Loading…
Loading…
Last updated: July 2026
Seba Wati Ltd (“we”, “us”, or “our”) is the data controller for the personal data described here. This Privacy Policy explains how we collect, use, store, and share your personal information when you use our website, mobile application, and services.
Seba Wati Ltd is established in Cairo, Egypt. You can reach us about anything in this policy at privacy@sebawati.com, or through our contact page. Section 9 explains the rights you have and how to exercise them, including your right to complain to a data protection authority.
When you create an account, we collect your name, email address, and password (stored securely via AWS Cognito). If you sign in via a social provider, we receive your name and email from that provider.
When you place an order, we collect your shipping address, billing address, and payment details. Payment card data is processed by our PCI-DSS compliant payment processors and is never stored on our servers.
When you activate a notebook, we record the verification code, your account identifier, and a timestamp on an append-only audit log. The record itself is retained permanently because it is the authenticity proof for a physical notebook that continues to exist — but if you ask us to erase your data, your account identifier is removed from it (see Section 8).
We may collect information about how you interact with the Service, including pages visited, features used, and device information (browser type, operating system, screen resolution), and for completed purchases the order reference, amount and item names. This is collected only if you accept analytics cookies.
If you write to us through the contact form or by email, we receive your name, your email address and whatever you tell us in the message. It is delivered to our support mailbox; we do not store contact-form messages in a database.
If you use the digital notebook, the page text, photographs and handwritten drawings you create are stored on our servers so they are available across your devices. We do not read this content, and it is not used for analytics, advertising or training. If you transfer a notebook to someone else, the pages travel with it unless you choose to erase them first — you are asked to confirm this at the point of transfer.
The night-sky feature can draw the sky above where you actually are. If — and only if — you grant location permission in your browser or on your device, your coordinates are rounded to roughly 11 km and used to look up current cloud cover from Open-Meteo (see Section 4). We do not store your location on our servers. If you decline, a default location is used instead.
If you enable notifications in the mobile app, we store the device token Apple issues for your handset so we can send you order and activation updates. Tokens are deleted automatically 180 days after your device last registered.
Under the UK/EU General Data Protection Regulation we must have a lawful basis for each purpose. Ours are:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Process and fulfil your orders, and handle returns. | Account, order, shipping address | Performance of a contract (Art. 6(1)(b)) |
| Manage your account and provide customer support. | Account, order history | Performance of a contract (Art. 6(1)(b)) |
| Verify notebook authenticity through Red Wax™ activation, and store your notebook pages. | Activation record, notebook content | Performance of a contract (Art. 6(1)(b)) |
| Send transactional email (order confirmations, shipping updates). | Name, email, order details | Performance of a contract (Art. 6(1)(b)) |
| Send the newsletter. | Email address, and your birthday if you give one | Consent (Art. 6(1)(a)) — double opt-in, withdrawable at any time |
| Send push notifications about your orders and activations. | Device token | Consent (Art. 6(1)(a)) — given in the device permission prompt, withdrawable in system settings |
| Show the sky above your location. | Approximate location (rounded) | Consent (Art. 6(1)(a)) — the browser/device permission prompt |
| Understand aggregated site usage and improve the Service. | Usage and device data | Consent (Art. 6(1)(a)) — analytics cookies, withdrawable via “Cookie preferences” |
| Prevent fraud and abuse, and keep the Service secure. | IP address, request metadata | Legitimate interests (Art. 6(1)(f)) — protecting the Service and our customers against fraud and misuse, which we consider not to override your rights because the data is limited to security telemetry, is not used to build any profile of you, and is retained only for the periods stated in Section 8 |
| Respond to an enquiry you send us through the contact form. | Your name, email address and the message text | Performance of a contract (Art. 6(1)(b)) where the enquiry concerns an order; otherwise legitimate interests (Art. 6(1)(f)) — answering someone who chose to contact us |
| Keep accounting and tax records. | Order records | Legal obligation (Art. 6(1)(c)) |
Where we rely on consent, you can withdraw it at any time, and doing so is as easy as giving it — withdrawal does not affect processing that already took place. Providing the data needed to fulfil an order is necessary to enter into the contract; without it we cannot ship to you. We will not sell your personal information. We do not use your data for automated decision-making or profiling.
We share personal information with the following sub-processors, who help us operate the Service under contractual confidentiality and data-protection obligations:
Each sub-processor is bound by its own privacy terms governing how it handles data we share. We may also disclose information when required by law, court order, or to protect our rights.
We are established in Egypt, which the European Commission has not found to provide an adequate level of data protection, and our staff access customer data from there. Our infrastructure runs in Amazon Web Services' US East (N. Virginia) region, and the providers listed in Section 4 — Amazon Web Services, PayPal, Resend, Google, Apple and Open-Meteo — are located outside the United Kingdom and the European Economic Area, principally in the United States. This means that if you are in the UK or the EEA, your personal data is transferred to a third country.
For those transfers we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where the UK GDPR applies), incorporated into each provider's data processing agreement, together with any adequacy decision that applies to the recipient — including the EU–US and UK–US Data Privacy Framework where the provider is certified under it. We also apply the technical measures in Section 7, in particular encryption in transit and at rest.
You may request a copy of the safeguards relied on for a particular transfer by emailing privacy@sebawati.com.
We use cookies and similar technologies to maintain your session, remember your preferences, and understand how you use the Service. For full details, see our Cookie Policy.
We implement appropriate technical and organisational measures to protect your personal data, including:
We keep your personal data for as long as your account is open, and then only where a specific reason requires it. Concretely:
You can do this yourself from your account details, or by emailing us. We delete your sign-in identity (name, email, password or social login link), your saved addresses and display name, your cart, your membership, your push notification tokens, and your notebook pages together with the images and handwriting files behind them.
Two things survive, and we want to be precise about them rather than describe them as anonymous when they are not. Your order records are retained because tax and accounting law requires it, with your email address and shipping address scrubbed. Your activation records and the related audit-log entries are retained because they are the authenticity proof for physical notebooks that still exist and may change hands — but your account identifier is replaced in them with a fixed placeholder that is the same for every erased user, so the remaining entry cannot be linked back to you or joined up with anything else.
Depending on your location, you may have the following rights regarding your personal data:
To exercise any of these rights, please contact us, or email privacy@sebawati.com. We will respond within one month, as required by Article 12(3), and will tell you if we need to extend that period. Exercising these rights is free.
This section applies to California residents under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).
Personal information we collect. The categories described in Section 2, including identifiers (name, email, postal address), commercial information (purchase history), and internet activity (pages viewed, device and browser data). We collect this directly from you and automatically via cookies and analytics.
Sale or sharing of personal information. We do not sell your personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA. No opt-out is required.
Sensitive personal information. We do not use or disclose sensitive personal information for purposes that trigger the right to limit under §1798.121.
Your California rights. In addition to the rights listed in Section 9, California residents may:
How to exercise your rights. Email privacy@sebawati.com from the address on file, or contact us through the site. We will verify your identity before responding and reply within the statutory 45-day window (extendable by a further 45 days where reasonably necessary, with notice).
Financial incentives. We do not offer financial incentives in exchange for the collection, sale, or retention of personal information.
The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.
We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on the Service. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.
For questions about this Privacy Policy or how we handle your data, please contact us or email privacy@sebawati.com.