Privacy Notice
The short version
- We never receive your documents. PDFs, CSV files, dates of birth, National Insurance numbers and passwords you use in Sealrift are processed only in your own browser. They are not uploaded, logged or stored by us.
- Because we never receive that content, we are neither a controller nor a processor of it. If you are an employer, bureau or accountant using Sealrift for your documents, you remain the controller of that data.
- The only personal data we handle is what is needed to sell and manage a paid subscription: Stripe billing data and your licence key.
- No accounts, no cookies, no analytics, no advertising, no third-party scripts or fonts.
Who we are
Sealrift is a trading name of Nikah AI Ltd ("we", "us"), a company registered in England and Wales (company number 17199968), registered office Office 1216, 60 Tottenham Court Road, London W1T 2EW. We are registered with the Information Commissioner's Office under registration number ZC176381. For anything about your data, email privacy@sealrift.com.
Documents you process with Sealrift
Sealrift runs as code inside your web browser (on sealrift.com or as a Chrome or Edge extension). The files you add, the CSV you load and the passwords Sealrift works out are held in your browser's memory and in background workers of the same page while you use it. They are never sent to us or to anyone else, and they are never written to your browser's storage. See How it works for the technical detail.
If you are using Sealrift for your organisation, you are responsible, as controller, for having a lawful basis to process the documents and for choosing and sharing passwords securely.
Personal data we do process
1. When you buy a subscription
Payment is handled by Stripe on Stripe's own checkout page. Stripe collects your name, email address, billing address, payment card details and country. We never see your card number. For Sealrift sales Stripe may act as the merchant of record (reseller) under Stripe Managed Payments, in which case Stripe (trading in the UK as Onelink) is responsible for charging any sales tax and is an independent controller of the payment data it collects under Stripe's privacy policy.
From Stripe we receive, and keep in our licence database: your Stripe customer ID, subscription ID and checkout session ID; your plan and billing period; the subscription status, renewal date and whether it is set to cancel. We also create a random licence ID. We do not store your name, email address, postal address or IP address in our database.
2. Your licence key
A licence key contains your licence ID, plan, billing period, the dates it was issued and expires, and a digital signature. It contains no name, email address or other identifier. It is shown on the page after payment and saved in your browser's local storage when you enter it in the app.
3. The licence check (web version only)
With a paid licence, the web app sends your licence key to sealrift.com about once or twice a day to get an updated key. The browser extension never does this.
4. Recovering a key and managing your subscription
On the Recover page you can give the email address you paid with and the receipt or invoice number from your Stripe receipt, or the checkout reference from your success page. On the Manage page you give your licence key and the email address you paid with. We use these once, to find the matching record through Stripe's API and check they match. We do not store or log them. To stop people guessing, the Recover page also keeps a salted one-way hash of the email address entered, in memory only, for at most one hour (see Technical data).
5. Technical data
Like any website, our server necessarily receives your IP address when your browser connects. For rate limiting (to stop people guessing keys or references), we keep a salted one-way hash of it in memory only, for at most one hour; it is never written to disk. Our server's request log records only the time, the request method, the page or API path (without any query string), the response status and how long it took. It does not record IP addresses, licence keys or email addresses. The web server in front of our service is configured not to keep access logs for Sealrift.
6. Email to us
If you email support@sealrift.com or privacy@sealrift.com, we use your email address and message to reply.
Why we use it (lawful bases)
| Purpose | Data | Lawful basis (UK GDPR) |
|---|---|---|
| Selling you a subscription, issuing and renewing your licence, recovery and the billing portal | Stripe IDs, plan and status, licence ID and key; email and receipt number when you recover a key | Contract (Article 6(1)(b)) |
| Keeping accounting and tax records | Payment records held by Stripe and in our accounts | Legal obligation (Article 6(1)(c)) |
| Protecting the service from abuse | Hashed IP address (and, on the Recover page, hashed email address) in memory, request log without IPs | Legitimate interests (Article 6(1)(f)): keeping the service secure and available |
| Answering your emails | Your email address and message | Legitimate interests (Article 6(1)(f)), or contract where it is about your subscription |
How long we keep it
- Licence database record: while your subscription is active, then deleted automatically 12 months after it ends (so we can answer questions and disputes about it).
- Stripe event IDs (used to avoid processing a payment notification twice): 30 days.
- Hashed IP addresses (and email addresses entered on the Recover page) for rate limiting: at most one hour, in memory only.
- Server request log (no personal data): kept in rotating files capped at 30 MB in total, after which the oldest entries are overwritten.
- Accounting records: six years from the end of the financial year they relate to, as UK tax law requires. Stripe keeps its own records under its policy.
- Support emails: 24 months after the conversation ends.
- Your licence key and saved templates in your browser: until you remove them (the app has a button for this) or clear your browser's site data.
Who we share it with
- Stripe (Stripe Payments UK Ltd, Stripe Payments Europe Ltd and Stripe, Inc.), for payments, invoices, receipts and the billing portal.
- Our hosting provider, OVH Ltd, whose servers for Sealrift are in the United Kingdom, as a processor that runs our licence server.
- Our email service providers, if you email us: Cloudflare, Inc., whose Cloudflare Email Routing service receives mail sent to our sealrift.com addresses and forwards it to us, acting as our processor; and Google, whose Gmail service is the mailbox where we read and answer it.
- Authorities, if the law requires it.
We do not sell personal data and do not use it for advertising.
International transfers
Stripe may process payment data in the United States. Stripe relies on the UK Extension to the EU-US Data Privacy Framework and on the UK International Data Transfer Addendum to protect it. If you email us, Cloudflare and Google may process your email in the United States; both are certified under the UK Extension to the EU-US Data Privacy Framework. Our own licence server is hosted in the United Kingdom.
Your rights
You have the right to ask for a copy of your personal data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable form. Email privacy@sealrift.com. We will reply within one month. Because our database holds only Stripe IDs and a licence ID, please include your licence key or the email address you paid with so we can find your record.
Deleting your licence record ends your ability to renew or recover your key; it does not cancel your subscription with Stripe (cancel that in the billing portal first).
If you are unhappy with how we have handled your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
Cookies and storage
We use no cookies. See our Cookie statement for the small amount of browser storage the app uses.
The browser extension
The Sealrift extension for Chrome and Edge collects no data at all. It needs no permissions to read websites, makes no network requests, and keeps your licence key and saved templates only in the extension's own storage on your computer.
Automated decisions and children
We make no automated decisions with legal or similarly significant effects. Sealrift is a business tool and is not intended for children.
Changes
If we change this notice we will update the date at the top. Material changes will be shown in the app before they take effect.