Seatext

GDPR overview

GDPR and CCPA compliance is claimed in as many words in the translation FAQ, on the technical argument that translations are processed in memory without storing personal visitor data. The documentation behind the claim is unusually complete for this price point: a published data processing addendum dated 2026-07-21, EU Standard Contractual Clauses (Module Two and Module Three) plus the UK Addendum, a named subprocessor annex, breach notification without undue delay and where feasible within 48 hours, 30 days' notice before a new subprocessor, one customer audit per twelve-month period, and deletion within 60 days of termination. Legal bases cited are contract, legitimate interests, consent and legal obligation, and the full list of data subject rights is set out. Two gaps stand out: no Article 27 EU representative is designated, and no data protection officer is named — every request goes to one personal mailbox.

Who owns the data?

Ownership is split, and the contracting entity is not consistent across the site. The terms are signed with Seatext Corp, a Delaware corporation, while the privacy policy and the data processing addendum both name Seatext LLC. Seatext retains all rights in the service and its intellectual property. Content you submit or create through the platform remains yours, but you grant Seatext a non-exclusive, royalty-free licence to use, reproduce, adapt, publish, translate and distribute it in order to deliver the service. Under the addendum the customer is the controller and Seatext the processor, acting on documented instructions only. Data can be exported during the term, and is returned or deleted within sixty days of termination at the customer's written choice.

Reuse rights

Whatever the agents produce on your own domain is yours to keep and reuse without asking: translations, copy variants, generated question-and-answer pages and product descriptions are published on your site and remain editable in the in-context visual editor, with a glossary, a notranslate class and URL exclusion rules to keep designated blocks untouched. The traffic runs the other way too. The privacy policy states plainly that customer data, visitor interaction data, website text, translation data, experiment data and bot-detection signals are used to develop, test, evaluate and improve Seatext's products, algorithms, analytics and machine-learning models, and no opt-out is documented anywhere. Seatext undertakes not to sell customer content to third parties for model training and not to let third parties train their own models on it without express authorisation; the two named subprocessors are MongoDB, Inc. for storage and Google LLC for Gemini LLM processing. Customer names and logos may also be used promotionally unless you object in writing.

Data retention & training

Hosting summary

The privacy policy and the data processing addendum both state that personal data may be processed and stored in the United States and in any other country where Seatext, its service providers or its infrastructure providers operate. No other country is named, and customers cannot choose a hosting region. Transfers out of the European Economic Area, the United Kingdom or Switzerland to jurisdictions without an adequacy decision rely on Standard Contractual Clauses or other approved mechanisms where required; the addendum incorporates Module Two and Module Three of the EU clauses plus the UK Addendum. Two subprocessors are named: MongoDB, Inc. holds service data, and Google LLC performs Gemini LLM processing for enabled AI features. Translation itself is described as running in memory at the Cloudflare network edge without storing personal visitor data, which is a vendor claim rather than a contractual commitment. The site's own IP address resolves to a Cloudflare anycast node and therefore says nothing about where data actually rests.