Slovenská verzia

Privacy Policy – Autogram

effective from 21 October 2026

This policy describes how the Autogram desktop application for Windows, macOS and Linux, including the versions from Microsoft Store and Apple App Store, handles personal data. The processing of personal data is governed by Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. on the Protection of Personal Data.

1. Controller and contact

• Controller: Služby Slovensko.Digital, s.r.o.
• Registered office: Staré grunty 18, 841 04 Bratislava, Slovakia
• Company ID (IČO): 50881337
• Registration: Commercial Register of the Bratislava III Municipal Court, Section Sro, Insert No. 119763/B
• Data protection officer: zodpovednaosoba@slovensko.digital
• Support: podpora@slovensko.digital

2. In short

Autogram runs entirely on your computer. It never sends the documents you sign or verify, or the data from your certificates, to the controller. The application has no user accounts, contains no analytics, telemetry or advertising, and does not write activity logs to files. The controller therefore does not obtain any personal data about you when you use the application. The only exception is aggregate statistics and crash reports provided by the app stores (see section 6).

3. What is processed on your computer

• Documents are opened, displayed, signed and verified locally. A signed document is saved where you choose, or returned to the website or application that requested the signature (see section 5).
• Certificates and signing keys are read from your electronic ID card, another smart card or a token, using the drivers provided by its manufacturer. The private key never leaves the signing device. You enter your PIN when signing and the application does not store it.
• Settings (e.g. language, signature level, last used folder, last used signing device including its serial number, proxy server) are stored in your user profile on your computer. You can delete them by restoring the default settings in the application.
• A cache of trusted lists and certificate validation data is stored in the system's temporary folder.

The controller has no access to this data.

4. Connections to other services

To sign documents and verify signatures, Autogram connects to public third-party services. It does not send them the content of your documents. As with any connection over the internet, the other party sees your IP address and technical details of the connection. It processes this data as an independent controller under its own policy.

• EU trusted lists: the European Commission's list (ec.europa.eu) and the national trusted lists of the member states. They are downloaded when the application starts, so it can verify that certificates come from trusted providers.
• Certificate status checks: when verifying signatures and certificates, the application may query the certification authority that issued the certificate (OCSP services and certificate revocation lists, CRL). The request contains identification of the certificate being checked, such as its serial number.
• Timestamps: only if you enable them in the settings. The timestamp provider (by default Sectigo and the Belgian government service, or a server you configure) receives only a fingerprint (hash) of the signature, not the document itself.
• Electronic forms: when you sign forms of public authorities (e.g. slovensko.sk, the Commercial Register, the Financial Administration), the application downloads public form templates. Templates for Financial Administration forms are downloaded from a public storage of Slovensko.Digital in Amazon Web Services (EU, Frankfurt). The request contains only the form identifier, not its content.
• Update check: versions downloaded from our website check the latest version through GitHub (api.github.com, GitHub, Inc., USA) when they start. The versions from Microsoft Store and Apple App Store do not perform this check; they are updated by the respective app store.
• Proxy server: if you configure one in the settings, connections go through it.
• Links: if you click a link in the application (e.g. to download a new version or to the documentation), the website opens in your browser and its own policy applies.

5. Signing from websites and other applications

Websites and applications, such as government portals or the Autogram na štátnych weboch browser extension, can ask Autogram to sign a document. They do so through an autogram:// link or through a local interface that accepts requests only from your computer. The website then passes the document to Autogram on your computer and, after your confirmation, receives the signed document back. It can read the list of your signing certificates only with your explicit consent in the application.

The operator of such a website or application is responsible for the processing of data on its side. Slovensko.Digital is not involved in this communication. You can disable the local interface in the application settings.

6. App stores

Microsoft Store (Windows): if you installed Autogram from Microsoft Store, installation and updates are provided by Microsoft, which processes data under the Microsoft Privacy Statement. Microsoft provides us with aggregate statistics (e.g. number of installations and ratings) and technical crash reports, which we use only to fix errors.

Apple App Store (macOS): if you installed Autogram from Apple App Store, installation and updates are provided by Apple, which processes data under the Apple Privacy Policy. Apple provides us with aggregate statistics (e.g. number of downloads and ratings). If you allowed sharing analytics with app developers in your system settings, Apple also provides us with aggregate usage data and crash reports, which we use only to fix errors.

7. Communication with support

If you contact us by email, we process your email address, name and the content of your message, including attachments, in order to reply. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). We keep the communication only as long as needed to resolve your request.

8. Your rights

Under the GDPR, you have the right:

• to access your personal data (Art. 15),
• to have it rectified (Art. 16),
• to have it erased (Art. 17),
• to restrict its processing (Art. 18),
• to data portability (Art. 20),
• to object to processing based on legitimate interest (Art. 21),
• to lodge a complaint with a supervisory authority (Art. 77).

As the application does not send us personal data, these rights mainly concern communication with support. You can exercise them at zodpovednaosoba@slovensko.digital, and we will reply within one month.

Supervisory authority: Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava 27, Slovakia, dataprotection.gov.sk

9. Open source

Autogram is an open-source application. Its source code is publicly available on GitHub, so anyone can verify how it handles data.

10. Changes to this policy

We may update this policy, for example when the application's features change. We publish the current version on this page together with its effective date.