature methods and the CPF or CNPJ entered for digital certificates, or CPF for biometrics; files and template fields; document identifiers, signing links, request statuses and history. Contract management also processes the counterparty's name and CPF/CNPJ, value, currency, dates, periods and termination reason to maintain contract terms in Assinafy. Normalized results of these changes remain encrypted in local history until uninstall to prevent duplicate operations; disconnecting retains this history. The reason remains in Assinafy history and is not copied to the CRM timeline. The application also stores OAuth authorizations, the confirmed delivery-failure email, CRM output settings and automation presets. These data authenticate connections, prepare documents, request signatures and return results to the deal.

Bitrix24 supplies the data and files accessible to the user. Selected data and documents are sent to the authorized Assinafy workspace for signature. Depending on configuration, the application returns status, links, signed PDFs and certificate pages to configured deal fields and records progress in the timeline. Status is polled in the background while the connection remains active. An administrator-authorized automation rule can read a deal and its contacts and send a document without a new manual review, according to the saved preset. Data are also subject to the permissions and policies of the Bitrix24 account and Assinafy workspace.

Protection and technical records

PDFs are transferred between services and are not written to this integration service's disk. Images, liveness evidence and biometric consent are processed in Assinafy and are not received by this application. Tokens, webhook secrets and persisted integration record contents are encrypted; identifiers required for lookup and technical metadata are also stored. Provider credentials remain on the server. Signers use their A1/A3 certificate and password in Assinafy and must not send them to this application.

The application does not log request bodies, names, emails or tokens. Operational records of Bitrix24 calls contain the method, status, duration and error category. They are retained for at least 72 hours and removed by cleanup after that period, including after the application has been uninstalled.

In the managed service, technical failures are sent to Sentry with the version, operation, status and diagnostic codes. These reports do not include documents, credentials, request bodies or users' personal data. Performance tracing, sessions and browsing recordings remain disabled.

Disconnection, removal and retention

Disconnecting requests revocation of the Assinafy authorization, stops Assinafy access through that connection and retains local history and Bitrix24 settings. On receipt of an authenticated Bitrix24 uninstall event, the application deletes the Bitrix24 account's local bindings and history and requests revocation of its connections. Encrypted credentials needed for revocation remain queued until the authorization service confirms it. Operational records follow the retention period described above.

Removing the application does not delete documents or signers in Assinafy, or files, templates, field values or timeline entries in Bitrix24, and does not close those accounts. These data follow the respective services' rules and must be managed by an authorized user. Managed-service backups follow the Assinafy Privacy Policy's criteria and the service's retention cycles, including preservation obligations; deletion from the active database does not immediately remove every backup copy.

Rights and contact

To request confirmation of processing, access, correction, deletion, information about sharing or exercise other applicable rights, use the Assinafy contact form and identify the request as concerning the Bitrix24 application. Identity verification may be required, and when the customer is the controller, the request may be referred to the Bitrix24 account or Assinafy workspace administrator. Do not include passwords, tokens, certificates or document contents in the request.

This policy covers the Assinafy-managed service. A customer-hosted connector requires its operator's own policy, accessible to users and identifying the operator, contact information, purposes, retention conditions and backups.