Skip to content
Sealbase

Privacy Policy

Last updated July 8, 2026

This Privacy Policy explains how Sam Fourie, trading as Sealbase (“we”, “us”, or “our”) collects, uses, shares, and protects personal information in connection with the Sealbase website and application (the “Service”). Sealbase is operated from Johannesburg, Gauteng, South Africa.

We take privacy seriously and aim to comply with the South African Protection of Personal Information Act, 2013 (POPIA), the EU General Data Protection Regulation (GDPR), and the UK GDPR, as applicable to you. If you have any questions, contact us at sam@sealbase.app.

1. The two roles we play

Sealbase is a tool that helps freelancers and studios (our “Users”) create and send quotes, proposals, and invoices to their own clients. This means we handle personal information in two distinct roles:

  • As a controller. For information about our Users (for example, the account holder's name, email address, business details, and how they use the Service), we decide how and why that information is processed. This Policy governs that processing.
  • As a processor (operator). For the content Users put into the Service about their own clients and recipients (for example, a client's name and email on a proposal), the User is the controller and we act on the User's behalf. We only process that content to provide the Service, and Users are responsible for having a lawful basis to enter it. A data processing agreement is available to Users who need one.

2. Information we collect

Information you provide

  • Account information: your name and email address when you register and sign in (managed through our authentication provider).
  • Business and payout details: your business name, logo, brand colour, tax settings, and any bank or payout details you add so that your clients can pay you by bank transfer.
  • Content you create: the quotes, proposals, invoices, line items, notes, and customer records you add to the Service, including information about your own clients and recipients.
  • Communications: the contents of messages you send us (for example, support requests).

Information we collect automatically

  • Usage and device data: your IP address, browser and device type, pages viewed, and similar analytics collected to keep the Service secure and to understand how it is used.
  • Cookies: a strictly necessary session cookie that keeps you signed in. We do not use advertising or cross-site tracking cookies. See “Cookies and analytics” below.

Payment information

  • Your subscription payments are processed by our reseller and merchant of record, Paddle (Paddle.com Market Limited). Paddle collects and processes your billing details and card information directly under its own privacy policy. We do not receive or store your full card number.
  • Payments from your clients to you (when you collect card payments on a hosted invoice) are processed through your own connected Stripe account. Your clients' card details are handled by Stripe, not by us; we never receive or store them. The API key you connect is encrypted at rest.

3. How we use information and our lawful bases

Where the GDPR or UK GDPR applies, we rely on the following lawful bases:

  • To provide the Service (create your account, authenticate you, store and render your documents, and send documents to the recipients you choose): performance of a contract with you.
  • To send service and transactional emails (sign-in, document delivery, receipts, important notices): performance of a contract and our legitimate interests.
  • To generate drafts with AI when you choose the “Draft with AI” feature: performance of a contract. The brief you submit is sent to our AI provider to produce your draft; it is not used to train AI models.
  • To secure, maintain, debug, and improve the Service and prevent abuse or fraud: our legitimate interests.
  • To take payment for subscriptions: performance of a contract (carried out through Paddle).
  • To comply with legal obligations (for example, tax and accounting records): legal obligation.
  • To send optional marketing, where we do so: your consent, which you may withdraw at any time.

Under POPIA, we process personal information on the corresponding grounds of contract performance, legal obligation, legitimate interests, and consent.

4. Cookies and analytics

We use a single strictly necessary cookie to maintain your signed-in session. We use Vercel Analytics to measure aggregate traffic and performance; it is designed to be privacy-friendly and does not build advertising profiles of you. We do not sell your personal information and we do not use it for cross-site advertising.

5. Service providers and sub-processors

We share personal information with a small number of trusted providers who process it on our behalf, only as needed to run the Service and under appropriate confidentiality and data protection terms:

  • Google Firebase: account authentication and session management.
  • MongoDB Atlas: hosting of application data (your account, documents, and customer records).
  • Vercel: application hosting and privacy-friendly analytics.
  • Resend: delivery of transactional email.
  • Anthropic: AI processing for the optional “Draft with AI” feature.
  • Paddle: subscription payment processing as our merchant of record.
  • Stripe: processing of payments made by your clients to you, through your own connected account.

We may also disclose information where required by law, to enforce our terms, or to protect the rights, safety, and property of Sealbase, our Users, or others. If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, and we will notify you of any change in control of your information.

6. International transfers

We operate from South Africa and our providers may process information in the United States, the European Union, the United Kingdom, and other countries. Where personal information is transferred across borders, we rely on appropriate safeguards, such as the European Commission and UK Standard Contractual Clauses or an adequacy decision where one applies, and we take reasonable steps to ensure your information remains protected.

7. Data retention

We keep personal information for as long as your account is active and as needed to provide the Service. After you close your account, we delete or anonymise your information within a reasonable period, except where we must retain it to comply with legal, tax, accounting, or dispute-resolution obligations. Residual copies may persist in backups for a limited time before they are overwritten.

8. Security

We use reasonable technical and organisational measures to protect personal information, including encryption in transit (TLS), encryption at rest for sensitive credentials such as connected payment keys, access controls, and secure session cookies. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights

Depending on where you live, you may have some or all of the following rights in respect of your personal information:

  • access to the information we hold about you;
  • correction of inaccurate or incomplete information;
  • deletion of your information;
  • restriction of, or objection to, certain processing;
  • portability of information you provided to us;
  • withdrawal of consent, where processing is based on consent; and
  • the right to lodge a complaint with a supervisory authority.

To exercise any of these rights, email us at sam@sealbase.app. We will respond within the time required by applicable law. If the information relates to a client of one of our Users (processed on that User's behalf), we will refer your request to the relevant User as the controller.

In South Africa, you may complain to the Information Regulator. In the EU or UK, you may complain to your local data protection authority (in the UK, the Information Commissioner's Office).

10. Children

The Service is intended for business use by adults and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, take reasonable steps to notify you. Your continued use of the Service after an update takes effect means you accept the revised Policy.

12. Contact us

For any privacy question or request, or to reach the person responsible for personal information at Sealbase, email sam@sealbase.app.