What personal data Seamix AI collects, why we are allowed to process it, who it is shared with, where it is stored, how long we keep it, and the rights you can exercise.
Last updated: 14 August 2026 // Version 1.0 // Governing law: the laws of England and Wales
Seamix AI is the controller of the personal data described in this notice. Our identity and postal address are published in full on the Company Information page.
This notice explains how we handle personal data when you visit our website, create an account, use the Studio, or contact us. It applies to the UK GDPR and the Data Protection Act 2018, to the EU GDPR where it applies to you, and to United States state privacy laws including the California Consumer Privacy Act as amended by the CPRA.
Questions, requests and complaints: privacy@seamix.ai. We have not appointed a statutory Data Protection Officer because we are not required to; privacy requests are handled by our privacy contact.
We do not intentionally collect special category data such as health, ethnicity, religion, political opinion, sexual orientation or genetic or biometric data, and you should not submit it. Please do not upload photographs of identifiable people unless you have their permission.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and operate your account, authenticate you, and provide the Studio | Account, profile, design content, Output | Performance of a contract |
| Generate technical documents by sending your brief and references to our AI provider | Design content, measurement data | Performance of a contract |
| Take payment, manage subscriptions, meter allowances and issue invoices | Payment, usage and metering records | Performance of a contract |
| Keep the Service secure: authentication checks, quota and rate limiting, abuse and fraud prevention, incident investigation | Technical and security logs, usage records, account data | Legitimate interests in protecting the Service and our users |
| Provide support and respond to your messages | Support data, account data | Performance of a contract and legitimate interests |
| Understand which features are used so we can improve the product | Analytics identifiers and events | Consent |
| Send product or marketing email | Email address | Consent, which you may withdraw at any time |
| Keep accounting, tax and transaction records, and respond to lawful requests | Payment records, account data | Compliance with a legal obligation |
| Establish, exercise or defend legal claims | Any relevant data | Legitimate interests and legal obligation |
Where we rely on legitimate interests we have balanced those interests against your rights, and we only process what is necessary for the stated purpose. You may object to that processing using the contact details in this notice.
To generate Output we transmit your brief, your refinement answers, any reference images you upload and relevant document context to Google as our AI inference provider, through the Google Gemini API on a paid service tier.
Full detail about model behaviour, provenance marking and the limits of Output is set out in the AI Transparency and Output Policy.
The Service runs on Google Cloud infrastructure. Application hosting, the Firestore database and file storage are provisioned in the Google Cloud region us-east4, located in Northern Virginia, United States. Model inference and analytics are also processed on Google infrastructure outside the United Kingdom and the European Economic Area.
This means that if you are in the United Kingdom or the EEA, your personal data is transferred to the United States. We rely on the following safeguards for those transfers:
You may request a copy of the transfer safeguards that apply to your data by emailing privacy@seamix.ai.
| Category | Retention |
|---|---|
| Account and profile data | For as long as your account is open, then deleted when you delete the account |
| Design content, uploads and generated Output | Until you delete the item or the account; removed from live systems on deletion |
| Routine encrypted backups | Overwritten on our providers' standard cycle, normally within 30 to 90 days of deletion |
| Usage, metering and credit ledger records | Up to 24 months, for billing accuracy, dispute handling and abuse prevention |
| Technical and security logs | Normally 30 days, longer only where an incident is under investigation |
| Payment, invoice and tax records | 6 years after the end of the relevant financial year, as required by tax law |
| Support correspondence | 24 months from the last message |
| Records of consent and of privacy requests | As long as needed to evidence compliance, normally 3 years |
You can delete your account yourself from your profile. Deletion is not instantaneous across encrypted backups, and we may retain the minimum data needed to meet a legal obligation, to prevent repeat abuse, or to defend a legal claim.
We take security seriously and describe our actual controls rather than making unverifiable claims. Current measures include:
Seamix AI does not itself hold an ISO 27001 certificate or a SOC 2 report. Our infrastructure providers hold their own certifications, which do not transfer to us. No internet service can be guaranteed to be completely secure.
If a personal data breach is likely to result in a risk to your rights, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it and will tell affected users without undue delay where the risk is high.
To exercise a right, email privacy@seamix.ai. We will respond within one month and may extend by two further months for complex requests, telling you if we do. We may ask you to confirm your identity. Exercising your rights is free unless a request is manifestly unfounded or excessive.
You can complain to the Information Commissioner's Office at ico.org.uk, or to the supervisory authority in your EEA country of residence. We would appreciate the chance to address your concern first.
If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas or another state with a comprehensive privacy law, this section applies to you in addition to the rest of this notice.
Send state privacy requests to privacy@seamix.ai with the subject line State Privacy Request.
The Service is a professional tool intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@seamix.ai and we will delete it.
We will update this notice when our processing changes. The version and date at the top always reflect the current text. For changes that materially affect how we use your personal data we will give notice by email or in the product before they take effect, and where the law requires it we will ask for fresh consent.