Privacy Policy

Seamind, Inc. (“Company,” “we,” “our,” or “us”) respects your privacy and is committed to protecting it through this Privacy Policy. This policy describes how we collect, use, disclose, and safeguard your information when you visit our website at seamind.xyz (the “Site”) and use our maritime learning, crew management, and fleet operations platform (the “Platform”). If you do not agree with this policy, please do not use the Site or Platform.

A. Information You Provide to Us

• First name and last name
• Work email address
• Company or organization name
• Any information you submit through our contact form (including messages)
• Information provided when signing up for demos or early access

B. Information Collected Through Authentication

When you sign in to the Platform, we collect profile information through our authentication provider, WorkOS, including your name, email address, email verification status, profile picture, organizational membership, and role.

C. Learning Activity Data

When you use the Platform for training, we collect learning activity data in accordance with the xAPI (Experience API) standard, including:

• Course progress and completion status
• Quiz responses, scores, and time spent on assessments
• Session duration and activity timestamps
• Training module interactions and navigation

D. Crew and Professional Profile Data

Where your organization uses our crew management product, we collect and process professional and identity information that you or your organization's administrators provide, which may be sensitive. This can include:

• Identity documents, such as passports, seafarer's identification documents (seaman's books), and other government-issued IDs
• Professional certificates and credentials (for example, STCW certificates, licenses, and medical certificates), including their issue and expiry dates and verification status
• Employment and sea-service history, such as rank or position, vessel assignments, and embarkation and disembarkation dates
• Next-of-kin and emergency contact details
• Profile photographs and contact information

Why we collect it: to operate crew management for your organization — building and maintaining crew profiles, verifying documents and certificates, supporting office review and approval workflows, and meeting maritime compliance, audit, and fleet management requirements.

Legal basis: we process this data as a processor on behalf of your organization. Where the GDPR or UK GDPR applies, our lawful bases are the performance of a contract with your organization, compliance with legal obligations (including maritime regulatory requirements), and our legitimate interests in operating the Platform. Any special-category or otherwise sensitive data is processed only as permitted by applicable law and your organization's instructions.

E. Automatically Collected Information

When you visit the Site, we may automatically collect:

• IP address
• Browser type
• Device information
• Pages visited
• Time spent on pages
• Referring URLs

This data is collected via Vercel Analytics, our web analytics service.

F. Mobile Application (iOS)

The Seamind iOS app provides the same Platform experience as the web application. With your permission, it uses the following capabilities on your device:

• Camera and photo library — so you can photograph or select certificates, travel documents, and profile photographs to upload to your crew profile.
• Microphone — only when you choose to dictate a message to the AI assistant. The recording is transcribed to text and is not retained as audio.

These permissions are requested only when you first use the relevant feature, and you can revoke them at any time in your device settings. The app does not use advertising identifiers and does not track you across other apps or websites.

We may use the information we collect to:

• Provide and operate the Platform, including delivering training content and tracking progress
• Generate AI-powered learning insights based on your training performance
• Provide fleet-wide analytics and compliance reporting to your organization
• Respond to inquiries and contact requests
• Improve the Site, Platform, and user experience
• Analyze traffic and usage patterns
• Comply with legal obligations, including maritime training compliance requirements

We do not sell your personal information.

The Platform includes AI-powered features such as an AI tutor and personalized learning insights. When you use these features:

• AI Chat: Your messages and relevant course context are sent to our AI service providers to generate responses. We do not send your email address or other personal identifiers to AI providers.
• Learning Insights: Aggregated performance data (such as course completion rates, quiz scores, and time spent) may be processed by AI services to generate personalized learning recommendations. Raw personal data is not shared.
• Document Search: Training content and, where your organization uses our crew management product, uploaded credential documents are indexed for AI-assisted search using Amazon Bedrock, entirely within our AWS environment. Search results follow the same permission model as the rest of the Platform: staff can search only their own organization's documents, and crew members only their own.

Where the AI assistant can surface platform data — such as crew profiles, credentials, or analytics — it operates within the following guardrails:

• It acts only within your own permissions and organization, and can access only the data you are already authorized to see.
• It uses a fixed, approved set of tools and cannot take actions outside them.
• Any change to your data requires human approval; the assistant does not make changes on its own.
• Your data is not used to train third-party AI models.

We use cookies for the following purposes:

• Authentication cookies: To maintain your signed-in session on the Platform
• Content delivery cookies: Signed cookies used to securely deliver training content via our CDN

We use Vercel Analytics for website usage analysis. You can disable cookies in your browser settings, though some features of the Platform may not function properly if cookies are disabled.

We use the following third-party service providers (“subprocessors”) to operate the Platform. Each processes data only on our behalf, under a data-processing agreement, and is not permitted to use it for its own purposes:

• Vercel — Website and application hosting, deployment, and web analytics; routes AI requests through the Vercel AI Gateway; and provides the isolated, short-lived sandbox environment used by the beta AI agent mode
• Amazon Web Services (AWS) — Core cloud infrastructure, databases, and encrypted content storage (United States region)
• Amazon CloudFront — Content delivery network (part of AWS) used to securely deliver training content
• Amazon Bedrock — AI document processing, indexing, and search (part of AWS; data remains within our AWS environment and is not used to train foundation models). This includes third-party foundation models operated inside Bedrock, such as Cohere's reranking model
• Amazon Simple Email Service (SES) — Delivery of transactional and notification emails (part of AWS)
• WorkOS — Authentication, single sign-on, and identity management
• OpenAI — AI-powered chat, learning insights, document analysis, and voice transcription. Processed under an agreement that prohibits use of your data to train models
• Braintrust — Monitoring and quality evaluation of AI features
• Cloudflare — Bot and abuse protection, and secure access for API integrations
• ClickHouse Cloud — Analytics database that stores learning, usage, and product-interaction data, including replicated copies of platform records used for reporting
• Kiwi.com — Optional flight-search tool available to crewing staff in the AI assistant. When you use it, the travel query you type (such as routes and dates) is sent to Kiwi.com to retrieve flight options. No crew profile data is sent automatically

The current list of subprocessors, with each provider's location and purpose, is published at seamind.xyz/subprocessors, and we will provide notice of material changes. These providers may process data on our behalf but are not permitted to use it for their own purposes. We are not responsible for the privacy practices of third-party websites linked from our Site.

We retain personal information according to the following schedule:

• User account data: Retained while your account is active and for a reasonable period thereafter
• AI assistant usage analytics: Automatically deleted from our analytics database after 2 years
• Learning analytics: Retained in our analytics database while your organization's account is active, for reporting and compliance purposes
• Training records: Retained for the life of your organization's account, and thereafter as required to support maritime compliance auditing requirements. Raw activity-statement archives are retained for at least 12 months
• Crew and professional profile data: Retained for as long as your organization maintains an active account, and thereafter only as required to meet maritime compliance and audit obligations
• Contact form submissions: Retained only as long as necessary to respond and follow up

Deletion on termination: When your organization's subscription ends, we delete or return personal data we hold on its behalf in accordance with our agreement with your organization, except for records we are legally required to retain. Personal data contained in routine backups is not immediately purged; instead, those backups age out and are overwritten on their normal backup cycle.

We implement reasonable administrative, technical, and organizational safeguards to protect your information, including:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Encryption of data at rest
• JWT-based authentication with cryptographic token signing
• Role-based, least-privilege access controls
• Multi-tenant data isolation scoped by organization
• Automated malware scanning of uploaded files
• A web application firewall (WAF) and rate limiting to prevent abuse
• Centralized, structured application logging with request correlation, and audit trails on sensitive records such as document verification, payroll, and contract events

However, no system is 100% secure. We cannot guarantee absolute security.

The Platform's core databases and file storage are hosted in the United States (Amazon Web Services, US East / us-east-1 region). Some of the service providers listed in Section 6 process data in their own United States-based environments outside our AWS account — including Vercel, WorkOS, OpenAI, ClickHouse Cloud, Braintrust, and Cloudflare. If you access the Site or Platform from outside the United States, your information will be transferred to and processed in the United States.

For customers and users in the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable) as the mechanism for transferring personal data to the United States. A copy of the relevant safeguards is available on request at support@seamind.xyz.

Singapore: where personal data is transferred out of Singapore to us, we contractually commit — through our data processing agreement with your organization — to provide a standard of protection comparable to the Personal Data Protection Act 2012 (PDPA), consistent with the PDPA's Transfer Limitation Obligation, and we impose equivalent obligations on our own service providers.

Depending on your jurisdiction, you may have some or all of the following rights with respect to your personal information:

• Access your personal information and request a copy of it
• Correct inaccurate or incomplete data
• Request deletion of your data
• Object to or restrict processing
• Data portability — receive your data in a portable format
• Withdraw consent where processing is based on consent

EEA / UK (GDPR and UK GDPR): in addition to the rights above, you have the right to lodge a complaint with your local data protection supervisory authority. Where we act as a processor on behalf of your organization, we will direct certain requests to your organization as the controller.

Singapore (PDPA): you have rights of access to and correction of your personal data, and the right to withdraw consent to its collection, use, or disclosure. Where we process your personal data as a data intermediary on behalf of your organization, we will refer your request to your organization and assist it in responding. You may also complain to the Personal Data Protection Commission (PDPC) of Singapore.

California (CCPA/CPRA): you have the right to know what personal information we collect and how it is used and shared, the right to delete and to correct your personal information, the right to opt out of any “sale” or “sharing” of personal information, and the right not to be discriminated against for exercising these rights. We do not sell your personal information.

To exercise these rights, contact us at: support@seamind.xyz

The Site and Platform are not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date.

If you have questions about this Privacy Policy, contact:

Seamind, Inc.
Email: support@seamind.xyz