Privacy Policy

Last updated: May 17, 2026 · LGPD-aligned (Lei nº 13.709/2018)

1. Data controller

The data controller is André Cunha Antero de Carvalho, MEI, inscrito no CPF 108.150.687-35, registered at Rua Jaime Gomes, 638, Araguari - MG, CEP 38440-244, Brasil. Contact our DPO at [email protected].

2. Personal data we collect

We collect only data necessary to operate:

  • Account data: email, account ID, hashed credentials, workspace IDs.
  • Billing data: handled by a Merchant of Record (payment processor TBD). We store only subscription ID and tier status.
  • Signing artifacts: SHA-256 hash + Ed25519 signature. Original content NOT persisted unless opted in.
  • Session metadata: AI tool ID, model version, timestamps, IP (rate-limiting only).
  • Cookies: single session cookie. No third-party advertising cookies.

3. Legal basis (LGPD art. 7º)

  • Contract execution (V): account, subscription, signing services.
  • Legal obligation (II): tax records, fiscal reporting.
  • Legitimate interest (IX): security logging, fraud prevention.
  • Consent (I): newsletters, content-archive mode.

4. Purpose of processing

Provide signing/verification services, authenticate, bill, communicate operational notices, comply with law. We do NOT sell data. We do NOT train AI models on your data.

5. Your rights (LGPD art. 18)

Access, correct, anonymize/block/delete, port, receive info, revoke consent. Contact [email protected]. Response within 15 days.

6. Data sharing

  • Merchant of Record — billing (payment processor TBD)
  • Resend — transactional emails
  • Cloudflare — DNS, edge proxy, email routing
  • OpenTimestamps — receives only SHA-256 hashes (no personal data)

7. International transfer (art. 33)

Operators in US (Merchant of Record, Resend, Cloudflare). Transfer per LGPD art. 33 exceptions.

8. Data retention

  • Account: until deletion or 24 months inactivity.
  • Billing: 5 years (fiscal law).
  • Signatures: per tier (Free 7d, Pro 90d, Enterprise unlimited).
  • Security logs: 90 days.

9. Security

TLS in transit, AES-256 at rest, least-privilege access, audit logging, Ed25519+OTS signed releases. Breach notification within 72h per art. 48.

10. Children

Not directed at minors under 18. Contact [email protected] if a minor provided data.

11. Changes

Material changes notified via email and posted at seifprotocol.com/privacy.

12. Contact

DPO: [email protected] · Support: [email protected]

Complaints: ANPD.