This policy explains how DiBeasi Global Investments LLC, doing business as SeatReaper ("SeatReaper", "we", "us"), handles personal information in SeatReaper.
Who this covers
- Account users: people at an MSP who sign up for or are invited to a SeatReaper workspace.
- People in connected tenants: employees of an MSP's clients whose license and usage data SeatReaper reads once a connector is set up. For that data the MSP decides what is processed and we act on the MSP's instructions as its service provider.
- Website visitors: people who browse the public site.
What we collect
| Information | Examples | Why |
|---|---|---|
| Account details | Name of your business, your email address, role, password (stored only as a hash by our authentication provider), two-step verification settings | To create your account, sign you in and keep it secure |
| Workspace data | Client names, Microsoft 365 tenant IDs, N-central customer IDs, Cove customer names, team members, invites, branding and logos | To provide the service you set up |
| Connected-tool data | User names and emails, license assignments, last sign-in dates, mailbox and device status from the tools you connect | To find unused licenses and estimate their cost |
| Support requests | What you write to us and our replies | To help you |
| Assistant conversations | Questions you ask the in-app AI assistant and its answers, kept for 90 days | To answer you, stop abuse of the assistant and improve our help articles |
| Audit log | Who changed what in your workspace and when, including support actions and their reasons | Security and accountability for you and us |
| Billing | Plan, billing status and the Stripe customer reference | To bill you. Card details are handled by Stripe, never by us |
| Technical data | IP address, browser type and sign-in sessions | Security, abuse prevention and showing you your active sessions |
| Website visits | On the public site and the sign-in pages: the page, the campaign tags in the link and the site you came from, with a visitor code (see below) | To see how people find SeatReaper |
| How you heard about us | Your optional answer when you set up a workspace | To see how people find SeatReaper |
We do not sell personal information, and we do not use it for advertising.
Cookies
SeatReaper uses only the cookies needed to keep you signed in and secure, and two that remember the language and currency you pick. It does not use advertising or analytics cookies.
Counting website visits
To see how people find SeatReaper, our own server records visits to the public site and the sign-in pages: the page, any campaign tags in the link (such as utm_source), the name of the site you came from, and which marked buttons were clicked. Each visit gets a visitor code made from your IP address, your browser's user agent and a random value that we replace every day and then delete, so the code cannot be turned back into your IP address or linked to your visits on another day. We do not store your IP address or user agent for this, we set no cookie and use nothing stored in your browser, and no other company receives this information. If your browser sends Global Privacy Control or Do Not Track, your visits are not counted. These records are deleted after 400 days.
When you set up a workspace, we note which site or campaign that day's visit came from and your optional answer to "How did you hear about SeatReaper?". Only SeatReaper's staff see this.
Where it is stored and who processes it
Your workspace data and authentication data are stored in Canada (Montreal). We use these service providers to run SeatReaper:
| Provider | What they do |
|---|---|
| Supabase | Database and authentication |
| Vercel | Hosting the application |
| Stripe | Payments and invoices |
| Resend | Sending email: sign-up and password emails, and the security alerts, weekly digests and scheduled reports you turn on |
| Anthropic | Answering questions you ask the in-app AI assistant (it receives your question, not your workspace or client data) |
They may process information in other countries, including the United States, under their own security and privacy commitments. The current list, with locations, is on Subprocessors; we list new providers there before they process your data. Customers who need one can rely on our Data Processing Addendum.
How long we keep it
We keep account and workspace data while your account is active. After an account is closed we delete or anonymize its workspace data within 90 days, except where we must keep records for legal, tax or security reasons. Data held in our providers' backups is removed on their normal backup cycle.
Security
Data is encrypted in transit and at rest by our providers. Access to each workspace is separated in the database itself, two-step verification is available to every user and required for our staff, and every staff action in a workspace is recorded in that workspace's audit log. See Security and data.
Your choices and rights
Account owners can see and change most information in the app and export the audit log. To access, correct, export or delete personal information, email us. If you are an employee of an MSP's client, please contact that MSP first; we will help them respond. Depending on where you live you may have further rights under local law, including the right to complain to a data protection authority.
Children
SeatReaper is a business tool and is not directed to children. We do not knowingly collect information from anyone under 16.
Changes
We will post changes here and update the date below. If a change is material we will tell account owners before it takes effect.
Contact
DiBeasi Global Investments LLC, doing business as SeatReaper, Lombard, Illinois. Email: support@seatreaper.com.