Privacy Policy

1. Who we are

Sebairo is a “Digital Life OS” app operated from the United Kingdom (“Sebairo”, “we”, “us”). For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Sebairo is the data controller for the personal data described in this policy.

Contact for privacy matters: support@sebairo.com, with [Data Rights] in the subject line if you are exercising a right under section 9.

Where you use a workspace to run a company, Sebairo is the processor and you are the controller for the customer, employee and applicant records you load into it. Section 8 of the Terms sets out what that means for your obligations.

2. What we collect

Account data

The phone number or email address you sign up with, your display name, profile details, a photo if you add one, your chosen language and your settings. Passwords are stored only as a hash by the authentication service; nobody at Sebairo can read yours.

Content you create

Posts, comments, messages, photos, videos, live streams and their replays, Marketplace listings, job posts and applications, notes, memories, workspace projects and records, and business pages.

Calls

Voice and video calls are carried in real time and are not recorded, unless the host of a live stream explicitly creates a replay, in which case that replay is stored as content.

Wallet and transaction data

Your SBX Wallet balances (prepaid credits and withdrawable cash), transaction history, subscription status and ad-spend records, each with a reference. Card payments are processed by Stripe; Sebairo never stores your card number.

Technical data

A push token so a notification reaches your device and not someone else's, and the ordinary server records any hosted service keeps in order to stay up, fix faults and detect abuse.

Reports and moderation records

Reports you submit about content or accounts, and the moderation actions taken, kept with an audit trail that records who acted and why.

3. What we deliberately do not collect

Some of these took deliberate engineering. They are the ones worth holding us to.

Your address book is never uploaded

Finding which of your contacts already use Sebairo works the way it does in WhatsApp: your phone sends the numbers, the server matches them in memory and answers, and nothing from your address book is written down. No copy of your contacts exists on our side.

Your card number

There is no field for it, no screen that asks for it and no table that stores it. Card entry happens on Stripe's own checkout page.

Your location, unless you switch it on

Map presence starts switched off, and “off” is not “we hide the pin”: the database refuses to release your row to anyone but you until you change the setting.

4. Why we use your data, and our lawful bases

Performance of a contract

Providing the app you asked for: accounts, messaging, calls, the feed, the Marketplace, the wallet, payments and subscriptions.

Legitimate interests

Keeping the platform safe and working: content moderation, fraud prevention, abuse detection, service diagnostics and security. These interests are balanced against your rights, and you can object under section 11.

Consent

Where required — for example certain notifications and map presence. You may withdraw consent at any time, and withdrawal takes effect from that point forward.

Legal obligation

Record-keeping and disclosures required by law, including financial and tax records connected to payments and withdrawals.

5. Who can see what

Most apps decide this in the screen: the server sends everything and the app hides the parts you should not see. Sebairo decides it in the database. Every table is row-level-security gated, and the app connects with your own session rather than an administrator key — so when you are not allowed to see a row, you never receive it in the first place.

• Every post carries an audience — public, followers, contacts or private — and the rule is enforced in the read policy and in the ranked feed alike.
• A conversation is readable by the people in it. Direct chats, groups, business inboxes and client portals are separate surfaces on purpose.
• Blocking is enforced in the database, both ways, not filtered on your screen.
• Group, chat and contract links never render as a public web page; a stranger with the URL sees nothing and a search engine cannot index it.
• Business pages, Marketplace listings and job posts are public by design — that is what they are for.

6. Encryption, stated plainly

Everything between your device and Sebairo travels over TLS, and the database and file storage are encrypted at rest by the hosting platform. That is the ordinary expected standard and Sebairo meets it.

Sebairo is not end-to-end encrypted, and we will not imply otherwise. Messages are stored in a form the service can read. In practice that means moderation can act on something you report, and that a lawful order could compel disclosure. If you need end-to-end encryption for a particular conversation, use a tool built for that and do not assume Sebairo is one.

7. Sharing and sub-processors

We do not sell your personal data. We share it with service providers who process it on our behalf under contractual safeguards. The full list, with what each one actually receives and why, is on its own page: Sub-processors.

• Supabase — authentication, database, file storage and the server-side functions the app calls.
• Stripe — card payments, subscriptions and checkout.
• LiveKit — real-time voice and video for calls and live streams.
• Google / Firebase — push notification delivery (Firebase Cloud Messaging).
• Twilio — one-time sign-in codes sent by SMS.
• Vercel — hosting for the public websites sebairo.com and help.sebairo.com.

We may also disclose data where required by law, or to protect the rights, safety and security of Sebairo, our users or others. What that means in practice — what process is required, what we will refuse, and when you are told — is set out in the Law Enforcement Guidelines.

8. Where your data is, and international transfers

The primary database and file storage are hosted in the London region of the hosting platform, in the United Kingdom.

Some sub-processors process data outside the United Kingdom — a push notification or a real-time call route may be served from another region. Where personal data is transferred internationally, we rely on appropriate safeguards such as UK adequacy regulations or the applicable standard contractual clauses together with the UK International Data Transfer Addendum.

9. Retention

We keep personal data for as long as your account is active and as long as needed to provide the service. When you delete your account, the account is removed at the authentication layer and your profile and profile-scoped data are deleted with it.

Some things outlive the account, and the reasons are specific rather than general: financial and tax records connected to payments and withdrawals, moderation records where they are needed to enforce a suspension or answer a legal request, and content other people received and kept. Each is kept only as long as its purpose requires.

10. Security

We use technical and organisational measures appropriate to the risk: encryption in transit, encryption at rest, row-level security on every table with policies naming exactly who may read and write each row, column-level revocation for the most sensitive fields, encrypted server-side vault storage for provider keys, and an audit log for staff moderation actions.

Sebairo has not been through a third-party security audit and runs no paid bug-bounty programme. No system is perfectly secure and we cannot guarantee absolute security. Vulnerability reports are welcome at support@sebairo.com with SECURITY in the subject line.

11. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data rectified;
• have your data erased — account deletion is permanent and available self-service from Settings in the app;
• receive a portable copy of data you provided;
• object to processing based on legitimate interests;
• restrict processing in certain circumstances;
• withdraw consent where processing is based on consent.

To exercise any of these, write to support@sebairo.com with [Data Rights] in the subject. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.

Sebairo does not make decisions about you by automated means that produce legal effects or similarly significant effects on you. Ranking a feed is not that.

12. Children

Sebairo is not intended for children under 13, and you must be at least 13 years old to create an account. If we learn that an account belongs to a child under 13, we will delete it.

13. Changes to this policy

We may update this policy as the service evolves. If we make material changes, we will notify you through the app or by other reasonable means before the changes take effect, and every change is logged with its date on the changes page.