01Who we are
Seidr Stack runs /Seiðr (Seidr Stack). For the personal data of the people who use the Service, we decide why and how it’s processed: we’re the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), and the controller under laws such as the GDPR.
When an account uses the Service for its own clients, and puts in personal data about those clients’ customers, staff or contacts, we process that data on the account’s behalf and on its instructions (as a Data Processor). Our Data Processing Agreement covers that.
02What we collect
You give us
- Account details: your name, email address and, if you sign in with Google, your Google profile picture. If you use a password, we store only a scrambled form of it (a salted scrypt hash), never the password itself.
- Your brand’s material: websites you ask us to read, files you upload (documents, images, audio and video), and what we read from accounts you connect, read-only (such as Google Drive, Notion, Figma, Instagram or LinkedIn).
- Your work: your Brand Spine, briefs, ideas, cards, comments, approvals, outputs and media made for you.
- People you add: teammates you invite (name, email, role), clients, and vendors who register through your links (company details, contacts, and documents they upload, such as tax forms, insurance or signed agreements).
- Business records: invoices, quotes, contracts and usage rights you create.
- Messages to us: what you write when you contact support.
We collect as you use the Service
- Usage: credits used and which kind of job used them, and product events (such as finishing onboarding) that tell us where people get stuck.
- Technical data: IP address, browser and device details and timestamps in our hosting providers’ logs, used for security and to fix problems.
- Cookies and local storage: to keep you signed in and remember display choices. See the Cookie Policy. We don’t use advertising or cross-site tracking cookies.
From others
- Payments: Razorpay processes your payments. It tells us whether a payment succeeded, its amount, and its reference numbers. Your card, UPI and bank details go to Razorpay, never to us.
- Google sign-in: your name, email and profile picture, as Google shares them when you sign in.
- Connected services: what those services return within the access you grant, and the access tokens that let us call them for you.
03How we use it
- To run the Service: read your materials, draft and keep your Brand Spine, make outputs, run automations, publish what you book, sync boards, and send what you ask us to send.
- To manage your account, plan, seats, credits and billing.
- To keep the Service and your data secure, prevent abuse and fraud, and enforce our terms.
- To help you when you contact us, and to tell you about changes to the Service, your plan or these policies.
- To improve the Service, using usage measures and product events, not the content of your work.
- To meet legal duties, such as keeping tax records.
We don’t sell personal data, we don’t use your content for advertising, and we don’t use your content to train AI models.
04AI processing
To read your materials and draft work, we send the relevant parts of your content to AI model providers (currently OpenAI and Google). They process it to return a result to us. We use their business API services, and we send what the task needs rather than everything you’ve given us.
If you connect a media tool with your own key (Runway, Higgsfield, Google Veo or ElevenLabs), the prompts and material for each job go to that tool under your account with it, and the result is stored in your account with us.
05Why we’re allowed to
Under the DPDP Act, we process your personal data with your consent, which you give when you create an account and use the Service, and for the legitimate uses the Act allows (for example, meeting legal duties). You can withdraw consent at any time; doing so stops the processing that depends on it, which may mean closing your account.
Where the GDPR or similar laws apply, we rely on: performing our contract with you; our legitimate interests in running, securing and improving the Service (balanced against your rights); your consent where we ask for it; and legal obligations.
07Where it’s stored
Your account and content are stored in Mumbai, India (Vercel bom1 and Supabase ap-south-1). Some providers process data outside India, mainly in the United States: the AI providers, and services you connect. Where we transfer data abroad, we do so as the DPDP Act allows and, for people protected by the GDPR, with safeguards such as standard contractual clauses.
08How long we keep it
- Your account and content: while your account is open. Delete a source, an output or a brand and it’s removed; delete your account from your Profile and we delete your details and every brand you own alone, with its Spine, materials, files and work. Brands you share with others pass to another member, so their work isn’t lost.
- Backups: deleted data can remain in our database provider’s backups for a short time, normally under 30 days, until they roll over.
- Billing records: invoices and payment records, as long as tax and accounting law requires, which in India can be up to eight years.
- Logs: security and error logs, for a limited time set by our hosting providers.
09How we protect it
- Everything travels encrypted (HTTPS).
- Access tokens and API keys for connected services are encrypted (AES-256-GCM) before they’re stored, and only opened on our servers for the call that needs them. They’re never sent to your browser.
- Passwords are stored only as salted scrypt hashes.
- The database refuses direct access; every request goes through our server, which checks that you belong to the account and brand involved, and what your role allows.
- Uploaded files are in private storage, shared only through short-lived links. Review and registration links store only a scrambled form of their token, and expire.
10Your rights
You can:
- See and correct your details in your Profile, or ask us for a summary of the personal data we hold about you.
- Delete your account and data yourself from your Profile, or ask us to.
- Export your design tokens and outputs from the app, and ask us for a full copy of your data in a portable form.
- Withdraw consent at any time.
- Nominate someone to exercise your rights if you die or become unable to (DPDP Act).
- Object or restrict: where the GDPR applies, object to processing based on legitimate interests, or ask us to restrict it.
- Complain: to our Grievance Officer first, and then to the Data Protection Board of India, or your local data-protection authority.
Write to support@seidrstack.com from the email on your account. We’ll reply within 30 days, and sooner where the law requires. If we hold your data only because an account added it (as a client’s or vendor’s contact), we’ll point you to that account, and help it respond.
11Children
The Service is for people aged 18 and over. We don’t knowingly collect data from children. If you think a child has given us their data, write to support@seidrstack.com and we’ll delete it.
12Changes to this policy
If we change this policy in a way that matters, we’ll tell you by email or in the app before the change applies. The date at the top shows when it last changed.
13Contact and grievances
Privacy questions and requests: support@seidrstack.com. Grievance Officer: support@seidrstack.com. We acknowledge grievances within 24 hours and resolve them within 15 days. Post: Seidr Stack, No 60/5, 4th T Block, Jayanagar, Bengaluru 560041, Karnataka, India. See also Contact.
Questions about this policy: support@seidrstack.com. Every policy is listed on Legal & policies.
