Privacy Policy

Effective date: 1 April 2026

This Privacy Policy explains how CONFIG MONEY LIMITED ("Sepal", "we", "us", or "our") collects, uses, and protects your personal information when you use our products and services. Sepal provides virtual email addresses, phone numbers, and payment cards designed to give you control over your personal data.

1. Information We Collect

We collect the minimum information necessary to provide and improve our services:

• Account information — your email address, name, and password when you create an account.
• Payment information — billing details required to process your subscription, handled securely by our payment processor.
• Usage data — how you interact with Sepal, including features used, virtual identities created, and general activity patterns. This helps us maintain and improve the service.
• Device and technical data — browser type, operating system, IP address, and similar technical information collected automatically when you access our services.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Sepal service.
• Process transactions and manage your account.
• Send service-related communications (such as security alerts and account updates).
• Detect and prevent fraud, abuse, and security threats.
• Improve our products based on aggregated, anonymised usage patterns.

We do not sell, rent, or trade your personal information to third parties. We do not use your data for advertising. The virtual identities you create through Sepal are yours — we do not mine or monetise them.

3. Data Storage and Security

Protecting your data is core to what Sepal does. We apply the following measures:

• All data is encrypted in transit (TLS) and at rest (AES-256).
• We use a zero-knowledge architecture where possible — for certain features, we cannot access your underlying data even if compelled to.
• Access to production systems is restricted to authorised personnel and protected by multi-factor authentication.
• We conduct regular security reviews and follow industry best practices for data protection.

Your data is stored on servers located within the United Kingdom and the European Economic Area.

4. Cookies

We use a small number of cookies strictly necessary for the functioning of our service:

• Authentication cookies — to keep you signed in and maintain your session.
• Preference cookies — to remember your settings and choices.

We do not use third-party advertising or tracking cookies. We do not participate in cross-site tracking.

5. Third-Party Services

We work with a limited number of third-party providers to operate our service:

• Payment processing — to handle subscription billing securely. Your full payment details are processed by our payment provider and are not stored on our servers.
• Infrastructure providers — to host and deliver the service reliably.
• Transactional email — to send you account-related messages.

Each third-party provider is contractually bound to process your data only as necessary to perform their service and in accordance with applicable data protection law.

6. Your Rights

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Restriction — ask us to limit how we process your data in certain circumstances.
• Objection — object to processing based on legitimate interests.

To exercise any of these rights, contact us at hello@sepal.email. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been infringed.

7. Data Retention

We retain your personal data only for as long as necessary to provide the service and fulfil the purposes described in this policy. When you delete your account, we remove your personal data within 30 days, except where we are required by law to retain certain records (for example, financial transaction records).

8. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Sepal dashboard before the changes take effect. The "Effective date" at the top of this page indicates when the policy was last revised.

9. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us:

CONFIG MONEY LIMITED
Company No. 16474180
124-128 City Road, London, EC1V 2NX
Email: hello@sepal.email