Privacy Policy

Last updated: 16 October 2026

By using the Sealfie website, mobile applications, and your account, you agree that your data is processed according to this policy. This document complements our Terms of Service.

1. Data controller

The Service is operated by Inkan.link SAS ("the Company"), a company incorporated under French law. Processing is subject to the General Data Protection Regulation (GDPR).

2. Data collected and purposes

During your verifications, your biometrics never leave your phone. The fingerprint or face recognition that unlocks Sealfie is processed by your operating system, inside the device's secure element (Secure Enclave on iPhone, StrongBox/TEE on Android). It only authorises the use of a cryptographic key that stays confined to that element and cannot be extracted from it. For these verifications, we never receive, process or store any biometric data, and a device without that secure element is refused rather than downgraded. Account creation is the exception: identity verification is then performed by ShareID, which processes a video or photo of your face (see section 3).

What we do collect: account identifiers (phone number, email); the photo taken at the moment of a verification, kept as a timestamped visual record attached to the file — we extract no template from it and run no facial recognition, identity being established by the signature of your device's key rather than by your face; technical device information (hardware fingerprint, used to detect a compromised or swapped device); and billing information necessary to pay for the subscription.

We never resell your data and never use it for advertising purposes.

3. Subprocessors

To provide the Service, we rely on the following subprocessors, each limited to the data necessary for its role:

Supabase — database hosting, authentication, and server functions for the application. Processes account data and verification results.

Stripe, Inc. — subscription payment processing. Processes billing and card data; Sealfie does not store card numbers. Stripe, Inc. is established in the United States: this processing involves a transfer of data outside the European Union, governed by the contractual commitments in place with that provider.

ShareID (ShareID SAS, Neuilly-sur-Seine, France) — identity verification provider. It is involved at two specific points, and only those: when your account is created, for the initial identity check against an official document, and in organisations that have chosen the process configuration including a ShareID step. The everyday verification flow does not involve ShareID. At those steps, ShareID captures a video or photo of your face and a copy of your identity document, for facial recognition: this is biometric data processing. Inkan.link is the controller of this processing and ShareID acts as its processor, under a data processing agreement (DPA). Under that agreement, ShareID hosts the service on Google Cloud Platform, in data centres located in the European Economic Area, with no transfer outside the EEA; Inkan.link has set videos to be deleted after 96 hours. In its privacy policy, ShareID states that it processes biometric data in memory without retaining it. Sealfie receives the result of the verification.

4. Legal basis

Processing of verification data is based on the performance of the contract between the Client company and Sealfie (providing the identity verification Service). Processing of billing data is based on the performance of the subscription contract. Processing of support requests is based on Sealfie's legitimate interest in resolving incidents and improving the Service.

5. Retention period

Account data and the verification log are retained for the duration of the subscription, then archived as required by legal and accounting obligations. You may request deletion of your account at any time via support@sealf.ie.

6. Your rights

Under the GDPR, you have the right to access, rectify, erase, object to the processing of, and port your data. To exercise these rights, write to the data protection officer: dpo@inkan.link. For questions about how the service works, support@sealf.ie remains the contact point.

You also have the right to lodge a complaint with the CNIL, the French supervisory authority (cnil.fr), or with your local authority.

7. Data disclosure

We only disclose your data in response to a binding legal obligation from the competent French authorities, after reviewing the validity of the request.

8. Changes

This policy may be reviewed periodically. Users who have enabled notifications will be informed of substantial changes.

For any questions about this policy, contact: support@sealf.ie