Draft Privacy Notice

The future contracting entity, registered address, privacy lead, and applicable-law roles are TBD. For customer document processing, the intended arrangement is that the business customer decides the purpose and means of processing and the future Oddseal entity acts on its documented instructions. Oddseal may act for its own purposes when securing accounts, operating the site, and meeting legal duties.

• Account data, including name, email, verification state, database session records, and security events.
• Public waitlist data, including normalized email, selected language, consent state, signup source, unsubscribe token, and bounded Resend Segment-sync state.
• Workspace and document data, including uploaded PDFs, extracted text, encrypted detected values, review decisions, redacted artifacts, verification evidence, share settings, and audit records.
• Support messages and bounded operational data. Share activity keeps rotating keyed or coarse network and device evidence for 30 days, not raw IP addresses or full user-agent strings.

Data is used to provide redaction and sharing, operate the public waitlist, send requested launch updates, authenticate users, enforce tenant boundaries, prevent abuse, diagnose failures, answer support requests, delete data, and meet applicable legal duties. Uploaded documents are not used to train models, and external AI is disabled for this beta.

Unverified uploads have a bounded cleanup clock. Originals normally purge 1–168 hours after verification, with a 72-hour default. Verified artifacts normally remain until owner deletion. A document deletion request removes access and revokes shares immediately, then targets primary database and object-store purge within 24 hours; provider recovery residue may remain for up to 30 days.

Unsubscribing from the public waitlist stops launch messages and preserves the minimal consent record needed to honor that choice. A verified deletion request may remove the waitlist record when no legal retention duty applies.

Assisted account erasure is currently limited to the private beta's single-user, providerless workspace shape. Some de-identified, unauthenticatable shells remain to preserve append-only audit integrity.

The planned private-beta providers and their roles are listed on the Subprocessors page. Processing may occur outside the customer's country. Singapore is the primary compute and database plane, but no residency promise or transfer mechanism is offered until counsel and providers confirm the final terms.

Contact support@oddseal.com for access, correction, deletion, export, or objection requests. Rights depend on applicable law, and identity and authority must be verified before action.