This Privacy Policy explains how Sigeel (“Sigeel”, “we”, “us”) collects, uses, and protects personal data when you use the Sigeel API or visit sigeel.pages.dev.
| Data | Why | How long |
|---|---|---|
| Email address | To issue your API key, communicate about your subscription, and process refunds or support requests. | While your key is active, plus 12 months. |
| SHA-256 hash of your API key and recovery token | To authenticate requests. We never store the plaintext key or recovery token. | While your key is active. |
| Monthly usage counter (number of screenings) | To enforce your quota and calculate overage. | 24 months (for billing reconciliation). |
| Hashed IP address (salted SHA-256) | To rate-limit free-key signups and prevent abuse. The raw IP is never stored. | 30 days. |
| Payment metadata (plan, invoice ID, subscription ID) | To reconcile payments and handle refunds. Card details are processed by Paddle and never reach Sigeel. | As required by tax and accounting law. |
We do not store the names you submit to /screen.
Screening queries are processed in memory and discarded. We do not build a
query history, and we do not use submitted names for training, analytics, or any
secondary purpose.
We do not collect your card number, CVV, or billing address. Those are collected directly by Paddle when you pay by card, or by NOWPayments when you pay in crypto.
Where GDPR applies, we rely on:
We share limited data with the following service providers:
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Database (API keys, usage counters) | Email, hashed keys, usage counts |
| Render | API hosting | Processes requests in memory |
| Cloudflare | CDN, static hosting, Turnstile bot protection | IP address, browser signals |
| Paddle | Merchant of Record for fiat payments | Email, billing details, tax information |
| NOWPayments | Crypto payment processing | Email, payment metadata |
Each provider is bound by its own data-processing terms. Paddle and NOWPayments act as independent controllers for the payment data they collect; their privacy policies apply to that data.
Our providers may process data outside your country, including in the United States and the European Union. Where required, transfers rely on Standard Contractual Clauses or an equivalent safeguard offered by the provider.
Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. To exercise a right, email sigeelapi@gmail.com. We respond within 30 days.
You can delete your API key at any time by using your recovery token to rotate it, which revokes the old key. To request deletion of your email and usage records, contact us.
The Sigeel marketing site does not use advertising cookies. Cloudflare Turnstile may set a functional cookie to distinguish humans from bots during signup. The API itself does not use cookies.
API keys and recovery tokens are stored only as SHA-256 hashes. Traffic to the API is encrypted with TLS. Responses are signed with Ed25519 so customers can verify integrity. No system is perfectly secure; if you discover a vulnerability, please report it to sigeelapi@gmail.com.
Sigeel is a business tool and is not directed at children under 16. We do not knowingly collect data from children.
We may update this policy. Material changes will be announced on this page with a new effective date.
Privacy questions: sigeelapi@gmail.com. General support: sigeelapi@gmail.com.