Privacy Policy

Last updated: 19 April 2026

1. Who is the data controller

The data controller for Seedling is Sébastien Tang, a French micro-entrepreneur (SIREN 898 194 394) operating the service at useseedling.com from 69 avenue du Général Leclerc, 95250 Beauchamp, France. Contact: [email protected].

This Policy describes how we collect, use, and protect your personal data when you use Seedling. It applies alongside the Terms of Service.

2. Applicable law

Because the controller is established in France, processing is primarily governed by the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés). The French data-protection authority (CNIL) is our lead supervisory authority. If you are a resident of the Republic of Korea, we additionally respect the spirit of the Korean Personal Information Protection Act (PIPA) as a courtesy where it grants you stronger rights than GDPR.

3. What we collect

• Account data: email address, account creation timestamp, subscription status.
• Configuration data: your onboarding answers (business name, website, voice preferences, topic keywords, delivery channel).
• Generated content: the articles and images Seedling produces for you, together with associated metadata (generation timestamp, token usage, status).
• Delivery credentials: if you connect GitHub for delivery, your Personal Access Token is stored encrypted at rest with AES-GCM using a key we control.
• Payment data: handled by Stripe. We store only the Stripe customer ID, subscription status, and plan. We do not store card numbers.
• Operational logs: request metadata (IP, user-agent, timestamps) for rate-limiting and abuse prevention. Retained up to 30 days.

4. What we do not collect

We do not use tracking cookies, third-party analytics, or advertising pixels. The only cookie Seedling sets is a session cookie required to keep you signed in.

5. Legal bases (GDPR)

• Performance of a contract — processing necessary to deliver the service you subscribed to.
• Legitimate interests — rate-limiting, fraud prevention, security logging.
• Consent — optional marketing emails, which you can withdraw at any time.
• Legal obligation — tax records, accounting, legal requests.

6. Sub-processors

We share the minimum data necessary with the following sub-processors:

• Cloudflare — hosting, D1 database, R2 object storage (images), Email Routing. Data may be processed in Cloudflare's global edge network.
• Anthropic — article generation (Claude API). Your topic keywords and voice configuration are sent to Anthropic; the generated article is returned to us. Anthropic's API policies apply.
• kie.ai (Nano Banana) — image generation. Prompts derived from your article outline are sent; the resulting images are returned to us.
• Resend — transactional email (magic-link sign-in, article-ready notifications). Your email address and the email content are processed by Resend.
• Stripe — subscription billing. Stripe collects card data directly; we only receive customer/subscription identifiers.

We select sub-processors who provide adequate contractual and technical safeguards. We do not sell your personal data to anyone.

7. Your rights

Under PIPA and GDPR you have the right to:

• Access — request a copy of the data we hold about you;
• Rectify — correct inaccurate data;
• Delete — request deletion of your account and associated data;
• Restrict or object — to certain processing;
• Portability — receive your data in a machine-readable format;
• Withdraw consent — where processing is based on consent;
• Complain — to a supervisory authority. Our lead authority is the CNIL (France, cnil.fr). EEA / UK / Swiss residents may instead complain to their national data-protection authority. Korean residents may contact the Personal Information Protection Commission (PIPC) at pipc.go.kr.

To exercise any of these rights, email [email protected]. We respond within 30 days.

8. Data retention

• Account and generated content: retained while your subscription is active and for up to 30 days after cancellation, then deleted.
• Operational logs: up to 30 days.
• Payment records: retained for 10 years to comply with French commercial-code accounting obligations (art. L123-22 Code de commerce).
• Encrypted GitHub tokens: deleted immediately on account cancellation or when you disconnect the integration.

9. International transfers

Because our sub-processors operate globally, your data may be transferred outside the European Economic Area. Where that is the case, transfers rely on Standard Contractual Clauses approved by the European Commission, on an adequacy decision covering the destination country, or on the sub-processor's binding corporate rules. Data transfers to the United States rely on the EU–US Data Privacy Framework where the sub-processor is certified.

10. Security

We protect your data with TLS in transit, encryption at rest for sensitive fields (GitHub Personal Access Tokens via AES-GCM), rate-limiting on authentication and signup endpoints, and the principle of least privilege for operator access. We regularly update dependencies and patch known vulnerabilities. No system is perfectly secure; if we discover a breach affecting your personal data, we will notify you without undue delay, and in any event within 72 hours as required by GDPR where applicable.

11. Children

Seedling is not directed to children under 16 and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

12. Changes to this Policy

We may update this Policy. Material changes will be announced by email to active subscribers at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the current version.

13. Contact

Questions, requests, complaints? [email protected].