Last updated: 2026-06-04
Policy scope: This policy covers the data SeaLink currently processes: account, billing, usage analytics, error diagnosis, and customer-enabled request snapshots.
For customer and data-subject clarity, we disclose personal information categories using common privacy-law category names: identifiers, commercial information, internet or electronic network activity, country/region-level location signal, and professional information if you provide it. We do not collect biometric information, and we do not sell or share personal information for cross-context behavioral advertising.
Default storage is in Singapore. Enterprise clients with dedicated residency requirements can define them in commercial and DPA terms.
When you call an AI model, SeaLink processes your prompt text through the selected model path to generate a response. SeaLink does not store prompt or completion content by default; we transmit only.
You can instruct SeaLink not to use your data for model training via the X-Training-Opt-Out request header or Dashboard privacy settings. SeaLink records and applies this preference where supported by the selected model path.
SeaLink applies automated content moderation to prompts to detect prompt injection attacks, personally identifiable information in 12 languages, and hate, harassment, or self-harm content in 8 Southeast Asian languages. When personal information is detected, it is masked before logging. Blocked requests log metadata only; prompt bodies are not stored.
AI model responses are generated by third-party providers and do not constitute automated decisions producing legal effects or similarly significant impacts on individuals. SeaLink does not use AI outputs for profiling or decision-making about individuals.
Payments: Airwallex. Email: Resend. Monitoring: Sentry. CDN: Cloudflare. See /legal/sub-processors.
You may access, export, correct, or delete your account data. Email contact@sealink.io.
SeaLink operates in six Southeast Asian jurisdictions and complies with each country's data protection legislation.
SeaLink is headquartered in Singapore and complies with the Personal Data Protection Act 2012 and PDPC advisory guidelines. Data subjects may exercise access rights via GET /v1/me/data and erasure rights via DELETE /v1/me/data. Data Protection Officer: contact@sealink.io.
Complies with Indonesia's Personal Data Protection Law, including data subject rights, breach notification, and records of processing activities. Indonesian users may submit data requests through the same GDPR-equivalent rights mechanisms.
Complies with Thailand's Personal Data Protection Act B.E. 2562, including consent management and sensitive data classification. For minors, consent must be provided by a parent or guardian before collecting personal data. Thai data subjects have rights of access, portability, rectification, and erasure.
Complies with the Philippines Data Privacy Act of 2012 and National Privacy Commission circulars, including data subject rights, security incident notification, and the right to file complaints with the NPC.
Complies with Malaysia's Personal Data Protection Act 2010, including notice and choice obligations, data integrity principles, and statutory access and correction rights.
Complies with Vietnam's PDPL Decree 13/2023/ND-CP, including data subject rights, breach notification, and cross-border data transfer obligations.
SeaLink complies with the General Data Protection Regulation for EU data subjects. Legal bases for processing include contractual necessity to provide the service and legitimate interests for security and fraud prevention, where not overridden by fundamental rights and freedoms.
EU data subject rights include access, rectification, erasure, restriction, data portability, objection, and automated decision-making opt-out. These are exercisable via GET/DELETE/PATCH /v1/me/data. For additional GDPR-specific requests, email contact@sealink.io.
SeaLink is a Singapore company and uses Singapore PDPA and customer contracts as the primary data-protection framework. Where your local law provides additional rights, you may exercise them via contact@sealink.io, /legal/privacy-choices, or the GET/DELETE /v1/me/data API. SeaLink does not sell or share personal information as defined under CCPA/CPRA.
Usage logs expire automatically after 90 days by default. API Keys with Zero Data Retention mode enabled have their usage records purged every 24 hours. Account deletion is permanent and irreversible.
Cross-border data transfers use Singapore as the default storage region. Customers may negotiate dedicated data residency requirements in commercial terms and Data Processing Agreements.
DPO: contact@sealink.io / Privacy inquiries: contact@sealink.io / Security issues: contact@sealink.io / API data access: GET /v1/me/data
