Privacy
Scope and controller
This proposed policy covers SeaWeb websites, accounts, FastMCP/API tools, and publisher index tools. [COUNSEL: legal entity, notice address, controller role, and supported jurisdictions].
Proposed data inventory
Potential data includes website/security logs; account, authentication, API-key, support, and quota data; FastMCP queries, tool arguments, and returned identifiers; and publisher listings and contacts. SeaWeb does not receive raw payment card numbers. Stripe, Inc. processes checkout and subscription data for paid plans under its own terms and privacy policy.
Subprocessors and infrastructure
Verify actual vendors and data flows before publication. Candidate subprocessors include Amazon Web Services (AWS) for compute and indexing infrastructure, Vercel Inc. for edge website delivery, Supabase for account and metadata storage, Cloudflare for DNS and edge security, Google Fonts, PostHog for telemetry, and Stripe, Inc. for subscription billing.
Retention and deletion
Proposed targets pending verification: security logs 30 days; query/telemetry 90 days; grounded live-search cache up to 72 hours; active publisher data plus 30 days; backups up to 30 days (retaining last 5 snapshots). Live retrieval obeys robots, URL allowlist, SSRF, noindex, and nosnippet gates and never fabricates a source. Publish request, identity-verification, automated deletion (`prepare_account_deletion` RPC), and exception procedures only after operational review.
Analytics and security
Analytics must remain off until consent, opt-out, event inventory, and vendor settings are verified. SeaWeb employs industry-standard security measures including TLS 1.3 transport encryption and Phase 1 AES-256-GCM authenticated encryption for query log telemetry with owner-bound authentication data, protected by Supabase forced Row Level Security.
US-first publication process
This draft has no effective date. Counsel and an accountable owner must approve data inventory, subprocessors, retention/deletion, analytics, security, payments, legal entity, jurisdiction, and contacts before publication.