Your privacy matters to us. This policy explains, in plain English, what personal data SEAYA collects, why we collect it, who we share it with, how long we keep it and the choices and rights you have.
1.Who is responsible for your data
The controller of your personal data is 3XAYA LTD, a company registered in England and Wales, with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom ("we", "us", "our").
For any question about privacy or to exercise your rights, contact us at hello@3xaya.com. We read every message and will reply as soon as we can.
2.What this policy covers
This policy explains how we handle personal data when you visit seaya.ai, use SEAYA as a guest or with an account, use our desktop or mobile apps, buy a plan or credits, or contact us. It should be read together with our Terms of Service and our Cookie Policy.
3.The data we collect
Account data
When you create an account, we collect your email address and the authentication data needed to sign you in securely. We also keep your plan, settings and preferences.
Chats and content
- Chats. If you are signed in, your conversations (your messages and SEAYA's answers) are saved to your account so you can come back to them. If you use SEAYA as a guest, your chats stay in your browser and are not saved to an account.
- Attached files. Files you attach are processed to answer your request. We do not store the contents of attachments; we only keep their file names as part of the chat.
- Memory. If you use the memory feature, SEAYA saves facts that it remembers about you to make future answers more useful. You can view and delete your memories at any time.
- Projects. If you organise chats in projects, we store the projects and what you add to them.
- Shared links. If you share a chat, we store the shared copy so that anyone with the link can view it. It stays public until you delete it.
Please avoid sharing sensitive information (for example about your health, beliefs or finances) or personal data about other people unless it is needed for what you are asking. If you do, we process it only to provide the Service to you.
Usage data
We keep records of how much you use the Service (for example the number of requests and the amount of usage counted against your allowance or credits) so we can apply plan limits, bill correctly and prevent abuse.
Billing data
Payments are handled by Stripe. We receive and keep billing records, such as your plan, payment status, invoices, and the country and tax details needed to calculate tax. We never see or store your full card details.
Technical data
Like any online service, our servers process technical data such as your IP address, browser and device type, and timestamps when you connect, to deliver the Service, keep it secure and fix problems. Cookies and local storage are described in our Cookie Policy.
Messages to us
If you email us, we keep your message and our reply so we can help you.
4.How we use your data and our legal bases
Under UK GDPR and EU GDPR we must have a legal basis for each use of personal data. We use your data as follows:
| Purpose | Legal basis |
|---|---|
| Providing the Service: creating your account, signing you in, answering your messages, reading your files, running web searches and the SEAYA Agent, saving chats, memory, projects and shared links | Performance of our contract with you |
| Applying plan allowances and credits, taking payments, automatic renewals and top-ups, invoicing and tax | Performance of our contract; compliance with legal obligations (tax and accounting) |
| Sending transactional emails, such as sign-in links, account confirmations, receipts and important notices about the Service or these policies | Performance of our contract; legitimate interests in keeping you informed |
| Providing a free guest allowance and preventing abuse, fraud and misuse; keeping the Service secure | Legitimate interests in protecting our users and the Service |
| Fixing problems and improving the reliability and quality of the Service | Legitimate interests in running and improving the Service |
| Responding to your requests and complaints | Performance of our contract; legitimate interests; legal obligations |
| Complying with the law, and establishing or defending legal claims | Legal obligations; legitimate interests |
Where we rely on legitimate interests, we have balanced them against your rights, and you can object (see section 9). We do not sell your personal data, we do not use it for advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
5.How AI processing works
To generate an answer, SEAYA sends your prompt, the relevant parts of the conversation, your memories (if enabled) and any attached files to AI model providers that we use to run the AI models. They process this data on our behalf only to generate the response and return it to us, under contracts that protect your data.
When you use web search or the SEAYA Agent, the Service fetches public web pages to complete your request. The Agent works in a private cloud browser that we run for you. Websites you or the Agent visit will receive the usual technical information from that browser (such as its IP address), and anything the Agent types into a website at your request is shared with that website, which handles it under its own privacy policy.
7.International transfers
We store your account data in the European Union. Some providers, such as AI model providers and Stripe, may process data outside the UK and the European Economic Area, including in the United States. Where this happens, we make sure appropriate safeguards are in place, such as adequacy decisions or the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum. You can contact us for more information about these safeguards.
8.How long we keep data
- Account data is kept while your account is open and deleted when you ask us to delete your account.
- Chats, memories and projects are kept until you delete them, or until your account is deleted. You can delete a single chat, all chats or your memories at any time in the app.
- Shared links stay available until you delete the shared link or the chat.
- Guest chats stay in your browser until you clear them or your browser data.
- Attachment contents are not stored after your request is processed; only file names are kept with the chat.
- Usage and billing records are kept for as long as needed to run your account and, for billing records, as long as tax and accounting law requires.
- Emails with us are kept as long as needed to deal with your request and any follow-up.
9.Your rights
Under UK GDPR and EU GDPR you have the right to:
- access your personal data and receive a copy of it;
- rectify data that is inaccurate or incomplete;
- erase your data ("right to be forgotten");
- restrict how we use your data in certain cases;
- data portability: receive the data you gave us in a structured, machine-readable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time, where we rely on consent.
You can delete chats, all chats and memories yourself in the app. To delete your account, to get a copy of your data, or to exercise any other right, email us at hello@3xaya.com. We may need to confirm your identity, and we will reply within one month (this can be extended in some cases, and we will tell you if so).
You also have the right to complain to a data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk). In the EU you can complain to the authority in the country where you live or work. We would appreciate the chance to deal with your concern first, so please contact us.
10.Security
We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls that limit who can access your account data, and providers with strong security practices. No system is completely secure, so please keep your login details safe and tell us at hello@3xaya.com if you notice anything suspicious.
11.Children
SEAYA is not intended for children under 13. In parts of the EU where the law requires it, users under 16 need the consent of a parent or guardian. If you believe a child has given us personal data without the required consent, contact us at hello@3xaya.com and we will delete it.
12.Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top shows when it was last changed. If we make significant changes, we will tell you by email or in the app before they take effect.
13.Contact us
3XAYA LTD, 128 City Road, London, EC1V 2NX, United Kingdom. Email: hello@3xaya.com.