Privacy Policy

Last updated: 2026-09-09

1. Data Controller

Sealsport Solutions GmbH
Am Hohlweg 16
4221 Steyregg, Austria
Company register number (FN): FN 681761 s (Landesgericht Linz (Regional Court Linz))
Email: hello@sealsport.io

2. Data We Collect

We collect and process the following categories of personal data:

  • Account data: name, email address, password (hashed), team membership
  • Documents: contracts and related files you upload to the platform
  • Usage data: access logs, feature usage, audit trails
  • Technical data: IP address, browser type, device information

3. Purpose and Legal Basis

We process your data for the following purposes and legal bases under the GDPR:

  • Performance of contract (Art. 6(1)(b) GDPR): providing and maintaining the Service, user authentication, document storage and management
  • Legitimate interests (Art. 6(1)(f) GDPR): improving the Service, security monitoring, fraud prevention
  • Consent (Art. 6(1)(a) GDPR): optional AI-powered document analysis via Google Gemini
  • Legal obligation (Art. 6(1)(c) GDPR): compliance with legal requirements

4. Document Storage & Encryption

All documents are encrypted before being stored on disk. Encrypted files are stored on a dedicated partition on our Hetzner server in Germany. Files are decrypted only on the server when an authorized user requests access. Each customer's documents are isolated in separate storage areas (tenant isolation). Access is controlled via temporary, tamper-proof signed links that expire automatically.

5. Third-Party Services

We use the following third-party services to provide the platform:

  • Google Gemini API: Used for optional AI-powered document analysis. Documents are sent once per analysis request to the Gemini API endpoint in Germany. Google does not store or further process the data. Google Gemini API Terms
  • Hetzner Online GmbH: Server hosting provider. Our server is located in Germany.

6. International Data Transfers

Your data is stored and processed within the EEA (servers located in Germany). We do not transfer personal data outside the European Economic Area (EEA) unless required by a sub-processor and adequately protected by Standard Contractual Clauses or an adequacy decision.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. When you delete a document, the encrypted file is removed from storage and the deletion is logged. Upon account termination, your data is retained for a reasonable period to allow export and then securely deleted. Backups are encrypted and retained according to our backup schedule.

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)

To exercise any of these rights, contact us at hello@sealsport.io.

9. Cookies

The Service uses necessary cookies for authentication and session management. If Google Analytics (Google Ireland Limited) is configured, we load it only with your consent to analyse visits (Art. 6(1)(a) GDPR). Without consent, Google Analytics is not loaded. You can withdraw your consent at any time via “Cookie settings” in the footer. This disables further analytics and deletes the analytics cookies accessible to our website. Withdrawal does not affect the lawfulness of prior processing.

The _ga and _ga_* analytics cookies recognise visitors and sessions. We configure them to expire after twelve months without automatic renewal on subsequent visits. Google Signals and personalised advertising signals are disabled in our integration. Your choice is stored under cookie_consent in local browser storage until you change it or clear browser storage.

More information about data processing by Google Analytics

10. Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for Sealsport Solutions GmbH is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde).

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the platform. The date of the latest revision is shown at the top of this page.