Privacy
Privacy
What SecretSam processes, and what it does not.
Controller vs processor. You are the controller of personal data in document bodies and of the recipient names or ids you assign. SecretSam is the processor for watermarking, validation, billing, and account administration.
Account data. We process name, email, company name, and a password hash to run your workspace. Stripe holds payment method, address, and VAT details. We store Stripe customer and subscription ids, plan, and billing status.
API data. Generate and validate receive the text you send, plus userId or recipientName. Seals_issued stores tracking ids, not the document body. Usage counts are stored per tenant and calendar month. We send an email at 80% of monthly cap.
What we do not do. We do not scrape end-user identities from customer sites. We do not sell personal data. Live API keys are stored hashed. HMAC signing salts stay on the server.
Your rights. To access, correct, or delete workspace data, email privacy@secretsam.com. Retention follows the life of the account plus billing records required by law.