What this notice covers

This notice covers Portant for AI agents: the service at mcp.portant.co (the MCP server, the REST API, sign-in and API keys) and the signing pages at www.portant.co/sign/ for documents sent through it. Portant PTY Ltd ("we") is the controller of the personal data described here. Our privacy policy applies to everything else, and to anything this notice does not cover, including your rights under the GDPR and the CCPA.

What we collect, and why

Your account. Your email address, how you signed in (an assistant connection, an API key, or the email confirmation of your first document), your plan, the date you joined, the country and IP address you joined from, and the name of the assistant you use. We use these to sign you in, apply the plan limits, prevent abuse and give support.

Sign-in codes. We store a one-way hash of each code, never the code itself, with the IP address that asked for it, to sign you in and to limit sign-in attempts.

Documents. The document you or your assistant sends: text, a PDF, or a Google Doc shared by link. We read it once, in memory, to make the PDF, then encrypt it and store only the encrypted file. The key that opens it is in the private signing link and in the request token that your assistant keeps, not on our servers. When we email you the signed PDF, the key passes through our server once, in memory, and is not stored.

Signer details. The signer's name and email address, which you give us, so that we can email them the signing link. They are stored inside the encrypted document. Our request record keeps only the domain of the signer's email address.

The signing certificate. When a person signs, the signing page records the name and email address they type, their IP address and the time, and adds them to the signed PDF as a certificate page. This record is inside the encrypted file.

Request records. For each request: its ID, status and dates, the page count and file size, the language, the assistant name, a one-way hash of the sender's email address, the signer's email domain, and the IP address the request came from. We use these to show the status, apply the limits and prevent abuse.

Usage analytics. Events such as "account created", "request created" and "signed PDF downloaded", with your account ID and no email address or document content. On the signing pages we record page views and signing steps only: no clicks, no session recordings, and never the part of the link that opens the document. The signing pages load no advertising or marketing scripts.

How long we keep it

  • Documents and signed PDFs: deleted automatically 14 days after we store them. Uploaded PDFs: deleted after 1 day.
  • Signing links: stop working after 14 days. A document sent without an account stops working after 48 hours if you do not confirm it.
  • Sign-in records, upload records, and requests that were never confirmed: deleted after 30 days.
  • IP addresses in account and request records: deleted after 30 days.
  • Your account and its request records, without IP addresses: kept while your account exists. Ask us and we delete them.
  • Emails we send: our email provider keeps delivery logs under its own retention settings.

Who receives it

  • Cloudflare hosts the service and stores the data.
  • Postmark sends our emails: sign-in codes, signing links and signed copies.
  • PostHog (EU region) receives the usage analytics described above.
  • Google: when you give a Google Doc link, we download the document from Google.
  • Stripe handles payment if you buy a paid plan.
  • The signer receives the document you send them. When they reply to our email, the reply goes to you.
  • Your AI assistant. The company that provides your assistant (for example Anthropic or OpenAI) handles your conversation under its own privacy policy. Portant receives only what the assistant sends to our tools, and returns only the tool results.

We do not sell personal data, and we do not use your documents to train AI models.

Your choices

  • Cancel a request before it is signed: the signing link then stops working.
  • Disconnect Portant in your assistant's settings. To stop an API key, create a new one at mcp.portant.co/keys; the old key stops working.
  • To delete your account and its data, email support@portant.co from your account's email address.
  • If someone sent you a document to sign, contact the sender about the document. To ask us about your data, email support@portant.co.

Contact and changes

Email support@portant.co with any question about this notice. When we change it, we update the date at the top of this page, and we tell account holders by email about any material change.