What you agree to
You confirm that you intend to sign the document, that you can bind yourself or the person you represent, and that the email you enter is yours. The one-time code shows control of that inbox at that moment.
What GustKit does
GustKit records the email, the consent version, the UTC time, the local time you send, the IP address, the browser, and the SHA-256 hashes. It then seals the PDF with a platform certificate. If a timestamp server answers, that time is embedded too. A later change breaks the seal.
What this signature is
This is an advanced-style electronic signature: email control, an explicit act, and a tamper-evident seal. In Brazil it is aimed at assinatura eletrônica avançada under Lei 14.063/2020, not at an ICP-Brasil qualified signature under MP 2.200-2/2001. In the US it is evidence for ESIGN and UETA, which look at intent and a retained record. In the EU it is evidence in the style of an advanced signature. It is not a qualified electronic signature. eIDAS advanced and qualified signatures need a key the signer alone controls, from a trust service. GustKit's key is a platform key.
Storage and retention
The PDF is not stored for a signature you apply alone, unless you tick the hold option. A request with other signers, and a signature made through the API, keeps an encrypted copy so the next person can sign and so you can download it. That copy is deleted after 72 hours by default (ESIGN_DOC_TTL_HOURS), or when the request is cancelled. Hashes and audit events are kept for 5 years by default (ESIGN_AUDIT_RETENTION_DAYS) so the verification page can still explain the signature. Write to [email protected] to ask for deletion.
No legal advice
GustKit does not decide whether a particular contract must use an ICP-Brasil or eIDAS qualified signature. Some acts (public deeds, some filings) need a qualified certificate. If you are unsure, ask a lawyer before relying on this seal.