Privacy Policy

1. Who is responsible for your data?

Seylac is the controller for personal data processed through the Seylac website and workspace, unless a separate agreement states otherwise.

Privacy questions and data-rights requests can be sent to privacy@seylac.com.

2. Data we process

Account and identity data

Name, email address, password credentials in protected form, account role, verification status, login history and security events.

Company and workspace data

Company profile, team members, customers, vendors, invoices, expenses, payments, banking records, bookkeeping entries, tax settings, files and information entered into the workspace.

Communication and support data

Messages, support requests, feedback and correspondence with Seylac.

Technical and usage data

IP address, browser and device information, timestamps, session identifiers, audit logs, error reports and interactions needed to operate, secure and improve the service.

AI assistant data

Prompts, generated previews, confirmation actions and related audit records. When a user asks for current public information, the question may be sent to an AI and web-search provider. Seylac is designed not to include private company records in a public web-search request.

3. Why we process personal data

• To create and manage accounts and company workspaces.
• To provide invoicing, expense, bookkeeping, reporting, payment and AI-assisted features.
• To authenticate users, prevent fraud, protect accounts and maintain audit records.
• To respond to support requests and communicate service information.
• To comply with accounting, tax, legal and regulatory obligations.
• To diagnose problems, understand service performance and improve Seylac.

Depending on the activity, processing is based on performance of a contract, compliance with a legal obligation, legitimate interests such as service security, or consent where consent is required.

4. AI and automated assistance

Seylac AI can prepare customer, invoice, expense and vendor-bill previews and answer questions about workspace information. A record is not saved until an authorised user confirms the preview.

AI output can be incomplete or incorrect. Users remain responsible for reviewing information before creating records, issuing invoices, filing taxes or making business decisions. High-risk actions such as deleting records, sending funds, approving payments or changing permissions are not completed through the AI assistant.

5. Connected email and messaging accounts

Seylac offers two optional features that use a connected account: the Customer Inbox, where a workspace administrator connects a shared business mailbox (Google Gmail, Microsoft 365 or Outlook.com) or a Slack workspace, and the AI Workforce assistant, where an authorised user connects their own mailbox or calendar for a private daily brief. A connection is made only through the provider's own sign-in and consent screen, and only for the account the user chooses.

Customer Inbox: what we access and why

• Google (Gmail): the account email address, new messages that arrive in the inbox after the account is connected (gmail.readonly) and permission to send the replies your team writes or approves (gmail.send).
• Microsoft 365 and Outlook.com: the account email address, new inbox messages received after connection and permission to send your team's replies (Mail.ReadWrite, Mail.Send).
• Slack: messages in the Slack channels you choose, channel names, member display names and permission to post your team's replies in the same thread.

This data is used only to show customer conversations in your shared inbox, to thread and assign them, to send the replies your team writes or approves and, when your workspace enables Seylac AI, to suggest draft replies and summaries for your team. For the Customer Inbox, older mail, sent mail, drafts and other folders are not imported.

AI Workforce assistant: what we access and why

• Email (read-only): with gmail.readonly (Google) or Mail.Read (Microsoft), the assistant lists the subject, sender, short preview and date of inbox messages from the last 30 days (up to 200 previews) so it can highlight invoices, payments and meetings in your daily brief. The full text of a message is read only when you open that message in Seylac. The assistant never sends, changes or deletes email.
• Calendar (read-only): with calendar.calendarlist.readonly and calendar.events.readonly (Google) or Calendars.Read (Microsoft), the assistant lists your calendars so you can choose up to five, and reads their events for the next 7 days to show upcoming meetings in your brief. It never creates, changes or deletes events.

The assistant may suggest follow-up drafts that are saved in Seylac for the user to review and copy; it does not send them. AI Workforce connections are private to the user who connected them. Cached previews are replaced on each sync, and disconnecting removes the cached previews, tokens and related drafts.

Other connected apps

• Google Drive & Sheets (optional): with drive.file, Seylac creates spreadsheets from the reports or lists you choose to export, in a “Seylac exports” folder. This permission only lets Seylac see files it created; it cannot read your other Drive files.
• Sign in with Google or Microsoft (optional): we receive your name and verified email address (openid, email, profile) only to sign you in to your existing Seylac account.
• Telegram, Microsoft Teams and Calendly (optional): messages customers send to your Telegram bot are shown in your inbox; alerts you choose are posted to your Teams channel through the workflow link you provide; new Calendly bookings add the invitee’s name and email as a customer and create a follow-up task.

Storage and protection

Access and refresh tokens are encrypted at rest and are never shown in the interface. Imported conversations are stored in your company workspace, isolated from other companies and visible only to authorised members of your team. All transfers use encryption in transit.

What we never do

• We do not sell this data or share it with third parties except the service providers needed to run the feature (hosting and, when AI is enabled, our AI provider processing it on our behalf), or when required by law.
• We do not use it for advertising, retargeting, profiling for advertising or credit decisions.
• We do not use it to develop, improve or train generalised or non-personalised AI or machine-learning models.
• Seylac staff do not read it unless you give explicit permission for a specific message (for example in a support request), it is necessary for security or abuse investigation, or it is required by law.

Google API Services User Data Policy

Seylac's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and deletion

An administrator can disconnect a Customer Inbox account at any time from Customer Inbox → Channels, and a user can disconnect an AI Workforce account from AI Workforce → Email & calendar connections. Seylac then revokes the token with the provider where supported, deletes the stored tokens and stops all access. You can also remove access at any time from your Google account permissions, Microsoft account or Slack app settings. Conversations already imported remain part of your workspace records until your team deletes them or the workspace is closed; you can ask us to delete them by writing to privacy@seylac.com.

6. Service providers and data sharing

We may use carefully selected providers for hosting, email delivery, security, customer support, payment integrations and AI functionality. They process data only for the agreed service and under appropriate contractual and security obligations.

We may also disclose information when required by law, to protect users or the service, during a corporate transaction, or when you instruct us to connect a third-party integration.

We do not sell personal data.

7. International data transfers

Some service providers may process data outside your country or region. Where required, we use recognised safeguards such as adequacy decisions, contractual protections and additional security measures.

8. How long we keep data

We retain data only for as long as needed to provide the service, protect accounts, resolve disputes and meet accounting, tax and legal obligations. Retention depends on the type of record, workspace status, contractual requirements and applicable law.

When data is no longer required, it is deleted, anonymised or securely isolated unless continued retention is legally required.

You can initiate account deletion inside the Seylac Android app or from our public account deletion page. After identity verification, account credentials, mobile access tokens and associated personal profile data are deleted or anonymised. Business accounting, tax, audit, security and anti-fraud records may be retained only where a legitimate legal or security obligation requires it; retained records are access-restricted and do not keep the app account active.

9. Security

We use access controls, company isolation, role-based permissions, secure sessions, encryption in transit, audit logging, backups and other technical and organisational measures designed to protect information. No online service can guarantee absolute security, so users must also protect passwords and devices.

10. Your privacy rights

Subject to applicable law, you may have the right to:

• Receive information about how your personal data is processed.
• Access and obtain a copy of your personal data.
• Correct inaccurate or incomplete information.
• Request deletion or restriction of processing.
• Object to certain processing.
• Receive portable data where the right applies.
• Withdraw consent without affecting earlier lawful processing.
• Complain to a data protection authority.

Requests can be sent to privacy@seylac.com. Account deletion can also be started from the dedicated deletion page. We may need to verify your identity before responding.

You may contact the data-protection or privacy authority responsible for your country or region. Finland-specific authority information is provided only when a Finland-specific service applies.

11. Children

Seylac is a business service and is not directed to children. Users must have legal authority to create an account and act for the company or organisation they represent.

12. Changes to this policy

We may update this policy when the service, providers or legal requirements change. The updated date will appear at the top of this page. Material changes may also be communicated in the workspace or by email.