Privacy Policy
This Privacy Policy explains how Eliran Azulay, an individual resident in Israel who operates the Seald service under the name "Seald" ("Seald", "we", "us"), collects, uses, discloses, and protects personal information when you visit seald.nromomentum.com or use the Seald e-signature service (the "Service"). Seald is offered only to users in the United States and Israel. This Policy is written for them and is not directed to people in the European Economic Area, the United Kingdom, or Switzerland.
1. Who we are
Seald is operated by Eliran Azulay, an individual resident in Israel, who is the controller (under Israel's Protection of Privacy Law, 5741-1981, the database controller) of personal information collected through the Site and the Service, except where Seald processes personal information on behalf of a customer organization, in which case Seald is a processor and the customer is the controller. The terms of that processor relationship are set out in our Data Processing Agreement.
- Privacy contact
- privacy@seald.nromomentum.com
- Postal address
- Seald (Eliran Azulay), Chlenov 24, Tel Aviv-Yafo 6604806, Israel
- Privacy protection officer
- Seald has not appointed a privacy protection officer. Seald is not one of the bodies required to appoint one under section 17B1 of the Protection of Privacy Law (as amended by Amendment 13). All privacy enquiries are handled by the operator at the address above.
2. Categories of personal information we collect
2.1 From you directly
- Identifiers — name, email address, optional phone number.
- Account credentials — authentication tokens and password hashes (Seald does not store plaintext passwords).
- Customer Content — PDF documents you upload, fields you place, recipients you invite, signatures you draw or type, and templates you save.
- Commercial information — when paid tiers are introduced, billing details (handled by our payment processor; Seald does not store full card numbers).
- Communications — emails, support tickets, and feedback you send us.
- Google Drive connection — if you connect Google Drive: your Google email address and account identifier, the access scope you granted, when you connected, last used and disconnected it, and a saved token that lets Seald reach the files you allow until you disconnect.
2.2 Automatically
- Internet and network activity — IP address, user-agent string, pages requested, timestamps, referrer.
- Audit-event metadata — for each envelope: viewed / consented / signed / declined / sealed events together with IP, user-agent, UTC timestamp, and SHA-256 document hashes.
- Cookies and similar technologies — see our Cookie Policy.
2.3 From third parties
- Trusted timestamp tokens issued by an RFC 3161 Time-Stamp Authority.
- Email-delivery telemetry from our transactional email provider (open, bounce, complaint signals — not message content).
2.4 Sensitive personal information (CCPA/CPRA § 1798.140(ae))
Seald does not intentionally collect Social Security numbers, driver's-license numbers, financial-account credentials, precise geolocation, racial or ethnic origin, religious beliefs, mail/email contents (other than transactional email metadata), genetic data, biometric identifiers used for unique identification, health, sex life or orientation, citizenship, or immigration status. A user may, however, choose to upload a document that contains such information; that content is treated as Customer Content and is not used for any purpose other than providing the Service. Drawn-signature images are not used for biometric identification; they are stored as visual marks attached to a sealed PDF.
3. Why we use your information
| Purpose | Why |
|---|---|
| Provide the Service (account creation, document handling, signing, sealing, audit trail) | To perform our agreement with you, or with the sender who invited you to sign |
| Send transactional emails (signing invitations, completion notices, account notifications) | To perform that agreement |
| Maintain security, prevent fraud and abuse, debug | To keep the Service and its users safe |
| Comply with legal obligations (e.g. responding to lawful requests from authorities) | Because the law requires it |
| Improve the Service through aggregated, non-identifying analytics | To improve the Service; the analytics beacon runs only if you accept it (see our Cookie Policy) |
| Send optional product or marketing email | Only with your prior consent. We do not currently send marketing email. |
You are not legally required to give us your information. Without it we cannot create an account for you or let you sign or send documents.
4. Recipients and sub-processors
We share personal information with service providers ("processors" / "service providers") who help us operate the Service. The current list, including where each provider processes data, is available at /legal/sub-processors. We do not sell personal information and we do not share it for cross-context behavioral advertising as those terms are defined under California's CPRA (Cal. Civ. Code § 1798.140(ad), (ah)).
We may disclose personal information to comply with a legally binding request from a public authority, to enforce our Terms, or to protect the rights, safety, or property of Seald or others. If the Service is transferred to a company formed to operate it, or to a buyer, personal information may be transferred to that successor, which will be bound by this Privacy Policy. We will notify you before such a transfer.
5. International transfers
Our database, object storage, and authentication services run on Supabase in the AWS eu-central-1 (Frankfurt) region. Our content delivery and DNS run on Cloudflare's global network. Our API and PDF conversion servers run on Amazon Web Services in the United States. Where we use AWS Key Management Service for document-sealing or token-wrapping keys, those keys are also held by AWS in the United States. Transactional email is sent through Resend, Inc., a U.S. company (see our Sub-processors list).
This means your information is stored in Germany (an EU member state) and processed in the United States. If you are in Israel, we transfer your information abroad in accordance with Israel's Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, and each provider has agreed in writing to protect it and not to pass it on except as we instruct. If you are in the United States, your information is stored outside the United States, in Germany.
Questions about international transfers can be sent to privacy@seald.nromomentum.com.
6. Retention
| Category | Retention period |
|---|---|
| Completed envelopes (sealed PDF, audit events, original PDF) | We don't currently delete completed records on a schedule, and we don't promise to keep them for any particular period. The sender is responsible for keeping any records it is required to keep. |
| Authentication and access logs | We don't promise to keep authentication or access logs for a particular period. |
| Account profile and contact data | Until you delete your account. Deletion takes effect immediately and can't be undone. Your login, contacts, templates, drafts and Google Drive connection data, including saved tokens, are deleted. Envelopes you've sent, and their audit records, are kept without a link to your account, and your email address is removed from the signer records where it appears. |
| Google Drive connection | Until you disconnect it or delete your account. When you disconnect, we ask Google to revoke our access and delete the saved token straight away. We keep the connected Google email address and the connection dates until you delete your account. |
| Support correspondence | We don't currently delete support correspondence on a schedule, and we don't promise to keep it for any particular period. |
7. Your rights — Israel
Under Israel's Protection of Privacy Law, 5741-1981, as amended by Amendment 13 (the "Privacy Law"), you have the following rights with respect to information about you held by Seald:
- Access (section 13) — to inspect the information about you that we hold, yourself or through a representative authorised in writing.
- Correction or deletion (section 14) — if the information is not correct, complete, clear or up to date, to ask us to correct or delete it. If we agree, we will make the change and notify anyone who received the information from us, as the regulations require. If we refuse, we will tell you.
- Removal from direct mailing (section 17F) — to ask in writing that your information be removed from any direct-mailing database. Seald does not currently use your information for direct mailing or sell it to others who do.
Where Seald holds information only on behalf of a customer (for example, a document a sender uploaded), we will tell you who the customer is and forward your request to them (section 13A).
To exercise these rights, email privacy@seald.nromomentum.com or use our privacy choices form. You may also write to Seald (Eliran Azulay), Chlenov 24, Tel Aviv-Yafo 6604806, Israel. We may need to verify your identity. We will let you inspect your information, or tell you why we refuse, within twenty-one (21) days of receiving your request. We will act on a request to correct or delete information, or tell you why we refuse, within thirty (30) days. These periods are no longer than those in the Privacy Protection (Conditions for Inspection of Data and Procedures for Appeal) Regulations, 5741-1981, and we do not extend them. Requests are free of charge.
If we refuse your request, you may appeal to the competent Magistrates' Court within thirty (30) days of our refusal. You may also complain to Israel's Privacy Protection Authority (הרשות להגנת הפרטיות) at ppa@justice.gov.il or through gov.il.
8. Your rights — California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey
Depending on your state of residence, you may have rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), the Colorado Privacy Act, the Connecticut Data Privacy Act, the Virginia Consumer Data Protection Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, the Oregon Consumer Privacy Act, the Montana Consumer Data Privacy Act, the Iowa Consumer Data Protection Act, the Delaware Personal Data Privacy Act, New Hampshire SB 255, and the New Jersey Data Privacy Act.
Seald does not currently meet the thresholds that make these laws apply to it; we nonetheless honour the requests below voluntarily.
- Right to know what categories and specific pieces of personal information we have collected, the sources, the purposes, and the recipients (CCPA § 1798.110, § 1798.115).
- Right to delete personal information we collected from you (CCPA § 1798.105).
- Right to correct inaccurate personal information (CCPA § 1798.106).
- Right to portability.
- Right to opt out of "sale" or "sharing" for cross-context behavioral advertising (CCPA § 1798.120). Seald does not sell personal information and does not share for cross-context behavioral advertising.
- Right to limit the use of sensitive personal information (CCPA § 1798.121). Seald does not use sensitive personal information for purposes that would require this election.
- Right to opt out of profiling with legal or similarly significant effects (CO/CT/VA/OR).
- Right of appeal if we deny a request (CO/CT/VA and others).
- Right to non-retaliation for exercising any of these rights.
To exercise these rights, use our privacy choices form or email privacy@seald.nromomentum.com. We will acknowledge within ten (10) business days and respond within twenty-one (21) days to a request to know or access your information and within thirty (30) days to any other request. If a request is genuinely complex, we may extend that period once, by up to forty-five (45) days, and will tell you why before the original period ends. Where Israeli law also applies, we follow its shorter deadlines without extension. We may verify your identity by matching the information in your request against the information in your account. An authorized agent must provide written permission from the consumer.
8.1 Global Privacy Control
Seald does not sell personal information or share it for cross-context behavioral advertising. We still honor the Global Privacy Control ("GPC") browser signal: if your browser sends GPC and you have not made a choice, we treat it as a rejection of our optional analytics beacon (see our Cookie Policy). A choice you make yourself through Manage cookie preferences stays in place until you change it.
8.2 12-month look-back
For California right-to-know requests we will report on the prior twelve (12) months of personal-information practices.
9. Security
We protect personal information with technical and organizational measures appropriate to the risk. Data is encrypted with TLS in transit between your device and our services, and between our servers and our database, file-storage and email providers. Documents, signatures and audit records are stored with our database and file-storage provider, which encrypts them at rest. Completed files include a PAdES seal when applied and an RFC 3161 timestamp when available. Audit events are chained with SHA-256 to make tampering detectable. No method of transmission or storage is perfectly secure.
Suspected security issues should be reported to privacy@seald.nromomentum.com.
10. Children
The Service is not intended for children under sixteen (16) and is not directed to children under thirteen (13). Seald does not knowingly collect personal information from a child under thirteen in violation of the U.S. Children's Online Privacy Protection Act ("COPPA", 15 U.S.C. § 6501 et seq.). If you believe a child has provided personal information to Seald, please contact privacy@seald.nromomentum.com and we will delete it.
12. Changes to this Policy
We will update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be communicated by email or in product at least thirty (30) days before they take effect.
13. Contact
- Privacy questions and rights requests
- privacy@seald.nromomentum.com
- Sub-processor change subscription
- privacy@seald.nromomentum.com
- Security
- privacy@seald.nromomentum.com