Privacy Policy

SeguraDoc watches mailboxes, personal or business, for fraud, impersonation, unwanted mail and dangerous attachments, and rebuilds PDF documents so that they can be opened safely. SeguraDoc is run by Ariano Fonseca Ângelo, an individual based in Portugal (“we”, “us”). This policy explains what personal data we hold when you use seguradoc.com, the dashboard at app.seguradoc.com, and a mailbox connected to the service. We are the controller of that data under the General Data Protection Regulation (GDPR).

Questions about this policy go to [email protected].

The service does two things, and they touch different data.

• Mailbox screening. You connect a mailbox. SeguraDoc watches it while its subscription is active. For each message it checks who the sender really is and, when content filtering is on, reads the message for signs of fraud and for the kind of mail it is. It rebuilds the PDF and Word attachments it can.
• Single-file sanitization. You upload one PDF in the dashboard and take the rebuilt copy back.

We rebuild PDF and Word (.docx) attachments; a Word file comes back as a PDF. We do not rebuild other files, such as older .doc files, spreadsheets or archives. We never move a message before we have decided what it is, and no attachment result moves a message on its own. A PDF we cannot rebuild is not rebuilt: the message stays in your inbox, your activity shows it as carrying something we did not check, never as safe, and we add a short note to your inbox, as a reply, naming the file and why. A PDF that arrives after your page allowance ran out waits in your inbox, unchecked, and is rebuilt when the allowance renews. A PDF on a message waiting for the message allowance waits with it, even with pages left, and is rebuilt when that message is checked.

So a screened message ends one of four ways: left where it is; left where it is with a warning, such as a changed bank account on an invoice; left where it is and shown as carrying something we did not check; or moved to your Junk folder. Section 5 says how a move works on a mail server that cannot move a message in one step. When we rebuild a message's attachments, we write a copy into your inbox, under the same subject, with the rebuilt files attached. It comes from SeguraDoc, never from you and never from the sender. Mail apps that group conversations normally show it with the original, which stays where it arrived. A message moved to Junk gets no copy.

In both cases a PDF or Word document is opened only inside a sandbox with no network access, every page is rendered, and a new PDF is built from what was drawn. For a file you upload, you get back only the rebuilt copy; for mail, the original stays where it arrived. We read HTML and SVG attachments as text, looking for forms, scripts and links; we never run them. With content filtering off, we do not read the content of a message with no attachment, but we still keep the small record section 5 describes.

Sign-in is passwordless. We hold your email address, your name if you give it to us, the organization your account belongs to, and the times you signed in. If you sign in with Google, we also keep the basic profile Google shares for sign-in: your name, the address of your profile picture, your Google account ID and the other basic profile fields Google sends with them. We never hold a password for your SeguraDoc account, because there is none: you sign in with a link we email you, or through Google.

Each sign-in link records the IP address that asked for it; we delete it a week after the link expires. The first time you sign in, we record when and from which IP address, as the record that you accepted our terms.

You can register for an account through the Service. We use the account information described above to create and manage your account and sign you in. Creating an account does not activate mailbox screening or document sanitization; processing requires an active subscription.

You can delete your account yourself, in Settings, once no subscription on it is active. We email you a code to confirm it is you. Deleting it removes your mailboxes, their history and notes, your documents and your sign-in details. We keep only what section 8 says we must.

To watch a mailbox we need a way in. For Gmail and iCloud that is an app password you create for SeguraDoc alone, never your account password. For other IMAP hosting it is an app password where your provider offers one; where it does not, it is the mailbox's own password, and the connect screen warns you that an app password is the better choice. For Microsoft 365 and Outlook.com it is a token Microsoft issues after you sign in with them, which we refresh as it expires.

• Credentials are kept in a separate credential service on our servers, with its own database and its own keys, and encrypted at rest. The web application that serves the dashboard can hand a new credential to it and have one revoked, but can never read one back; only the connector that talks to your mail server can fetch one.
• They are used for one purpose: reading the mailbox, moving messages within it, creating a SeguraDoc/Junk folder where your provider has no Junk folder, and appending the rebuilt copies. We never send mail from your address to anyone else.
• While a mailbox has no active subscription, the connector does not open it, with two exceptions: to test the sign-in when you connect or reconnect it, and to finish returning a message you asked us to move back to your inbox. Mail that arrives in that time is never read, also not after you pay; screening resumes with the mail that arrives from then on, and with mail that arrived while the subscription was active and was not screened yet. To tell them apart, we read only the date your mail server recorded for each message that arrived since we last screened the mailbox, never its sender, subject or content. A message moved into the inbox while it was unpaid keeps its original date and is judged by it. A message you move into the inbox after you pay is screened like new mail, whatever its date.
• Disconnecting the mailbox in the dashboard revokes the credential at once, and keeps the mailbox's history and notes so protection picks up where it left off if you reconnect. Deleting the mailbox, in its settings, removes them too. You can also revoke the credential from your provider's side by deleting the app password, changing the mailbox password, or removing the Microsoft consent.

The dashboard has to answer one question without opening a message: what did SeguraDoc do, and why. To answer it we keep a record for each message the watch analysed or acted on: moved, flagged or rebuilt, and any message the model pass read.

Every new message also gets a small record, even when we read nothing else of it, for example because filtering is off and it carries no attachment: its sender address, a fingerprint (a SHA-256 hash) of its Message-ID, the date it carries, the sender's domain and that domain's authentication results. It lets us recognise the message if you move it later, tell you whether a sender has written before, and spot a domain made to look like one you already get mail from.

Subjects and sender addresses live in the activity database only. They are never written to application logs, error reports or alerts.

A message we read and left alone is recorded too, with the reason we left it. That is what lets you open an email you did not want and find out what SeguraDoc made of it, and it is why the table above says read rather than filtered: the subject of a message we analysed is kept whether or not we acted on it. A message we never read has no subject to keep, and its row says so — we do not go and fetch one to fill the gap.

Three more records sit beside that history:

• Junk. While filtering is on, we note the sender address, the Message-ID fingerprint and the authentication result of each new message in your Junk folder, whether or not we check it.
• Your sender lists. When you move mail out of or into Junk, unsubscribe, or block a newsletter, we keep the exact sender address or domain, so we can act the same way next time. You can see and remove each one in the mailbox's settings.
• Attachments. For each attachment we keep its type, size, a SHA-256 hash and its page count, and for an invoice the last four characters of each bank account it shows.

Names we have seen before

To catch someone borrowing a colleague's or supplier's name from a new address, we keep, for each mailbox, a note of which display names have written to it from which senders. The note holds no names and no addresses: only keyed fingerprints (HMACs) of the display name, the sender address and its domain, made with a key that belongs to your organization and is itself kept encrypted. From it the AI pass is told one fixed word, such as whether a name has written before from a different sender. It is learned from new mail as it arrives, and only from mail our check did not find dangerous; we do not read your older mail for it unless you ask us to. Deleting the mailbox deletes the note, as does the end of its subscription, after the 90 days described below, and deleting your account deletes the key.

People you have written to

To tell mail you asked for from mail you did not, we look at who you write to. Between checks of your inbox, the connector reads three header fields of new messages in your mailbox's Sent folder: To, Cc and Message-ID. It never reads their subject, body or attachments, or their Bcc line. We keep, for each mailbox, only keyed fingerprints (HMACs) of the addresses you wrote to, of their domains (never of a mail service anyone can open an address on) and of the Message-IDs, made with the same key that belongs to your organization and is itself kept encrypted; no address or Message-ID is stored. They are compared with the sender and the reply headers of the mail you receive, and the AI pass is told a few fixed words: whether you have written to the sender or to their organization, and whether the message answers one you sent. When you connect a mailbox and its subscription is active, we also read the same three fields of the mail you sent in the 12 months before, once, in small batches between checks of your inbox; it stops if you disconnect or pause the mailbox. The connect screen says so before you connect. For a mailbox connected before we started doing this, we read its older sent mail only if you ask us to. The 12 months include any time the mailbox was not paid for. Deleting the mailbox deletes the fingerprints, as does the end of its subscription, after the 90 days described below, and deleting your account deletes the key.

Suppliers' bank accounts

To warn you when an invoice asks you to pay a different bank account, we keep, for each mailbox, a note of which accounts each supplier's invoices have shown. The account numbers are read from the invoice inside our sandbox. The note tells suppliers apart by their tax number, their certificate numbers from the Portuguese tax authority, the program that made the PDF, and the address and domain they send from. It holds none of these, and no account number, as written: only keyed fingerprints (HMACs) of them, made with the same key that belongs to your organization, plus the last four characters of each account, so a warning can say which one it means. It never holds a supplier's name or postal address. It is learned from new invoices as they arrive, and only from mail our checks did not mark as dangerous, including mail the AI pass did not check. The AI pass is never shown an account number, only fixed words such as whether the account is new for that supplier. Deleting the mailbox deletes the note, as does the end of its subscription, after the 90 days described below, and deleting your account deletes the key.

How long, and who deletes it

While a mailbox's subscription runs, its filtering history and the records beside it are kept until you delete them. You can delete a mailbox's whole history yourself at any time, from that mailbox's settings.

A subscription ends when it is cancelled and its paid period is over, when a crypto renewal goes unpaid, or when a free period we granted runs out. A card payment that failed and is still being retried does not end it. From the end, we keep the history for 90 days, in case you come back. Then we delete it, together with the records beside it and the mailbox's notes and fingerprints described above. If you subscribe again before then, nothing is deleted. Your sender lists and rules stay, and so does the connection, until you delete the mailbox. A message we were still working on when the subscription ended keeps its record until you subscribe again or delete the mailbox.

Deleting history also deletes what we kept about each message behind it: the small record, the sender, the subject, our decision, the Junk notes, the attachment records, and the note of where we moved the original, which is the one thing a restore needs. For the newest messages we may keep a bare marker, the message's number in your inbox and that it was already checked, so the same message is never checked or charged twice; it holds nothing about the message and cannot restore it. A message we are still working on when you delete is kept until that work ends, and then shows in your history. Your sender lists, and a sender rule you created from a row, stay, because they are your decisions rather than records of one message. Deleting history never touches the mail itself.

Deleting a mailbox, from its settings, removes everything this section describes for that mailbox, including its notes and fingerprints. You can delete a mailbox once no subscription on it is active, and we email you a code to confirm it is you.

What happens to the messages

SeguraDoc relocates mail; it never destroys it. Nothing is trashed and no folder is emptied. A message we move goes to your provider's own Junk or Spam folder, or to a folder we create called SeguraDoc/Junk when your provider offers none, and it stays there under your provider's own retention rules for that folder, which we do not control.

Some mail servers — iCloud is the one in practice — offer no way to move a message in one step. There we move a message to Junk by copying it to the other folder and then removing it from the one it came from, one message at a time, and never before the server confirms the copy has landed. Ask us and we will switch that off for any mailbox: nothing there is then moved, the message stays where it is, and we only record what we found.

The rebuilt copies are written inside your own mailbox, as a reply to the original message. We do not mail them out. We keep no copy of any message.

A PDF reaches us either as a mailbox attachment or as a dashboard upload. Either way it is processed in the sandbox described above. What happens to the files afterwards depends on how it arrived. We changed how a mailbox attachment's rebuilt PDF is kept: it is now kept only while your mailbox may need its checked copy. An attachment checked before this change keeps the earlier rule, shown below. Your account's retention period is shown in Settings, where an account owner can change it.

We use your documents for these things and nothing else: the rebuilt copy and its report; the fraud checks sections 5 and 7 describe, such as comparing an invoice's bank account with the ones that supplier used before or noting a payment QR code; and, for a PDF you upload yourself, the short summary described in section 7. We do not use them to train any model.

Three steps use a machine-learning model, and each is bounded in what it sees.

• Reading scanned pages. When a page carries little or no text, such as a scan, we send the rendered page to a vision model to recover its text, which we show with the result in your dashboard. The text comes back to us and is deleted with the outputs above.
• Document summary. For a PDF you upload yourself, we send the text of the document to a model to write the short summary shown with the result. Up to 50,000 characters; anything past that is cut. We do not do this for a mailbox attachment. The summary is deleted with the other outputs above.
• The message pass. For a message the fixed rules could not settle, we send a small model the sender's display name and domain, whether or not the domain is authenticated, how widely used the domain is, the name of the server that received the message, the subject and up to 2,000 characters of the message text. When a message is mostly pictures, we also send up to 1,000 characters of the text in those pictures, read by our own text-recognition service on our servers and not stored. A link's destination hidden in the message's markup is never sent to the model. A web address the sender wrote out in the text is part of the text and is sent with it. We also send, for up to 8 of the message's links, up to 80 characters of what the link shows: its words, a picture button's alternative text, or the words just before a web address written out in the text. We also send up to 300 characters of the message's closing footer, such as a copyright line. In those link words and that footer, email addresses, web addresses and site names, and runs of four or more digits are replaced with placeholders. The display name, subject, message text and picture text we send have email addresses and runs of four or more digits replaced the same way, and a web address written in them keeps its site name and loses everything after it. This is a filter for common patterns, not a promise that every code, amount or identifier is removed. After an attachment is checked, a second call may add a few fixed words about what we found in it, such as whether a PDF carries a payment QR code or a new bank account, never its text or its numbers. That second call sends the display name, subject and message text as written, without the link words or footer; so does the first call if we have to switch part of our checking off in an emergency, and then it sends no picture text. The model never sees an attachment itself, a rendered page, your rules or another mailbox. It is asked a fixed set of questions, such as whether the message shows signs of trying to defraud or manipulate the reader, what kind of mail it is, whether it claims to come from the police, and which language it is written in. It answers with a score and labels from a fixed list; anything else it writes is discarded. The message text, picture text, link words and footer we send exist for the length of one call and are not stored by us; the other details are already in the record section 5 describes.

The model can only raise suspicion. No answer from it can clear a message, so a sender cannot talk their way past a check.

Checking Junk. "Check Junk for mail you want" is on by default. While it is, newly arriving mail in your Junk folder also gets the same message pass described above, sending the same details, up to 20 messages per mailbox in any rolling day and within your normal allowance, so not every Junk message is checked. If the answer and our own checks narrowly confirm it is mail you want, we move it back to your inbox. This is the only case where an answer from the model can move mail back, and never on its own. That is not a promise that it is safe, and we cannot always tell who put it in Junk. You can turn this off in the mailbox's settings.

Unsubscribe. When you click Unsubscribe on a message SeguraDoc sent to Junk, we send that sender's own one-click unsubscribe request, once, to the address the sender put in the message for that purpose, after checking the message's signature again. From then on, their mail goes to Junk. We send nothing unless you click.

Languages you read. Off until you save a list in the mailbox's settings. The page may suggest your browser's languages, which it reads in your browser and sends nowhere unless you save them. Once you save a list, we keep it with the mailbox, and we also use it to read text in pictures in those languages. Your list is never sent to the model. A message plainly written in a language you did not list, that also shows other warning signs of a scam, counts as a little more risk; the language alone never moves mail. You can turn this off at any time. Whether or not you save a list, the message pass says which language each message is written in, and we keep that language's code with the message's record, along with which country the sender's domain belongs to, worked out from how the domain ends.

The message check is done by one AI company at a time, never by two for the same message. Which one depends on availability: TypeSafe AI (its Jev model), OpenAI through its Decisions API, or Mistral AI, OpenAI or Anthropic, which do the jobs below. If the check fails, the message keeps the outcome of our own checks. Whichever company does it receives the message details described above, never a document. To look into a decision that may be wrong, we may run the check again on that one message at another company on the list. Reading scanned pages and upload summaries are done by Mistral AI, OpenAI or Anthropic, never by TypeSafe AI or OpenAI's Decisions API, so they can run at a different company from the message check. Who receives your data lists each company and what it receives, and how we tell you before that list changes.

Mistral AI is the default for scanned pages and summaries, and for the message check when neither TypeSafe AI nor OpenAI's Decisions API does it. We can move this work to OpenAI with an internal setting. We then send it directly to OpenAI's API under our own OpenAI account, and OpenAI receives what each job sends: a rendered page image to recover its text, the text of a PDF you sent us yourself to summarise it, and, for the message check, the message details described above, never a document.

The same setting can move this work to Anthropic instead. We then send it directly to Anthropic's API under our own Anthropic account, and Anthropic receives what each job sends, as described for OpenAI above. A separate setting can send only the message check to Anthropic, and leave scanned pages and summaries where they are.

We check the host name of each link found inside a document against URLhaus, a malware database run by abuse.ch. Only the host name is sent; nothing about you or the document is.

We ask the registry that runs a sender's domain (for example Verisign for .com or DNS.PT for .pt) when that domain was registered. Only the domain name is sent; nothing about you or the message is. Most registries answer over an encrypted connection; for .pt and .it domains we use the older WHOIS service, which is not encrypted.

Card payments are handled by Stripe. We send Stripe your email address and your name if you gave it. We hold a Stripe customer reference, your subscription's Stripe reference and status, and the dates and invoice numbers of its paid periods. Your card number never reaches our servers. Stripe issues the invoices for card subscriptions.

Crypto payments are handled by BlockBee. We send BlockBee your email address when you start a crypto subscription, so it can send you each month's payment link. We hold your subscription's BlockBee reference and the dates of its paid periods.

Before subscriptions, accounts bought prepaid credit. For those purchases we keep Stripe's payment records as Stripe sent them, which include the card brand, its last four digits and expiry date, and the billing details, together with the IP address the purchase came from.

If you dispute a charge with your bank, we may send Stripe the records that show the service was provided: your name and email address, when and from which IP address you accepted our terms, the dates and use of your paid periods, and the names of documents processed in that time. A person decides whether to answer a dispute; nothing does it on its own.

Payment records are kept for as long as tax and accounting law requires, also after you delete your account. When you delete it, we also keep for 550 days the details above that we would need to answer a dispute, and then remove them.

• Essential cookies and storage keep you signed in, remember for 10 minutes which dashboard page you were going to while you sign in, remember your colour scheme (in your browser only) and remember your privacy choices for 6 months.
• Counting page visits. When your browser asks our server for a page, on this site or in the dashboard, the server adds one to that page's count in Umami, an analytics tool we run ourselves. It sends the page's address with identifiers and the query removed (the campaign tags utm_source, utm_medium and utm_campaign are kept), the name of the site that linked to you, your browser's preferred language and the general type of browser, system and device. It does not send your IP address, your browser's full identification string, the page title or any visitor ID, so these counts are not joined into a history of your visits. Redirects are not counted. You can switch counting off under Privacy choices, and we skip it when your browser sends a Global Privacy Control or Do Not Track signal.
• Optional analytics in your browser. Only if you accept, Umami's script also measures moves between pages inside the site and the dashboard, with your screen size and language. For this, Umami receives your IP address and browser details and links your page views until the end of the calendar month with a code made from them, and may work out an approximate location (country, region and city) from your IP address. You can withdraw under Privacy choices at any time, and it stops at once.
• Error reporting. Server errors are reported to error trackers we run ourselves. A report leaves out the query part of the web address and anything you typed into a form.
• Product demo. The homepage demo loads from Storylane only when you click to start it. Storylane may record that the demo was viewed and set its own cookies.

Open Privacy choices to see or change your answers. The same link is at the foot of every page.

These companies process data on our behalf, each receiving only what it needs for the purpose shown.

The AI rows name the companies the AI work may run on. The message check runs at one of them at a time, depending on availability; scanned pages and summaries never go to TypeSafe AI or OpenAI's Decisions API. Moving work between the companies listed here is not a change to this list.

Before this list changes

We email account holders at least 30 days before we add a company to this list or replace one on it, saying who it is, what it will receive and from when. If you object, write to [email protected] before that date.

Removing a company needs no notice, and we update this section when we do. The date at the top of this policy tells you when it last changed.

Tawk.to, which ran the live chat on our pages, has been removed from this list. The site no longer loads its chat, and support is by email at [email protected]. Chats from before the removal were held by Tawk.to; to ask about them, write to the same address.

Who is not on this list

Your own mail provider is not on this list. It already holds your mail; we act on the mailbox with the access you grant us. That includes Microsoft, which, as your mail provider, issues the sign-in token when you connect a Microsoft 365 or Outlook.com mailbox.

Work we run ourselves, on the servers above, is not listed again: rebuilding documents in our sandbox, reading text in pictures, and screening mail.

Outside the European Economic Area

Some of these companies operate outside the European Economic Area. Where data leaves the EEA it is protected by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

No one else

• We do not sell or rent personal data, and we do not share your mail or documents with advertisers or data brokers.
• We disclose data when the law requires it, or to protect the service and its users from abuse.

To ask what we hold, to object or to complain, see Your rights.

• Contract. Screening a mailbox, rebuilding documents, running your account and taking payment are the service you asked for.
• Legitimate interest. Keeping the service secure, detecting abuse, reporting errors, keeping a record that you accepted our terms, answering a payment dispute, and counting page visits as totals, which you can object to under Privacy choices.
• Legal obligation. Keeping payment records and answering lawful requests.
• Consent. Optional analytics in your browser, which runs only after you accept it; the product demo, which loads only when you click it.

The service also handles data about people who are not our customers: people who write to you (name, address, subject and a short excerpt of their message, which goes to the AI check, and their domain, which goes to the domain registries), people you write to (only keyed fingerprints of their addresses), senders in your Junk folder (the same as people who write to you), and suppliers whose invoices reach you (only keyed fingerprints of their details, and the last four characters of each bank account). We rely on the mailbox owner's legitimate interest in being protected from fraud and malware, and we keep only what this policy lists.

• PDF and Word documents are opened only inside a sandbox with no network access, and the sandbox is discarded after each job.
• Mailbox credentials are kept in a separate credential service and encrypted with keys only that service holds; the web application cannot read them back.
• All traffic between you, us, your mail server and our providers is encrypted in transit. The one exception is the domain-age lookup for .pt and .it domains, which carries only a domain name.
• Access to production systems is limited to the people who run the service.

No system is perfectly secure. If a breach affects your data we will tell you without undue delay, and the supervisory authority within the time the law sets.

Under the GDPR you may ask us to:

• show you the personal data we hold about you;
• correct it, delete it, or restrict how we use it;
• give it to you in a portable form;
• stop processing that rests on legitimate interest, or withdraw a consent you gave.

Some of this you can do without asking. Filtering history can be deleted from the dashboard, and disconnecting a mailbox removes its credential. You can delete a mailbox, or your whole account, in Settings, once no subscription on it is active. To object to page counting, use Privacy choices at the foot of any page; no account is needed. To withdraw consent to optional analytics, use the same place. For everything else, write to [email protected]. You may also complain to the data protection authority where you live.

We will update this page when the service changes what it collects. For a material change we will email account holders before it takes effect. The date at the top tells you when the text last moved.