Privacy policy

This policy explains what personal data SealHive processes and why. We follow India's Digital Personal Data Protection Act, 2023 and, where it applies, the GDPR.

Data we process

• Account data: your name, email address and a securely hashed password.
• Certificate data: recipient names, optional recipient emails and the details you put on certificates. You (the issuing organization) decide what is included.
• Usage data: basic logs needed to run and secure the service, and the IP address and browser of each signed-in session.
• Reports: when someone reports a certificate, what they wrote and, if they gave one, their email address.
• Bot protection: sign-up and report forms may use Cloudflare Turnstile, which checks the visitor's browser to tell people from bots.

Verification pages

Anyone with a certificate's number or QR code can see its verification page, which shows the recipient's name, the issuer, the certificate title and dates. Verification pages are hidden from search engines.

Your choices

Recipients can ask the issuing organization, or us, to revoke a certificate or remove their personal data. Because removing data breaks the verification link, we will confirm before doing so.

How long we keep data

• Sign-in sessions (with IP address and browser) are deleted when they expire, 30 days after you last used SealHive.
• Reports: the reporter's email is removed 30 days after the report is closed, and the report is deleted after a year.
• Certificates and the activity log are kept while the issuing organization exists, so certificates stay verifiable. Removing a recipient's personal data also removes it from the activity log; deleting an organization or account deletes its data.

Storage & security

Data is stored with Cloudflare. Files are kept in private storage and passwords are never stored in plain text.

Contact

For privacy requests, email privacy@sealhive.app.