Vellum · sigillum.uk
Privacy Notice
Version 1.1 · 26 August 2026
1. Controller
The data controller is Richard Palmer, trading as Sedge5 Technology Solutions, of 124 City Road, London, EC1V 2NX.
Enquiries concerning this notice, and requests to exercise your rights, should be addressed to [email protected].
2. Personal data we process
2.1 Account data
- Account name, email address, and a scrypt hash of your passphrase. The passphrase itself is not stored.
- Session records for the duration of each signed-in session.
2.2 Document content
- Documents submitted for processing, and material derived from them: extracted claims, generated pages, manifests and sealed bundles.
- Such material may contain personal data where personal data is present in the documents submitted. Its content is determined by you.
2.3 Billing data
- Subscription status and Stripe customer identifiers. Card details are processed by Stripe and are not held by us.
2.4 Technical data
- Server logs recording IP address, timestamp and requested route, retained for security and diagnostic purposes.
3. Purposes and lawful bases
| Purpose | Data | Lawful basis |
|---|---|---|
| Provision of the service | Account, document content | Performance of a contract |
| Billing and collection of fees | Account, billing | Performance of a contract |
| Password reset by email | Account, email | Performance of a contract |
| Security, rate limiting and abuse prevention | Technical, account | Legitimate interests |
| Maintaining the verifiability of attestations | Sealed bundles | Legitimate interests |
| Publication of a record at your instruction | Sealed bundles, account name | Performance of a contract |
4. Processors
We engage the following processors. Each is bound by contract to process personal data only on our instructions.
| Processor | Purpose | Location of processing |
|---|---|---|
| Oracle Cloud Infrastructure | Application hosting and storage | South Africa (Johannesburg) |
| Anthropic | Automated extraction from document content | United States |
| Stripe | Payment processing | European Union / United States |
| Cloudflare | DNS and reverse proxy | Global edge network |
| Google (Workspace SMTP relay) | Transactional email | European Union / United States |
| Amazon Web Services | Encrypted off-site backup | United Kingdom |
Document content submitted to Vellum is transmitted to Anthropic for automated extraction. You should take this into account when determining what material to submit.
5. International transfers
Our application servers are located in South Africa. Personal data submitted to the service is therefore transferred outside the United Kingdom, as are transfers to processors operating in the United States.
Where a recipient is outside the United Kingdom, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses as the safeguard for that transfer.
6. Retention
| Category | Retention period | Basis |
|---|---|---|
| Sealed bundles | Indefinite | An attestation capable of destruction does not constitute evidence. Retention preserves the assurance the bundle exists to provide. |
| Intake files | Deleted once the bundle is sealed, unless the account holder sets a longer period (up to 12 months) | The document has served its purpose once sealed; the bundle records its digest |
| Account records | Duration of the account, then six years | Contractual and tax records |
| Server logs | 90 days | Security and diagnosis |
| Billing records | Six years | United Kingdom tax law |
We do not keep your source documents. Once a bundle is sealed, the uploaded document is deleted and the bundle retains its SHA-256 digest, so a claim still traces to the document it came from and you can prove which file that was.
Sealed bundles are retained indefinitely as a permanent property of the service. Where a bundle contains personal data, retention is necessary for the establishment, exercise or defence of legal claims.
7. Publication
Publication is optional and never automatic. A sealed record is private to your account unless you choose to publish it, and the choice is made separately for each record.
Two modes are available:
- Unlisted. The record is reachable only at an address containing a random token. It is not linked from the service and is not listed anywhere. Anyone holding the link can view it.
- Listed. The record is reachable at a stable address containing your account name. The address is readable, may be found, and may be indexed by search engines.
When you publish a record, its page and signature file become available to anyone who reaches that address, without signing in. Where a record contains personal data, publication makes that data public. You are the controller of the material you submit and the decision to publish is yours; you should satisfy yourself that you have a lawful basis for publishing any personal data a record contains.
We record which mode you chose and when.
You may unpublish at any time, in either mode. Unpublishing removes the address: the page ceases to be served and the record returns to being private to your account. It cannot reach copies already taken by others, and a search engine may retain a cached copy for a period afterwards.
Unpublishing does not delete the record. The sealed bundle is retained as described in section 6.
Publication continues while your account exists, including during any period when your subscription has lapsed. It ends when your account is closed: published pages cease to be served, though the sealed bundle is retained as described in section 6.
Published pages are served through our reverse proxy’s global edge network, so a published record is available internationally.
8. Your rights
You have the right to request access to your personal data, its rectification or erasure, restriction of or objection to processing, and its provision in a portable form. Where processing is founded on consent, that consent may be withdrawn at any time.
Requests should be addressed to [email protected]. We will respond within one month.
Where you are our customer and the personal data in question is contained within documents you have submitted, you are the controller of that data and we act on your instructions. Requests from your own data subjects should be directed to you.
9. Complaints
If you are dissatisfied with our handling of your personal data you may complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would welcome the opportunity to address the matter first.
10. Amendments
Amendments to this notice will be published here. Where an amendment is material, account holders will be notified by email.