What this notice covers

This notice covers Portant for AI agents: the service at mcp.portant.co (the MCP server, the REST API, sign-in and API keys) and the signing pages at www.portant.co/sign/ for documents sent through it. Portant PTY Ltd ("we") is the controller of the personal data described here. Our privacy policy applies to everything else, and to anything this notice does not cover, including your rights under the GDPR and the CCPA.

What we collect, and why

Your account. Your email address, how you signed in (an assistant connection, an API key, or the email confirmation of your first document), your plan, the date you joined, the country and IP address you joined from, and the name of the assistant you use. We use these to sign you in, apply the plan limits, prevent abuse and give support.

Sign-in codes. We store a one-way hash of each code, never the code itself, with the IP address that asked for it, to sign you in and to limit sign-in attempts.

Documents. The document you or your assistant sends: text, a PDF, or a Google Doc shared by link. We read it once, in memory, to make the PDF, then encrypt it and store only the encrypted file. The key that opens it is in the private signing link and in the request token that your assistant keeps, not on our servers. When we email you the signed PDF, the key passes through our server once, in memory, and is not stored. On the Plus and Scale plans the signed PDF is an exception: so that you can download it from your account page at any time, we also store a copy encrypted with our service's own key, which means we can open it. You can delete it at any time.

Signer details. The signer's name and email address, which you give us, so that we can email them the signing link. They are stored inside the encrypted document, and in the request record so that your account page can list your requests. In the request record they are encrypted with our service's own key, which is separate from the key that opens the document. A request with several signers (Plus and Scale) holds each signer's name and email address, in signing order.

Saved templates (Plus and Scale). When you ask to save a document as a template, we keep it as you sent it, before any signer's name goes in: the text or the PDF, any field positions, its title and the name you give it. For a Google Doc we keep only its link, not a copy: each send exports the Doc again, so the signer gets it as it is at that time. When you rename a template or change its text, the new version replaces the old one. Unlike a sent document, a template is encrypted with our service's own key, not with a key in a signing link, so that you can send it again from a new chat. This means we can open a saved template. We open it only to send it again or to show it to you or your assistant.

The signing certificate. When a person signs, the signing page records the name and email address they type, their IP address and the time, and adds them to the signed PDF as a certificate page. This record is inside the encrypted file. With several signers, each signer's record travels inside the encrypted document to the next signer, so each later signer, and everyone who receives the signed PDF, can see the name, email address, IP address and signing time of the people who signed before them.

Request records. For each request: its ID, status and dates (sent, signed, cancelled and when the link expires), the document title, the signer's name and email address, the page count and file size, the language, the assistant name, whether we emailed the signer or gave you the link, a one-way hash of the sender's email address, the signer's email domain, the IP address the request came from, how many times the signing page was opened with the first and latest time, how many reminders we sent with the time of the latest email to the signer, and, with several signers, how many there are, whose turn it is and when each one signed. The title and the signer's name and email address are encrypted. We use these to show the status and your list of requests, apply the limits and prevent abuse.

When the signer opens the document. Each time the signing page opens a document, it tells us, and we add one to a count and store the time. The record holds only the count and the times, with nothing about who opened it: no name, email address, IP address or device. A reload in the same browser tab does not count again. Plus and Scale accounts can see the count and the latest time in their assistant and on their account page.

Usage analytics. Events such as "account created", "request created" and "signed PDF downloaded", with your account ID and no email address or document content. On the signing pages we record page views and signing steps only: no clicks, no session recordings, and never the part of the link that opens the document. The signing pages load no advertising or marketing scripts.

How long we keep it

  • Documents and signed PDFs: deleted automatically 14 days after we store them. Uploaded PDFs: deleted after 1 day.
  • On the Plus and Scale plans, a signed PDF is kept until you delete it, on your account page or with your API key. We keep it twice: encrypted with the key in the signing link, and encrypted with our service key so that you can download it from your account page. Deleting it removes every copy. If you move to the Free plan, stored copies stay until you delete them.
  • A webhook URL and its signing secret (Plus and Scale): kept until you remove them. The secret is stored encrypted with our service key. A webhook event holds the request ID, its status and times, never the document, its title or the signer.
  • Saved templates: kept until you delete them, in your assistant or on your account page. You can delete them on any plan.
  • Signing links: stop working after 14 days. A document sent without an account stops working after 48 hours if you do not confirm it.
  • Sign-in records, upload records, and requests that were never confirmed: deleted after 30 days.
  • IP addresses in account and request records: deleted after 30 days.
  • Your account and its request records, without IP addresses: kept while your account exists. Ask us and we delete them.
  • Emails we send: our email provider keeps delivery logs under its own retention settings.

Who receives it

  • Cloudflare hosts the service and stores the data.
  • Postmark sends our emails: sign-in codes, signing links and signed copies.
  • PostHog (EU region) receives the usage analytics described above.
  • Google: when you give a Google Doc link, we download the document from Google.
  • The signer receives the document you send them, with your name and email address and the name of the assistant you used (for example "sent from Claude with Portant"). When they reply to our email, the reply goes to you. With several signers, each one receives the document in turn, after the one before has signed, and when Portant emails the signers, each earlier signer also gets the signed PDF by email when the last one signs.
  • Your AI assistant. The company that provides your assistant (for example Anthropic or OpenAI) handles your conversation under its own privacy policy. Portant receives only what the assistant sends to our tools, and returns only the tool results.

We do not sell personal data, and we do not use your documents to train AI models.

Your choices

  • Cancel a request before it is signed: the signing link then stops working.
  • Delete a saved template in your assistant or on your account page at mcp.portant.co/keys.
  • Disconnect Portant in your assistant's settings. To stop an API key, create a new one at mcp.portant.co/keys; the old key stops working.
  • To delete your account and its data, email support@portant.co from your account's email address.
  • If someone sent you a document to sign, contact the sender about the document. To ask us about your data, email support@portant.co.

Contact and changes

Email support@portant.co with any question about this notice. When we change it, we update the date at the top of this page, and we tell account holders by email about any material change.