This policy describes how SealScribe handles personal data of site visitors, registered users, and client companies, in compliance with Brazilian Law No. 13,709/2018 (General Data Protection Law — LGPD). For the processing of documents and data submitted by already-registered client companies, our Data Processing Agreement (DPA), accepted in the portal, also applies — this policy covers general processing, including what happens before you even create an account.
What data we collect
- Registration data: company name, tax ID (optional), corporate e-mail, and password (stored hashed, never in plain text).
- Usage data: orders created, options chosen, translation pipeline events (no document content in log records).
- Submitted documents: source files and delivered translations, treated as confidential and covered by your company’s NDA/DPA.
- Contract acceptance trail: date, document version, and IP address at the time you accept the NDA/DPA/Terms.
- Browsing data: aggregated site-usage metrics (see the Cookies section below) — we don’t collect browsing data outside our domain.
How and why we use your data
We use your data to: (i) create and maintain your account and authenticate your access; (ii) process the translation orders you place; (iii) keep the legally required contract-acceptance trail; (iv) comply with applicable legal and regulatory obligations. The legal basis is contract performance (LGPD art. 7, V) for registration and service delivery, and compliance with a legal obligation where applicable. We never use the content of your documents to train AI models.
Cookies and similar technologies
We use the minimum necessary: essential cookies for the site to work, plus measurement cookies that load only with your consent. No advertising cookies, no cross-site tracking, and no selling data to third parties:
| What | Type | Purpose |
|---|
| Session cookie (Supabase Auth) | Essential | Keeps you signed in across portal pages. The site doesn't work without it. |
| Consent preference (ss_consent) | Essential | Stores your choice about measurement cookies so we don't ask again. |
| Vercel Web Analytics | No cookie | Aggregated per-page visit counts, with no personal identifier or browsing profile. |
| Google Analytics 4 (_ga) | Measurement — consent only | Understand how the site is used (pages, traffic source, completed steps) to improve the product. Declining limits no functionality. |
| LinkedIn Insight Tag (li_*) | Measurement — consent only | Measure the results of our LinkedIn ads and build audiences for new ads. Declining limits no functionality. |
Measurement cookies (Google Analytics and LinkedIn) load only afteryou accept in the banner shown on your first visit: until you decide, no request is made to Google. Declining is as easy as accepting and limits no functionality. You can change your mind by clearing this site’s cookies in your browser, which brings the question back.
What is never sent to measurement:your document content, file names, the items identified during anonymization, your email, or any personal data. Portal URLs containing the order identifier are anonymized before being sent, and Google’s advertising and personalization features stay disabled.
Who we share data with
We only share data with providers acting on our behalf (processors, under the LGPD), under contract and with access limited to the purpose of the service:
- Supabase: database, authentication, and file storage, hosted in the São Paulo region (sa-east-1).
- Anthropic: translation API — receives only the text needed for translation, with sensitive identifiers anonymized beforehand, under a no-training clause.
- Vercel: site/application hosting and cookieless analytics.
We never sell personal data to third parties, under any circumstances.
How long we keep data
Client files (source documents and translations) are automatically deleted 60 days after upload. Registration data is kept while the account remains active; upon account closure, data is deleted or anonymized, except where the law requires longer retention (for example, tax obligations).
Your rights as a data subject
Under LGPD art. 18, you may request at any time:
- Confirmation that we process your data, and access to it.
- Correction of incomplete, inaccurate, or outdated data.
- Anonymization, blocking, or deletion of unnecessary data or data processed unlawfully.
- Portability of your data to another provider.
- Deletion of data processed with your consent.
- Information about who we share your data with.
- Withdrawal of consent, where applicable.
To exercise any of these rights, contact us at privacidade@sealscribe.com.br (address to be activated before the production launch).
Security
We adopt technical and organizational security measures, including access control, per-company data isolation (multi-tenant with Row Level Security), and encryption in transit. No client document is used to train AI models.
Changes to this policy
We may update this policy to reflect changes in the service or in the law. Material changes will be communicated by e-mail or a notice in the portal before they take effect.