Effective Date: 7 August 2026
Sealab Productions Inc. ("Sealab," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Policy describes how we collect, use, disclose, and safeguard information when you visit www.thesealab.com (the "Site") or use our services (the "Services").
This Privacy Policy applies to all visitors, registered users, and customers worldwide. Additional disclosures for California residents (CCPA/CPRA) and EU/UK data subjects (GDPR) appear in Sections 10 and 11.
| Purpose | Legal Basis (GDPR) / Business Purpose (CPRA) |
|---|---|
| Provide & fulfil orders | Contract performance |
| Prevent fraud & secure the Services (incl. IP-based logging) | Legitimate interest / Security |
| Generate aggregate analytics & improve features | Legitimate interest / Analytics |
| Process payments & accounting | Contract + Legal obligation |
| Marketing emails with your opt-in consent | Consent |
| Personalize the Sealab Assistant from account activity and clear lasting preferences | Legitimate interest / Service personalization, subject to applicable law |
| Comply with law, enforce Terms, resolve disputes | Legal obligation / Legitimate interest |
The Sealab Assistant can answer questions about our catalog and, for signed-in customers, securely access authorized order information. Personalization is enabled by default for signed-in customers. The Assistant may learn concise, lasting cabinetry and workflow preferences from your latest orders that you own and from clear preferences you share in Assistant conversations. It does not learn from orders merely shared with you, and it is designed not to retain credentials, payment or contact data, sensitive personal information, one-off requests, or private order facts as personalization preferences.
You can review, remove, or turn off personalization at any time from Profile > AI personalization. Turning it off stops future learning and stops the Assistant from using learned preferences in future chats. Removing a preference, or selecting Forget all, deletes it from the active application record and prevents the same learned pattern from being automatically re-added. Learned preferences are not used to verify your identity, grant access to an order, or authorize a transaction or order change.
To generate a response, we send the relevant assistant message, limited conversation context, and any enabled learned preferences to OpenAI, our AI service provider. OpenAI does not use API data to train its models unless we explicitly opt in. We configure the Responses API not to persist application conversation state; OpenAI may retain API content in abuse-monitoring logs for up to 30 days under its standard data controls.
We do not use first-party marketing cookies. We use local browser storage for product analytics identifiers and preferences. Our analytics provider, PostHog, records page visits, page engagement duration, web performance measurements, masked click interactions, account and purchase lifecycle events, and sampled session replays so we can understand and improve the Services. Catalog search analytics include query length and result count, not the search terms. After sign-in, analytics may be associated with a customer account identifier and account email so we can understand customer journeys. Form inputs, typed text, element text and attributes, payment interfaces, account and order areas, chat, uploaded content, and drawing workspaces are masked or blocked from replay. Sentry processes limited application-error and performance diagnostics. You can opt out of product analytics and replay using the privacy choice in the Site footer; we also respect supported browser Do Not Track and Global Privacy Control signals. Operational error monitoring remains active with default personal-data collection disabled.
Raw logs containing full IP addresses are retained no longer than 90 days and then deleted or irreversibly anonymised (/24 truncation and hashing).
We do not sell or share personal data for cross-context behavioural advertising. Data is disclosed only to:
| Data Category | Retention Period |
|---|---|
| Server logs (raw IP) | ≤ 90 days |
| Product analytics events and sampled replay | Up to 1 year |
| Application error and performance diagnostics | Up to 30 days |
| Order & tax records | 7 years (IRS/GAAP) |
| Account data | While account active + 2 years |
| Design content | 5 years after last order or on request |
| Optional saved assistant memories | Until you remove them, your account is deleted, or the account-data retention period ends |
| Backup archives | 30-day rolling |
We implement appropriate administrative, technical, and physical safeguards to protect personal data.
The Services are directed to businesses and individuals aged 18+. We do not knowingly collect data from children under 13.
California residents may request: (a) disclosure of categories/particular pieces of personal information collected, (b) deletion, (c) correction, and (d) opt-out of “sharing” for advertising (not applicable as we do not share). Submit requests at info@thesealab.com. Identity verification required.
You may access, rectify, erase, restrict, or port your personal data and object to processing based on legitimate interests. Contact admin@thesealab.com. You also have the right to lodge a complaint with your local supervisory authority.
Data is stored in the United States. Transfers from the EEA/UK rely on the European Commission’s Standard Contractual Clauses (SCCs).
Material changes will be posted 15 days before taking effect. Prior versions are archived at /legal/privacy-archive.
Sealab Productions Inc.
63 Flushing Ave, Bldg 3 #1108
Brooklyn, NY 11205
Email: info@thesealab.com
Last updated: 7 August 2026