Draft Privacy Notice

The future contracting entity, registered address, privacy lead, and applicable-law roles are TBD. For customer document processing, the intended arrangement is that the business customer decides the purpose and means of processing and the future Oddseal entity acts on its documented instructions. Oddseal may act for its own purposes when securing accounts, operating the site, and meeting legal duties.

• Account data, including name, email, verification state, database session records, and security events.
• Public waitlist data, including normalized email, selected language, consent state, signup source, and unsubscribe token.
• Workspace data and published redacted PDFs, verification evidence, share settings, and audit records are stored on the server. Original PDFs, extracted text, detected values, and review decisions stay in the originating browser.
• Support messages and bounded operational data. Share activity keeps rotating keyed or coarse network and device evidence for 30 days, not raw IP addresses or full user-agent strings.

Data is used to provide redaction and sharing, operate the public waitlist, send requested launch updates, authenticate users, enforce tenant boundaries, prevent abuse, diagnose failures, answer support requests, delete data, and meet applicable legal duties. Uploaded documents are not used to train models, and Oddseal does not send document content to external AI services.

The original PDF, extracted text, detected values and review stay in the browser that processes the document. Only reviewed, masked page images are uploaded for PDF assembly and structural verification. The server does not inspect the original or independently confirm every redaction choice. There is no cloud processing option for originals.

Local drafts survive sign-out and require the same account and current workspace membership to resume. Unfinished drafts expire after 14 days. Verified local originals use the workspace retention interval recorded when verification completes. Expiry is enforced when the app starts, returns to the foreground or opens a draft; a closed or suspended browser cannot guarantee deletion at an exact time. You can delete drafts explicitly, and browser storage eviction can remove them earlier. Local drafts are not included in server backups.

Unfinished local drafts expire after 14 days. Verified local originals expire 1–168 hours after verification, with a 72-hour default, and are cleaned up when this browser runs the app. Published redacted PDFs remain until owner deletion. Deleting a local draft does not delete its published PDF. A server document deletion request removes access and revokes shares immediately, then targets primary database and object-store purge within 24 hours; provider recovery residue may remain for up to 30 days.

Unsubscribing from the public waitlist stops launch messages and preserves the minimal consent record needed to honor that choice. A verified deletion request may remove the waitlist record when no legal retention duty applies.

Assisted account erasure is currently limited to the single-user, providerless workspace shape. Some de-identified, unauthenticatable shells remain to preserve append-only audit integrity.

The planned providers and their roles are listed on the Subprocessors page. Processing may occur outside the customer's country. Singapore is the primary compute and database plane, but no residency promise or transfer mechanism is offered until counsel and providers confirm the final terms.

Contact support@oddseal.com for access, correction, deletion, export, or objection requests. Rights depend on applicable law, and identity and authority must be verified before action.