Privacy Policy

Last updated 28 October 2026

This policy explains how Ayshan Huseynova, a sole proprietor registered in the Republic of Azerbaijan (VÖEN 6501887942), trading as Bindseal (“Bindseal”, “we”, “us”) handles personal data when you visit this site, create an account, or use our licensing and anti-tamper Service. Where you use the Service to process personal data about your own end users, you are the controller of that data and we act as your processor — see our Data Processing Addendum.

1. Data we collect

• Account data — your name, work email, organization, and the products you register.
• License and activation records — product identifiers, machine fingerprints (a derived, hashed value), seat and entitlement metadata, and timestamps. These are primarily pseudonymous technical identifiers.
• Billing data — handled by Paddle (see Section 4). We receive confirmation of your subscription and invoices, not your full card details.
• Support and communications — messages you send us and their contents.
• Security and request logs — server logs (such as IP address and request metadata) that we need to run and protect the site and the Service. This site does not use analytics.

The SDK verifies licenses offline and does not phone home. Any online checks (for example seat counts or revocation) are opt-in, documented, and carry only what the check needs.

2. How we use data

• To provide, secure and support the Service and sign your license files;
• To manage your account, subscription and communications with you;
• To detect, prevent and investigate abuse, fraud and security incidents;
• To comply with legal obligations.

We do not sell personal data, and we do not use it to build advertising profiles.

3. Legal bases

Where the GDPR or similar laws apply, we rely on: performance of our contract with you; our legitimate interests in running and securing this site and the Service; and compliance with legal obligations. If we ever ask for your consent to something optional, you can withdraw it at any time.

4. Payments — Paddle

Our payments are processed by Paddle, which acts as the merchant of record and an independent controller of the payment data you provide to it. Paddle handles your card details and billing information under its own privacy policy. We receive only the information needed to fulfil and account for your subscription.

5. Sub-processors

We use a small set of infrastructure providers to run the Service:

• Amazon Web Services (AWS KMS) — hardware-backed key storage and signing (EU region).
• Neon — managed PostgreSQL database for license records (EU region, Frankfurt).
• Fly.io — application hosting for the license server (EU region, Frankfurt).

We require each provider to protect data consistently with this policy. A current list is available on request and in our DPA.

6. Third-party resources on this site

This website is static and loads a few resources from third parties. Like any web request, each one receives your IP address and browser user agent:

• Cloudflare — hosts and delivers this website and our status page (status.bindseal.com). Opening the status indicator fetches the current service status from that page; no cookies are sent or set.
• Google Fonts — our typefaces are loaded from fonts.googleapis.com and fonts.gstatic.com, so your browser sends your IP address and user agent to Google when it loads them. Google’s privacy policy applies to that request.
• cdnjs (Cloudflare) — the plan estimator page loads a screenshot library from cdnjs.cloudflare.com.
• Paddle — the checkout page loads Paddle’s checkout from cdn.paddle.com. What you enter there goes directly to Paddle, which handles it as an independent controller (see Section 4).

7. International transfers

We aim to keep license data in the EU. Where personal data is transferred outside your region, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

8. Retention

We keep account and license data for as long as your account is active and as needed to provide the Service, then delete or anonymize it within a reasonable period, except where we must retain records to meet legal, tax or security obligations.

9. Your rights

Subject to applicable law, you may request access to, correction of, deletion of, or a copy of your personal data, and you may object to or restrict certain processing. You can also export your account’s license records at any time. To exercise a right, contact us using the details below; you may also complain to your local data protection authority.

10. Security

Signing keys never leave the HSM. Data is encrypted in transit (TLS) and at rest, access is restricted on a need-to-know basis, and admin actions require scoped tokens. No system is perfectly secure, but we design the Service so that compromising us does not hand an attacker your signing key.

11. Cookies

This site uses only what it needs to function and to stay secure. Our own pages use your browser’s session storage for one small display detail (the custom cursor’s position) while you browse. We do not use analytics, advertising or cross-site tracking cookies.

12. Children

The Service is for businesses and is not directed to children, and we do not knowingly collect personal data from them.

13. Changes

We may update this policy; we will post the new version here and update the date above, and give notice of material changes.

14. Contact

Privacy questions or requests: privacy@bindseal.com.