Sealpost Privacy Notice
Effective date: set at launch Controller / operator: DigiMar Inc, 2079 Global Ct, Sarasota, FL 34240. Privacy questions and rights requests: privacy@sealpost.app.
1. Who this covers
Three kinds of people read this page, and we collect different things from each.
| You are | We call you | Our role |
|---|---|---|
| Visiting sealpost.app, or filling in the early-access form | a visitor | controller |
| Holding a Sealpost account or API key | a customer | controller of your account data |
| Signing a document someone sent you through Sealpost | a signer | processor, on the sender’s instructions; the sender is the controller |
If you are a signer and want to know why a document was sent to you, ask the person or company that sent it. We can tell you who that was.
2. The website (visitors)
Early-access form. We collect what you type: name, email address, company (optional), what you are building, how many envelopes a month you expect, and which languages or tools you will call us from (optional). We also record the time you sent it and your IP address, which we use to limit abuse of the form. We use the form to decide who gets early access, to create your account when it opens, and to email you about it. We do not add you to any other list. The form data is stored in our AWS account. Our team gets an email saying a request arrived, with the volume you chose and nothing that identifies you. When self-serve signup exists, the early-access list becomes the account list and this notice’s customer section applies.
Analytics. The site uses Google Analytics 4 to count visits and see which pages are read. It is loaded with Google Consent Mode v2:
- Outside the United States, analytics storage is off until you choose “Allow” on the banner. Until then Google receives only cookieless pings: no cookie and no client identifier, though like any web request they carry your IP address and browser details.
- In the United States, analytics runs without a banner. The cookie page says why.
- No advertising features, no Google Signals, no remarketing, no ad cookies. We do not sell or share this data for advertising.
Server logs. Our content delivery network keeps request logs (IP, user agent, page, time) for 30 days to detect abuse and debug outages.
3. Customers
What we collect. Your name, email, company, password hash and two-factor secret; the card and billing address you give Stripe (we see the last four digits and the expiry, never the full number); your API keys; a log of your API requests for 90 days (method, path, status, timing, request id; never request or response bodies, secrets or document content); your usage and invoices; webhook endpoints and delivery logs; and support email you send us.
Why. To run your account, bill you, answer support, keep the service secure, and tell you about changes that affect your account. Legal basis where one is required: performance of our contract with you, and our legitimate interest in keeping the service secure and billed correctly.
Marketing. We email customers about service changes, price changes and incidents. We do not send marketing email unless you ask for it, and every such email has an unsubscribe link.
4. Signers
When you sign a document through Sealpost, the sender has asked us to record enough to show that you, and not someone else, signed it. This is what the record holds.
| Data | When | Why |
|---|---|---|
| Name and email address, or phone number | given by the sender | to deliver the signing link and address you |
| IP address and approximate location from it (city, region, country) | every event: link opened, disclosure accepted, each field signed, finished, declined | attribution of the signature |
| Browser and device (user agent) | same | same |
| Timestamps (UTC, shown in the sender’s timezone on the certificate) | same | same |
| The signature image you drew, typed or uploaded, and any initials | when you sign | placed on the document |
| Values you type into fields | when you sign | part of the document |
| Your acceptance of the e-signature disclosure and its version | before the document opens | consent record |
| PIN, SMS code or email code attempts, and the phone number used for SMS | only if the sender turned authentication on | signer authentication |
| Your reason, if you decline | when you decline | sent to the sender |
The finished PDF, the certificate page and the audit record contain this data and go to the sender and to you. We do not use signer data for anything else. We never sell it, and we do not use it to contact you except to deliver the document and reminders the sender set.
No account needed. Signing creates no account, no password and no profile. The link you receive is single-use and expires 30 days after it is sent, or sooner once the document is finished or withdrawn.
5. How long we keep it
| Data | Kept for |
|---|---|
| Finished documents, certificates and audit records | the retention period the sender’s account sets: 7 years by default, settable from 1 to 10 years, enforced by a storage lock that the service cannot shorten once the document is sealed |
| Documents never finished (expired, declined, cancelled) | until the sender deletes them, then 30 days in trash, then purged |
| Test-mode documents | up to 90 days |
| API request log | 90 days |
| Webhook delivery log | 90 days |
| Early-access form entries | until the account is created, or 12 months, whichever is first |
| Customer account data | while the account is open, then 30 days for export, then deleted (invoices kept as long as tax law requires) |
| Website analytics (GA4) | 14 months, Google’s shortest setting |
| CDN and application logs | 30 days |
| Backups | 35 days, then overwritten |
Three kinds of deletion. A sender can trash and purge a document that was never finished (gone after 30 days). A person can ask for erasure (section 8): we replace their name, email, IP and signature image with placeholders in our database, but the signed PDF and its audit chain are kept as they are, because the record of who signed must stay intact for the retention period. When an account closes, the customer can still export its documents for 30 days, and then the customer’s access ends. Sealed documents stay stored, under their retention lock, until their retention periods end; until the account’s encryption key is destroyed they can still be decrypted, so a legal hold or court order can be met. When its retention periods have ended and nothing is on legal hold, the account’s encryption key is destroyed. Our key backups expire within 35 days of that, and from then on no copy still held in our storage can be read. Copies already downloaded by the sender or the signers are not affected.
A sealed document is not deleted early. Once a finished document is sealed, the storage lock holds it for the retention period the sender set. The service cannot shorten that lock, and neither can the sender or a deletion request. The lock is Amazon S3’s governance mode, which a separately permissioned AWS administrator can lift outside the service; we would do that only if the law required it, for example under a court order addressed to us. Short of that, the only thing that can happen to it before then is the pseudonymisation above. Senders choose the retention period knowing this. Keeping a signed record whole for its retention period is the basis we rely on when we decline to delete it: completing the transaction it records, defending legal claims, and keeping the integrity of a signed record (the exceptions in the California CCPA §1798.105(d) and, if it ever applies, GDPR Article 17(3)).
6. Who else sees it (subprocessors)
We run on these providers and no others. Each has a written contract with us that limits what it may do with the data.
| Provider | What it does | Where |
|---|---|---|
| Amazon Web Services | hosting, database, document storage, encryption keys, outgoing email (SES) | United States (us-east-1); a replica of sealed documents in a second US region is planned, and this table will say so when it exists |
| Stripe | billing for customers; never sees documents or signer data | United States |
| Telnyx | sends SMS authentication codes to signers when the sender turns that on; sees the phone number and the code | United States |
| Google (Analytics) | website visit counts only, as described in section 2; never sees service data | United States |
We will update this list before adding a provider that handles customer or signer data, and email customers 30 days before the change. Error-reporting and uptime tooling that could see request metadata will be added to this table before it is turned on.
We do not transfer signer or customer data outside the United States except when a signer or customer is outside it and the data travels to them.
7. Security
Documents are encrypted in transit and at rest with a separate encryption key per account. Finished documents are stored with a retention lock. Every account’s data is separated from every other account’s at the database level. Application logs never contain document content, signer personal data or signing links. The security page has the full description.
If something goes wrong. If we learn of a breach involving your personal data, we tell affected customers within 72 hours of confirming it, and affected individuals within 30 days of determining the breach, as Florida law requires (Fla. Stat. §501.171), or sooner where another law sets a shorter period. For signer data we notify the sender, who notifies you, and we notify you directly where the law asks us to.
8. Your rights
Depending on where you live, you may have the right to see the personal data we hold about you, correct it, have it deleted, get a copy, object to or restrict how we use it, or withdraw consent. Write to privacy@sealpost.app from the address we hold for you, or include enough for us to find your record. We answer within 30 days. We do not charge for this and we do not treat you differently for asking.
If you are a signer, the sender controls your data and we will pass your request to them, and act on it ourselves where we can. Note the limit in section 5: a signed document stays whole for its retention period; we pseudonymise our database copy of your identity instead.
If you are in the European Economic Area, the United Kingdom or Switzerland and are unhappy with our answer, you can complain to your data protection authority. We do not yet take customers in those regions; a signer there is covered by the sender’s obligations, and we help the sender meet them.
California and the other US state privacy laws. We do not sell personal information, do not share it for cross-context advertising, and do not profile anyone, so there is nothing to opt out of and no “Do Not Sell or Share” link. You have the rights above, you can use an authorised agent, and you can appeal our answer by replying to it; we respond to appeals within 45 days and tell you how to reach your state attorney general if you still disagree. We honour the Global Privacy Control signal from your browser by treating it as a request to turn analytics off, and the footer shows “Analytics off (browser signal)” when we have.
9. Children
Sealpost is for businesses and their customers. We do not knowingly collect data from anyone under 18 as a customer. A sender may send a document to a minor only where the law allows and with the parent or guardian’s involvement; that is the sender’s responsibility.
10. HIPAA
Sealpost is built to the HIPAA Security Rule standard for every account, whether or not the account handles health information. For accounts that do, we sign a business associate agreement before the first such document, and the account runs in HIPAA mode (field-level encryption, masked email subjects, minimum 7-year retention). Our hosting provider is covered by a business associate agreement with us. Without a signed agreement, an account must not send protected health information.
11. Changes
We may update this notice. Material changes are emailed to customers 30 days before they take effect and the date at the top changes. Earlier versions stay readable at the same address.
DigiMar Inc 2079 Global Ct, Sarasota, FL 34240 privacy@sealpost.app