Privacy Policy

Seamind LLC (“Company,” “we,” “our,” or “us”) respects your privacy and is committed to protecting it through this Privacy Policy. This policy describes how we collect, use, disclose, and safeguard your information when you visit our website at seamind.xyz (the “Site”) and use our maritime learning, crew management, and fleet operations platform (the “Platform”). If you do not agree with this policy, please do not use the Site or Platform.

A. Information You Provide to Us

• First name and last name
• Work email address
• Company or organization name
• Any information you submit through our contact form (including messages)
• Information provided when signing up for demos or early access

B. Information Collected Through Authentication

When you sign in to the Platform, we collect profile information through our authentication provider, WorkOS, including your name, email address, email verification status, profile picture, organizational membership, and role.

C. Learning Activity Data

When you use the Platform for training, we collect learning activity data in accordance with the xAPI (Experience API) standard, including:

• Course progress and completion status
• Quiz responses, scores, and time spent on assessments
• Session duration and activity timestamps
• Training module interactions and navigation

D. Crew and Professional Profile Data

Where your organization uses our crew management product, we collect and process professional and identity information that you or your organization's administrators provide, which may be sensitive. This can include:

• Identity documents, such as passports, seafarer's identification documents (seaman's books), and other government-issued IDs
• Professional certificates and credentials (for example, STCW certificates, licenses, and medical certificates), including their issue and expiry dates and verification status
• Employment and sea-service history, such as rank or position, vessel assignments, and embarkation and disembarkation dates
• Next-of-kin and emergency contact details
• Profile photographs and contact information

Why we collect it: to operate crew management for your organization — building and maintaining crew profiles, verifying documents and certificates, supporting office review and approval workflows, and meeting maritime compliance, audit, and fleet management requirements.

Legal basis:we process this data as a processor on behalf of your organization. Where the GDPR or UK GDPR applies, our lawful bases are the performance of a contract with your organization, compliance with legal obligations (including maritime regulatory requirements), and our legitimate interests in operating the Platform. Any special-category or otherwise sensitive data is processed only as permitted by applicable law and your organization's instructions.

E. Automatically Collected Information

When you visit the Site, we may automatically collect:

• IP address
• Browser type
• Device information
• Pages visited
• Time spent on pages
• Referring URLs

This data is collected via Vercel Analytics, our web analytics service.

We may use the information we collect to:

• Provide and operate the Platform, including delivering training content and tracking progress
• Generate AI-powered learning insights based on your training performance
• Provide fleet-wide analytics and compliance reporting to your organization
• Respond to inquiries and contact requests
• Improve the Site, Platform, and user experience
• Analyze traffic and usage patterns
• Comply with legal obligations, including maritime training compliance requirements

We do not sell your personal information.

The Platform includes AI-powered features such as an AI tutor and personalized learning insights. When you use these features:

• AI Chat: Your messages and relevant course context are sent to our AI service providers to generate responses. We do not send your email address or other personal identifiers to AI providers.
• Learning Insights: Aggregated performance data (such as course completion rates, quiz scores, and time spent) may be processed by AI services to generate personalized learning recommendations. Raw personal data is not shared.
• Document Search:Training content and, where your organization uses our crew management product, uploaded credential documents are indexed for AI-assisted search using Amazon Bedrock, entirely within our AWS environment. Search results follow the same permission model as the rest of the Platform: staff can search only their own organization's documents, and crew members only their own.

Where the AI assistant can surface platform data — such as crew profiles, credentials, or analytics — it operates within the following guardrails:

• It acts only within your own permissions and organization, and can access only the data you are already authorized to see.
• It uses a fixed, approved set of tools and cannot take actions outside them.
• Any change to your data requires human approval; the assistant does not make changes on its own.
• Your data is not used to train third-party AI models.

We use cookies for the following purposes:

• Authentication cookies: To maintain your signed-in session on the Platform
• Content delivery cookies: Signed cookies used to securely deliver training content via our CDN

We use Vercel Analytics for website usage analysis. You can disable cookies in your browser settings, though some features of the Platform may not function properly if cookies are disabled.

We use the following third-party service providers (“subprocessors”) to operate the Platform. Each processes data only on our behalf, under a data-processing agreement, and is not permitted to use it for its own purposes:

• Vercel — Website and application hosting, deployment, and web analytics; also routes AI requests through the Vercel AI Gateway
• Amazon Web Services (AWS) — Core cloud infrastructure, databases, and encrypted content storage (United States region)
• Amazon CloudFront — Content delivery network (part of AWS) used to securely deliver training content
• Amazon Bedrock — AI document processing, indexing, and search (part of AWS; data remains within our AWS environment and is not used to train foundation models)
• Amazon Simple Email Service (SES) — Delivery of transactional and notification emails (part of AWS)
• WorkOS — Authentication, single sign-on, and identity management
• OpenAI — AI-powered chat, learning insights, document analysis, and voice transcription. Processed under an agreement that prohibits use of your data to train models
• Braintrust — Monitoring and quality evaluation of AI features
• Cloudflare — Bot and abuse protection, and secure access for API integrations
• ClickHouse Cloud — Analytics database that stores learning, usage, and product-interaction data

A current list of subprocessors is available on request, and we will provide notice of material changes. These providers may process data on our behalf but are not permitted to use it for their own purposes. We are not responsible for the privacy practices of third-party websites linked from our Site.

We retain personal information according to the following schedule:

• User account data: Retained while your account is active and for a reasonable period thereafter
• Learning analytics: Retained for 2–3 years in our analytics database for reporting and compliance purposes
• Training records archive: Retained for 7 or more years to support maritime compliance auditing requirements
• Crew and professional profile data: Retained for as long as your organization maintains an active account, and thereafter only as required to meet maritime compliance and audit obligations
• Contact form submissions: Retained only as long as necessary to respond and follow up

Deletion on termination:When your organization's subscription ends, we delete or return personal data we hold on its behalf in accordance with our agreement with your organization, except for records we are legally required to retain. Personal data contained in routine backups is not immediately purged; instead, those backups age out and are overwritten on their normal backup cycle.

We implement reasonable administrative, technical, and organizational safeguards to protect your information, including:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Encryption of data at rest
• JWT-based authentication with cryptographic token signing
• Role-based, least-privilege access controls
• Multi-tenant data isolation scoped by organization
• Automated malware scanning of uploaded files
• A web application firewall (WAF) and rate limiting to prevent abuse
• Continuous monitoring and logging of access and activity

However, no system is 100% secure. We cannot guarantee absolute security.

The Platform is hosted in the United States (Amazon Web Services, US East / us-east-1 region), and your information is stored and processed there. If you access the Site or Platform from outside the United States, your information will be transferred to and processed in the United States.

For customers and users in the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable) as the mechanism for transferring personal data to the United States. A copy of the relevant safeguards is available on request at support@seamind.xyz.

Depending on your jurisdiction, you may have some or all of the following rights with respect to your personal information:

• Access your personal information and request a copy of it
• Correct inaccurate or incomplete data
• Request deletion of your data
• Object to or restrict processing
• Data portability — receive your data in a portable format
• Withdraw consent where processing is based on consent

EEA / UK (GDPR and UK GDPR): in addition to the rights above, you have the right to lodge a complaint with your local data protection supervisory authority. Where we act as a processor on behalf of your organization, we will direct certain requests to your organization as the controller.

California (CCPA/CPRA):you have the right to know what personal information we collect and how it is used and shared, the right to delete and to correct your personal information, the right to opt out of any “sale” or “sharing” of personal information, and the right not to be discriminated against for exercising these rights. We do not sell your personal information.

To exercise these rights, contact us at: support@seamind.xyz

The Site and Platform are not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date.

If you have questions about this Privacy Policy, contact:

Seamind LLC
Email: support@seamind.xyz