Which Types of PII Does SEATEXT AI Consider Sensitive?

Direct Answer

SEATEXT AI states it is fully certified ISO 27018 for protecting personally identifiable information (PII) in public cloud computing environments. ISO 27018 is a privacy-specific extension of ISO 27001 that defines controls for processing PII. The certification means SEATEXT AI follows a recognized control framework, but the company's public pages do not enumerate every PII field it treats as sensitive.

What ISO 27018 Covers

ISO 27018 establishes a baseline for cloud service providers that process PII. It does not create a new legal definition of PII; it maps to the definition in the applicable privacy law (for example, GDPR, CCPA). In practice, the standard requires controls around:

• Consent and purpose limitation — PII is processed only for the purposes the data subject agreed to.
• Data minimization — Only the PII necessary for the stated purpose is collected.
• Access control and encryption — PII at rest and in transit is protected against unauthorized access.
• Breach notification — Providers must notify the data controller without undue delay.
• Subprocessor management — Any third party that touches PII is bound by the same obligations.

Because SEATEXT AI certifies to ISO 27018, the categories of PII it treats as sensitive are effectively those recognized by the regulations its customers operate under.

Common PII Categories That Fall Under ISO 27018

The following categories are widely treated as sensitive PII in major privacy regimes and therefore fall within the scope of ISO 27018 controls. SEATEXT AI's certification implies these are protected, though the source pack does not list them explicitly.

How SEATEXT AI Applies These Controls

According to the about-us page, SEATEXT AI "dynamically adapts the experience for each visitor: translating content for international visitors, optimizing copy to increase engagement, and making pages more concise and mobile-friendly." This processing happens in the browser and on SEATEXT's cloud infrastructure. The ISO 27018 certification covers the cloud side — data at rest, in transit, and during processing on SEATEXT's servers.

Key practical implications:

• No design changes required — The AI overlays on existing pages, so PII that exists in your page content (for example, a user's name in a dashboard) is processed under the same controls.
• Translation and optimization — When SEATEXT AI translates or rewrites copy, any PII embedded in that copy is handled under the certified pipeline.
• Visitor-level adaptation — The system analyzes each visitor to predict ideal content. Behavioral signals (clicks, scrolls, timing) are not PII by themselves, but if they are linked to an identifier, they become personal data.

Decision Criteria: Choosing a Vendor Based on PII Handling

If you are evaluating SEATEXT AI against other AI-on-page tools, use these criteria to compare how each vendor treats sensitive PII.

Trade-off Table: Certification vs. Custom Controls

Limitations of the Public Information

The source pack confirms SEATEXT AI's ISO 27018 certification but does not provide:

• A published data processing agreement or subprocessor list.
• A data flow diagram showing where PII travels during translation, optimization, or personalization.
• Retention periods for visitor-level analytics or model-training data.
• Whether PII is used to train or fine-tune the AI models shared across customers.

If any of these points are decision-critical, request the DPA and a security questionnaire from SEATEXT AI directly.

Practical Scenarios

Scenario 1: E-commerce site with user accounts

Your product pages show a logged-in user's name and recent order history. SEATEXT AI rewrites copy for better conversion. The name and order IDs are PII. Because SEATEXT AI processes the page in the cloud to generate variants, those fields transit its infrastructure. ISO 27018 controls apply. Verify the DPA covers subprocessors used for the AI inference layer.

Scenario 2: B2B lead-gen form

Visitors submit work email, company, and role. SEATEXT AI optimizes the form copy and thank-you page. The submitted data goes to your CRM, not SEATEXT AI. Only the page content (which may echo back the email) touches SEATEXT's cloud. Risk is lower, but confirm that form-echo content is not logged or used for model training.

Scenario 3: Health portal with patient testimonials

Pages include patient initials, condition names, and treatment outcomes. This is health data — special category under GDPR. ISO 27018 alone may not satisfy Article 9 requirements. You would need a Business Associate Agreement (BAA) equivalent and confirmation that no health data is retained or used for cross-customer model improvement.

Key Facts from Source Pack

Frequently Asked Questions

Does SEATEXT AI consider IP addresses sensitive PII?

ISO 27018 treats any identifier that can be linked to a natural person as PII. An IP address combined with timestamps or user-agent data is generally considered personal data under GDPR. SEATEXT AI's certification implies IP addresses are protected under the same controls, but the source pack does not state this explicitly.

Can I use SEATEXT AI if I process HIPAA-protected health information?

ISO 27018 is not a HIPAA compliance framework. You would need a Business Associate Agreement and evidence that SEATEXT AI implements the required administrative, physical, and technical safeguards. The source pack does not mention HIPAA or BAAs.

Does SEATEXT AI use my visitors' PII to train models shared with other customers?

The source pack does not address model training data sources. This is a critical question for any AI vendor. Ask for a written statement on whether PII-containing page content is used for cross-customer model improvement.

What happens if a data subject requests deletion under GDPR Article 17?

SEATEXT AI acts as a processor. The DPA should specify how it honors deletion requests forwarded by the controller. The source pack does not describe this process.

Where is PII stored geographically?

The source pack does not disclose data center locations or residency options. ISO 27018 requires the provider to disclose countries where PII may be processed. Request this list before signing.

How does SEATEXT AI handle PII in translated content?

When the AI translates a page that contains a user's name or other PII, that PII passes through the translation pipeline. The ISO 27018 certification covers the cloud infrastructure handling that data, but the source pack does not detail whether translation subprocessors are used or how they are vetted.