Privacy Policy

Last updated: 18 October 2026. XSeal is operated by Website Holding, which is the data controller for the personal data described here.

XSeal is built so that your documents stay yours. This policy explains exactly what we collect, what we never collect, and the rights you have over your data.

What we never collect

We never store the contents of the files you seal or verify. When you seal or verify files on the website (one file, a bulk batch, or a new version from the dashboard), your browser computes each SHA-256 hash and sends only the hash, the file name and its size: the files themselves never reach us. Only a very old browser without Web Crypto sends the file over an encrypted (HTTPS) connection; its hash is computed in memory and the file is discarded as soon as the request finishes. Only the hash and the metadata listed below are kept. The “Find by file” search in your dashboard and the API’s hash mode never send the file either.

What we store

• Seal records: the SHA-256 hash, the file name and size you provide, the UTC timestamp, the Seal ID and signature, the confidence score, and (when relevant) the seal it is a new version of and the API key that created it. A seal made without an account is not linked to any person.
• Bulk-seal manifests: if you seal a batch of files at once, we store one combined, signed manifest record referencing each file's individual seal, the same way a single seal is stored.
• Account data: your email address, a password hashed with scrypt (we never store the password itself) and your plan, if you create an account to keep a seal history.
• Session: a random sign-in token, stored with your account and in a cookie, that expires after 30 days or when you log out.
• API keys: if you create one, its name, prefix, creation and last-used time, and a SHA-256 hash of the key. The full key is shown once and cannot be recovered by us.
• Upgrade requests: if you request a plan upgrade in-app, we store that request (your account and the requested plan) so it can be reviewed.
• Operational logs: minimal request logs (including IP address and browser details) used to keep the service secure and reliable. Rate limiting counts requests per IP address in memory only and is not stored.
• Support messages: if you use the contact form, the name, email, topic and message you send, stored by XSeal and passed to the Website Holding helpdesk so we can reply.

Data retention

Seal records and account data are kept for as long as your account is active, so your seal history stays verifiable; your plan's retention period on the pricing page is the minimum we keep it. You can delete individual seals at any time, and closing your account removes your account data; seals you made stay verifiable but are no longer linked to you. Seals made without an account are kept so they remain verifiable; to have one removed, send us its Seal ID. Expired sessions are no longer accepted and a revoked API key is deleted at once. Support messages are kept while we handle your request and for a reasonable period afterwards. Operational logs are rotated on a short cycle. We keep only the minimum needed to run the service and meet our legal obligations.

Third-party processors

We share data only with the processors that help us run XSeal:

• Website Holding: our operator and merchant of record, which handles accounts, billing and support (including its helpdesk, which receives contact-form messages).
• Amazon Web Services: the application and database run on AWS in the United States (the us-east-1 region), delivered through AWS CloudFront. Transfers outside the EU are covered by AWS's data processing terms, which include the EU Standard Contractual Clauses.
• Cloudflare: the network in front of xseal.nl, which handles every request (including your IP address) to deliver the site and protect it from attacks.
• Google Fonts: the site's typefaces are loaded from Google's servers, which receive your IP address and browser details when a page loads.
• The report form on the report page is provided by Website Holding and protected by Cloudflare Turnstile, which checks that a person is submitting it.
• Payment processing: when self-serve card checkout is enabled, card payments will be handled by Website Holding's payment provider and we will never see or store full card numbers. Until then, paid plans are arranged directly with the operator and no card data is collected by XSeal at all.

Cookies

We use a strictly necessary session cookie to keep you logged in. One other cookie is set only if you choose Hide checklist on your dashboard: xs_hide_start remembers that choice in that browser for a year and holds no personal data. We do not use analytics, advertising or third-party tracking cookies, and we do not sell or share personal data for advertising.

Payments

Paid plans are billed by Website Holding as merchant of record. Self-serve card checkout is not yet live: today, an upgrade request you make in-app is reviewed and granted directly by the operator, and no card data is collected. When checkout goes live, card details will be handled by the payment processor and will never be stored by XSeal.

Your rights

Under the GDPR you can request access to, correction of, deletion or a copy of your account data and seal history, and object to or ask us to restrict its processing. You can delete individual seals from your dashboard at any time, or contact us to close your account. We answer requests within one month. If you are unhappy with how we handle your data, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

If you live in California, the CCPA (as amended by the CPRA) gives you, where it applies, the right to know what personal information we hold about you, to have it corrected or deleted, and to opt out of its sale or sharing. XSeal does not sell personal information or share it for cross-context advertising, and we will not treat you differently for using these rights. Use the same channels below to make a request.

Contact

For privacy questions and requests, use the contact form (topic “Account”) or email hello@websiteholding.com, and we will respond promptly.