Privacy Policy

Paysealed is operated by Muzamil Awan (“Paysealed”, “we”, “us”). If we set up a company to run Paysealed, that company will take over this role and we will update this page. You can reach us at hello@paysealed.com.

This policy covers our website, the Paysealed app (including the version you add to your phone’s home screen), our Slack app, our Gmail add-on and our Outlook add-in.

When a company uses Paysealed, that company decides what goes into it: its team members, payment requests and approvals. For that information, the company is in control and we process it on its behalf, following its instructions and this policy. In legal terms, the company is the “controller” or “business” and we are its “processor” or “service provider”.

For our website and early access list, we decide how information is used, so we are the controller.

Early access list. Your work email and, if you share them, your company name and team size, plus which page you signed up from.

Your account. Your name, email address, job title, company name and role. If you sign in with Google, Google gives us your name, email address and profile picture.

Payment requests. Who is to be paid, the amount, the last 4 digits of the bank account, any note you add, how the request arrived (for example email, phone call or Slack), who asked, who approved or declined, and when. Please don’t enter full bank account numbers or other sensitive details in notes.

Your phone and passkey. When you register a phone, it creates a passkey. We store the passkey’s public key, its ID, a counter, the name you give the phone and the browser or device type. Your fingerprint or face check happens only on your phone. We never receive biometric data.

Approval proofs and audit log. Each approval is signed by the approver’s passkey. We keep the signed record and a log of important actions, such as requests, approvals, invitations and settings changes. Each log entry is linked to the one before it, so entries can’t be changed without it showing.

Notifications. If you turn on notifications, your browser gives us a delivery address and keys. Notifications are delivered through your browser’s push service and show the payee, the amount and who is asking.

Slack. If your company connects Slack, we store the workspace ID and name, our bot’s ID and an access token, which we encrypt. When you use /vouch or “Verify with Paysealed”, Slack sends us your Slack user ID, the channel and the message you chose to verify. We look up Slack users’ email addresses so we can match them to Paysealed accounts, and we post request updates back to Slack.

Gmail add-on and Outlook add-in. When you open the Paysealed panel on an email, the add-on reads that one email: sender, reply-to address, recipients, subject and text. It sends them to our server, which looks for warning signs and sends back the result. We don’t store the email. The add-on can’t read your other emails. If you click “Verify with Paysealed”, the details it found open in a request form, and they are saved only if you send the request.

Technical data. IP address and browser type, used for security and to limit abuse. Our hosting provider keeps short-lived server logs.

Website analytics. Vercel Web Analytics counts page visits. It doesn’t use cookies and doesn’t identify you.

• To run Paysealed: send requests to approvers, verify approvals, send reminders and backup alerts, and show results in the app and in Slack.
• To keep accounts and payments safe, including detecting abuse and limiting repeated attempts.
• To send service messages, such as sign-in codes, invitations and important changes.
• To answer support questions and, for the early access list, to contact you about Paysealed.
• To understand, in aggregate, how Paysealed is used so we can improve it.
• To meet legal obligations.

We don’t sell or rent personal information, we don’t share it for advertising, and we don’t use customer data or email contents to train AI models.

Our Gmail add-on uses Google permissions to read only the email you open while using the add-on, and to know your own email address. We use this only to show you the fraud check. Paysealed’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don’t let people read this data unless you ask us to for support, it’s needed for security, or the law requires it.

The app uses essential cookies from Clerk to keep you signed in. It also stores a small note in your browser so it doesn’t set up notifications twice. We don’t use advertising or tracking cookies, and our website doesn’t set cookies for analytics.

We use these providers to run Paysealed. They may only use the data to provide their service to us.

Inside your company, people on your Paysealed team can see requests and approvals according to their role. We may also share information if the law requires it, to protect people from fraud or harm, or as part of a merger or sale of Paysealed, in which case this policy will continue to apply.

App data is stored in Australia. Some providers, such as Clerk, process data in the United States. When data moves between countries, we rely on our providers’ legal safeguards, such as the European Commission’s Standard Contractual Clauses where they apply.

• Account, request and approval data, including the audit log: while your company has a Paysealed account. After the account is closed, we delete it within 30 days, unless the law requires us to keep it longer.
• The audit log can’t be edited entry by entry, because that is what makes it trustworthy. It is deleted as a whole with your company’s account.
• Emails checked with our add-ons: not stored.
• Sign-in challenges and abuse-limit records: about one day.
• Notification addresses: until you turn notifications off, remove the phone, or the browser stops accepting them.
• Slack connection: until an admin disconnects Slack. The access token is deleted then.
• Early access list: until the early access program ends or you ask us to remove you.

All connections use HTTPS. Data is encrypted at rest by our database provider, and Slack access tokens are encrypted again by us. Every company’s data is kept separate. Approvals need a passkey on a registered phone, and we limit repeated attempts. No system is perfectly secure. If you find a security issue, please tell us at hello@paysealed.com.

You can ask to see, correct, export or delete your personal information, or object to how we use it. If your company uses Paysealed, please contact your company’s Paysealed admin first, because they control your company’s data. We will help them.

If you are in the EU or UK, you have rights under the GDPR, including the right to complain to your data protection authority. If you are in California, you have rights under the CCPA. We don’t sell or share personal information for advertising, and we won’t treat you differently for using your rights. We reply to requests within 30 days. Write to hello@paysealed.com.

Paysealed is a business tool for adults. It isn’t meant for anyone under 18, and we don’t knowingly collect their information.

If we change this policy, we will update the date at the top. If a change is important, we will tell company admins by email or in the app before it takes effect.

Questions or requests: hello@paysealed.com. See also our Terms of Service.