Privacy Policy

This policy covers two kinds of accounts:

• Provider accounts — the business owner and their team (workers, branch managers, account managers) who use Sebafy to run jobs, invoicing, and dispatch.
• Customer accounts — the end customers of a provider, who use Sebafy to view their job history and, optionally, set up a customer wallet.

• Account information — name, phone number, and (for provider accounts) email address and a hashed password. Customer accounts log in by phone number; a password is only created if the customer chooses to set one up for their wallet.
• Business data a provider enters — job records, service descriptions, prices, invoices, notes, and the name, phone number, and address of their customers.
• Payment amounts, not payment details — Sebafy does not process payments. Providers log the amounts they've collected (cash, bank transfer, or a manual payment link they configure themselves, e.g. Zelle or Venmo). We never see or store card numbers, bank credentials, or other payment instrument data.
• Photos you choose to upload — e.g. job-completion photos or a customer's signature, which a provider's team may attach to a job record.
• Usage data — we use privacy-focused, cookie-free page analytics (Vercel Analytics) to understand aggregate traffic to this site. It does not track you across other sites.

• To operate the core product — job dispatch, scheduling, invoicing, and the customer-facing booking page.
• To send SMS notifications you or your provider opted into (appointment reminders, one-time login/reset codes) via our SMS provider, Twilio.
• To send account emails (e.g. password reset) via our email provider, Brevo.
• To keep the service secure — session cookies that keep you logged in, and fraud/abuse prevention.
• We do not sell personal data, and we do not use your data to train third-party AI models.

A customer's job history and contact details are only visible to the specific provider(s) that customer has actually done business with — not to every business on Sebafy. Within a provider's account, access to customer and financial data is limited to that provider's own team, based on their role (owner, branch manager, account manager, or technician).

We share data with a small number of infrastructure and communication vendors strictly to run the service: our hosting provider (Vercel), our database infrastructure, our SMS provider (Twilio), and our email provider (Brevo). These vendors process data only on our behalf and under their own confidentiality and security obligations — we do not permit them to use it for their own purposes.

We use a small number of essential session cookies (one for provider logins, one for customer logins) that keep you signed in. These are functional, not advertising or cross-site tracking cookies. We do not use third-party ad-tracking cookies.

We keep account and job data for as long as the account is active, so providers retain their business records. A provider can export their data (jobs, invoices, customer records) as CSV or PDF at any time. To request deletion of your account or personal data, contact us using the details below — we will act on the request, subject to any records we're legally required to retain.

Passwords are stored as one-way hashes, never in plain text. Access to production data is limited to the people who need it to operate the service. No system is 100% secure, and we cannot guarantee absolute security, but we take reasonable technical and organizational measures to protect your data.

Sebafy is a business tool and is not directed at, or knowingly used by, children under 16.

We may update this policy as the product changes. We'll update the effective date above when we do. Material changes will be communicated to provider accounts directly.

Questions about this policy or a request about your data? Reach us at [email protected] or WhatsApp.