Privacy Policy

Effective date:

This policy explains how Seedling collects, uses, discloses, protects, retains, and deletes personal information when organizations and their authorized users use our services.

1. Scope and our role

This Privacy Policy applies to the Seedling websites, hosted software, APIs, support channels, and integrations that link to it (collectively, the “Service”). It does not govern a third-party service before information is provided to Seedling or after a customer directs Seedling to send information back to that service.

Seedling provides a business-to-business service. For Customer Data placed in a workspace, the customer determines why and how the information is processed, and Seedling generally acts as its processor or service provider. Seedling acts as a controller or business for account administration, website operations, security, support, and its own legal obligations. If your employer or another organization provided your information to Seedling, that organization’s privacy notice may also apply.

2. Information we collect

Account and identity information
Name, work email address, authentication records, profile information, workspace membership, role, permissions, and account preferences.
Customer Data
Information submitted, uploaded, synchronized, or generated within a workspace, including documents, records, messages, meeting information, transcripts, recordings, operational evidence, workflows, proposals, and approved configuration.
Integration information
Connected-service identifiers, authorization grants, encrypted credentials or tokens, selected permissions, synchronization state, webhook events, and the content and metadata the customer authorizes Seedling to retrieve.
Usage and technical information
IP address, browser and device characteristics, request and event times, application routes, diagnostic records, security events, and feature interactions needed to operate and protect the Service.
Support and communications
Messages, attachments, contact details, and troubleshooting information provided when someone requests support, reports a security issue, or communicates with us.
Derived information
Source-backed indexes, embeddings, summaries, classifications, operational models, verification results, and other outputs created to provide the workspace features requested by the customer.

3. Sources of information

  • You, when you create an account, configure a workspace, upload information, or contact us.
  • Your organization and its authorized administrators or users.
  • Third-party services that an authorized workspace administrator connects to Seedling.
  • The Service itself, through essential cookies, logs, security monitoring, and requested workspace processing.
  • Service providers acting on our behalf, such as authentication, infrastructure, communications, and security providers.

4. How we use information

Where a legal basis is required, we process information to perform our contract, follow customer instructions, pursue legitimate interests in operating and securing a business service, comply with law, or act with consent. A person may withdraw consent where consent is the applicable basis, without affecting earlier processing.

  • Provide, maintain, secure, troubleshoot, and improve the Service.
  • Authenticate users and enforce workspace roles, permissions, and source entitlements.
  • Connect approved third-party services and synchronize authorized information.
  • Create source-backed search, operating context, verification results, workflows, and other customer-requested outputs.
  • Provide support and communicate about service, security, privacy, and administrative matters.
  • Monitor reliability, prevent abuse, investigate incidents, and enforce our agreements.
  • Comply with law and protect the rights, safety, and integrity of Seedling, our customers, and others.

5. AI and automated processing

Seedling may send the minimum information needed for a requested feature to an AI provider enabled for the workspace. Depending on workspace configuration, the provider may be selected by the customer, accessed with customer-supplied credentials, or made available by Seedling. We require providers processing Customer Data on our behalf to protect it under appropriate contractual and security commitments.

Seedling does not use Customer Data or connected-service data to train shared Seedling models, and does not permit third-party model providers to use that data to train their shared models. Seedling may use de-identified service telemetry that does not identify a customer, user, or source record to understand reliability and capacity.

Automated outputs may be incomplete or inaccurate. Seedling is designed so generated operating configuration is proposed for human review before materialization. Customers remain responsible for reviewing outputs and for decisions made using the Service.

6. How we disclose information

We disclose information only as needed to provide the Service, follow customer instructions, protect the Service, complete a corporate transaction, or comply with law. Recipients may include:

  • Google Cloud Platform, which provides production hosting, database, storage, networking, and related infrastructure.
  • AI and application service providers enabled for a workspace, solely to provide the requested feature.
  • Authentication, communications, observability, security, and professional service providers acting under our instructions.
  • Connected services when a customer directs Seedling to authenticate, retrieve information, or perform an authorized action.
  • Professional advisers, authorities, or other parties when reasonably necessary to comply with law or protect rights and safety.
  • A successor or participant in a merger, financing, reorganization, acquisition, insolvency, or sale of assets, subject to appropriate confidentiality protections.

7. No sale or behavioral advertising

Seedling does not sell or rent personal information. We do not share personal information for cross-context behavioral advertising, use connected-service data for advertising or surveillance, or build advertising or unrelated profiles from Customer Data.

Seedling's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google API Services User Data PolicyGoogle's requirements for how apps use, transfer, and protect information received from Google APIs.

8. Cookies and similar technologies

The Service uses essential cookies and similar storage for authentication, workspace continuity, security, and user preferences. Seedling does not currently use Customer Data or connected-service data for advertising cookies. If our use of non-essential analytics or advertising technologies changes, we will update this policy and provide consent controls where required.

9. Retention

Additional detail about disconnect, workspace deletion, and personal-data requests is available in the Data Deletion guide.

Active workspaces
Customer Data is retained while needed to provide the workspace and for the customer’s configured lifecycle.
Disconnected integrations
Credentials and provider-derived active data are deleted when the disconnect and provider purge complete.
Deleted accounts and workspaces
Verified deletion requests are ordinarily completed in active systems within 30 days.
Backups
Deleted information may remain in encrypted, access-restricted backups until it is overwritten or expires, ordinarily within 35 days after active-system deletion.
Integration delivery records
Provider payloads and authorization records are retained only as needed for processing, delivery integrity, recovery, security, and the provider-specific commitments in the applicable integration guide.
Legal and security records
Limited records may be retained longer when required for security, fraud prevention, dispute resolution, tax, accounting, or other legal obligations.

10. Security

Seedling uses administrative, technical, and organizational safeguards designed to protect information, including tenant separation, role-based access controls, encryption in transit and at rest, encrypted integration credentials, request verification, logging, dependency management, and restricted production access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Report a suspected vulnerability or security incident to security@tryseedling.ai. Please do not include credentials, tokens, or unnecessary Customer Data in the initial report.

11. International data transfers

Seedling is operated from the United States and uses Google Cloud Platform and other providers that may process information in the United States or other countries. Where required, Seedling uses contractual or other approved safeguards for cross-border transfers. Customers should contact us before connecting data subject to specific residency requirements not addressed in their agreement.

12. Privacy rights and choices

Depending on location and applicable law, a person may have rights to know, access, correct, delete, restrict, object to processing, receive a portable copy, withdraw consent, or appeal a decision. Submit a request to privacy@tryseedling.ai. We may verify identity and authority before acting and may retain information when an exception applies. We will not discriminate against someone for exercising an applicable privacy right.

If the information is controlled by your employer or another Seedling customer, please submit the request to that organization first. Seedling will support the customer’s response as required by contract and law. Authorized agents may submit requests where permitted, subject to verification.

13. Children

The Service is intended for business use by people who are at least 18 years old. Seedling does not knowingly offer the Service directly to children or knowingly collect personal information from children through the public website. Customers must not use the Service to process children’s information unless expressly authorized by an agreement and applicable law.

14. Changes to this policy

We may update this policy to reflect changes in the Service, law, or our practices. We will post the updated version with a new effective date and provide additional notice when a change is material and applicable law requires it. Earlier versions may be requested from the privacy contact.

15. Contact

Questions and privacy requests may be sent to privacy@tryseedling.ai. Security reports may be sent to security@tryseedling.ai. General product questions may be sent to support@tryseedling.ai.