Seedline Privacy Policy

1. Data controller

The person or company operating Seedline (getseedline.com) is the data controller. For any privacy question, write to privacy@getseedline.com.

2. Data we process

We only process what is needed to provide the service:

• Account data: e-mail address, name (optional), language, time zone, theme and notification preferences.
• Workspace data: products you add, communities you select, platform usernames and karma values, tasks, drafts, calendar and reports.
• Session and security data: session records, browser information (user agent), 2FA setting (the secret is stored encrypted), audit logs.
• Notification data: push subscription endpoints and delivery status.
• If tracking is on, aggregated records of clicks on short links (see below).

3. Data we don't collect

By design, Seedline never asks for or stores:

• Any platform's password, session cookie or 2FA code.
• Visitors' IP addresses in click tracking.
• Tracking data for advertising or profiling.
• Payment details (there are no payments in Phase 1).

4. Short-link tracking

Tracking is optional and off by default. When you turn it on, visitors who click the short links in your posts are redirected to your product's site and the click is counted.

The count is done in a way that doesn't identify people:

• No IP address is stored; unique visitors are counted with a one-way value (hash) computed with a salt that changes every day.
• No cookies or device identifiers are used.
• The country comes only from the country header added by the content delivery network (CDN); browser and referrer are kept at a coarse level.

5. Visitor analytics on our own site

To understand how Seedline is used, we count page views on our own pages (home page, sign-in, legal pages and the app) in aggregate, with the same privacy model as short-link tracking:

• No cookies, local storage or device identifiers are used for analytics, and no consent banner is needed.
• Your IP address and full browser string are never stored; unique visitors are counted with a one-way hash that uses a salt changing every day, so visits can't be linked across days.
• We keep only the page path (without query parameters), the referring site's domain, the country from the CDN header and a coarse device and browser type.
• Raw page-view records are deleted after 90 days; only daily totals are kept after that.

6. Cookies

We only use cookies that are strictly necessary for the service; there are no tracking or advertising cookies:

• sl_session: keeps you signed in (30 days, readable by the server only).
• sl_csrf: protection against forged requests.
• sl_theme, sl_locale, sl_tz: your theme, language and time zone preferences.
• sl_product: the product you last chose in the product switcher.

7. Why we process data

We process your data only for these purposes, based on performing our contract with you and our legitimate interests:

• Creating your account, signing you in and protecting your account.
• Finding communities, preparing tasks and drafts, building your calendar and reports.
• Sending the notifications you asked for by e-mail, push and in the app.
• Preventing abuse and audit-logging critical actions.

8. AI processing

For product analysis, community discovery and draft generation, your product information and community data are sent to an AI provider (Anthropic, Claude API). This is done only to provide the service.

Discovery only reads publicly available web pages. AI output is validated before it is stored and can't take any action in the system on your behalf.

9. Service providers

We don't sell your data. We work with these providers to run the service:

• Hosting and database: Amazon Web Services (EU region).
• E-mail delivery: Resend.
• AI: Anthropic.
• Push notifications: your browser's push service (Google, Apple, Mozilla, Microsoft).

10. Retention

We keep data only as long as needed:

• Account and workspace data: as long as your account is open.
• Raw click records: 13 months; daily aggregate tables indefinitely (they contain no personal data).
• When you delete your account: all workspace data is permanently deleted within 30 days.
• Backups: database backups expire automatically after 7 days.
• Site visitor analytics: raw page views 90 days; daily totals (no personal data) indefinitely.

11. Your rights

You have the right to access, correct and delete your data, to restrict or object to processing, and to receive your data in a portable format. In Settings → Data you can download all your data as JSON and delete your account.

For other requests, write to privacy@getseedline.com; we answer within 30 days at the latest. You also have the right to lodge a complaint with the data protection authority in your country.

12. Security

Sign-in links are single-use and stored as hashes; the 2FA secret is encrypted; connections are protected with HTTPS; sign-in endpoints are rate-limited and critical actions are audit-logged.

13. Country-specific information

Depending on where you use Seedline or promote your product, the following regulations may also apply. Because tracking stores no IP addresses and uses no cookies, it is designed not to require separate consent in most regions.

• EU/EEA – GDPR and ePrivacy: the rights above are your GDPR rights; the legal bases are performance of contract and legitimate interests.
• United Kingdom – UK GDPR and PECR: the same rights apply under UK GDPR.
• Türkiye – KVKK (Law No. 6698): your data is processed on legal bases that don't require explicit consent; you can exercise your rights under Art. 11 KVKK via privacy@getseedline.com.
• USA/California – CCPA/CPRA: we don't sell or share your personal information; you have the rights to know, delete and correct.
• Brazil – LGPD: you have rights of access, correction, deletion and portability.
• Japan – APPI: personal information isn't used beyond the stated purposes; cross-border transfers are described in this policy.
• South Korea – PIPA: processing purposes and retention periods are listed above.
• China – PIPL: for cross-border transfers and your rights, write to privacy@getseedline.com.
• Canada – PIPEDA: your data is processed only for the stated purposes; you have rights of access and correction.
• Australia – Privacy Act (APPs): send access and correction requests to privacy@getseedline.com.
• India – DPDP Act 2023: you can request correction and erasure of your data and contact us with grievances.

14. Changes

If we change this policy, we update the date at the top of the page and notify you of significant changes by e-mail.

15. Contact

For privacy questions: privacy@getseedline.com.