Privacy Policy

1. Overview

SeamStream is a B2B SaaS platform for garment manufacturing management, operated by Daehan Global DS, Inc. ("SeamStream", "we", "us"). This Privacy Policy explains how we collect, process, store, and protect information when you use our platform, including SeamSource, SeamStock, SeamCut, SeamLine, and all associated tools.

Our processing of personal data is subject to the Personal Information Protection Act of the Republic of Korea and, where applicable, to Indonesia's Personal Data Protection Law (UU PDP, Law No. 27/2022, in full force since October 17, 2024) and other applicable data protection laws. This Policy applies to all users, including factory administrators, production line operators, and business contacts whose information is processed through the platform, and to people who visit or contact us through our websites.

2. Information We Collect

2.1 Account Information

• Company name, business registration number
• Contact person name, email address, phone number
• User role (administrator, operator, viewer)
• Login credentials (passwords are stored using one-way hashing and are never readable)

2.2 Manufacturing Documents You Upload

• Buyer purchase orders (PO), including fabric specifications, quantities, delivery dates
• Supplier invoices, packing lists, fabric rolls data
• Production records: cutting floor data, bundle QR assignments, loss-rate tracking
• Quality control images shared via Telegram integration

These documents are your property. We process them solely to deliver the platform's services. See Section 5 (Customer Data Ownership) for full details.

2.3 IoT Device Data

• Per-second production throughput data from line-mounted IoT sensors
• Machine state signals (running, idle, fault)
• Device connectivity status, firmware version, device ID

IoT devices deployed at your facility generate operational data. The factory owner retains ownership of this operational data. SeamStream processes it to display real-time analytics, detect bottlenecks, and trigger alerts.

2.4 Automatically Collected Technical Data

• IP address, browser type, operating system
• Session duration, pages visited, feature usage patterns
• Error logs and performance traces

Visit statistics on our websites. We measure visits to our websites with Cloudflare Web Analytics, so that we can see which pages are read and where visitors come from. It sets no cookies and stores nothing on your device, and we show no cookie banner for it. Your browser sends Cloudflare the page address (including any tags in it, such as ref or src), the referring site, browser and device type, and page loading times. Cloudflare also sees your IP address as part of the connection and works out the country from it. It does not follow you from one site to another. It covers ssm8.app and its subdomains, including the logged-in SeamStream web applications, seamone.app, and the chat window on our pages, which loads from daehan.id. In the web applications too, it sends page addresses and technical data. If an address contains values such as a search term or a document number, those values are sent too. Cloudflare processes this data for us (see Sections 7.1 and 10).

Visit records on our home pages. When you open the ssm8.app home page in any language, the /intro/ page or a business card page under /b/card/, the page sends a signal to our server at share.daehan.id. The server records your IP address, browser information (user agent), the page address with any src tag in it, the ref tag from the address, and the time. The ref tag in links in our emails marks the company we sent the email to. It associates a visit with a link we issued for that company, but it does not by itself show who opened the link or whether the request came from a person. We use these records to count visits, to tell people from automated traffic, and to see which of our emails and links bring visitors. A daily summary with visit counts and company names goes to a channel of our team messaging service (Slack). To tell people from automated traffic, we look up each IP address with an IP lookup service (ip-api.com), which tells us the country, the network operator and whether the address belongs to a hosting network, and we keep the lookup results on our own computers. The web server also logs these requests, with the IP address, for 14 days. Section 8 sets how long we keep the records.

Fonts from other services. Our pages load fonts from Google Fonts, and the ssm8.app home pages and seamone.app also load a font from the jsDelivr network. When your browser fetches these fonts, those services receive your IP address and browser information.

2.5 Website Inquiries

When you contact us through the consultation form or the chat window on our website, we receive the information you enter:

• Company or factory name and your name
• The contact details you give us: email address, WhatsApp or phone number
• On the form, the number of sewing lines (optional); in the chat window, the message you write
• Which of our sites you used; on the form, also the page language and the tag in the page address if you came from one of our emails or links
• The time of the inquiry and a reference number created for it

This information is stored on a server that DigitalOcean operates for us in Singapore, with backup copies on a second DigitalOcean server in Singapore, and is sent to an internal channel of our team messaging service (Slack), where our team reviews it and replies to you. We use it to respond to your inquiry, to prepare a consultation that fits your factory, and to see which of our emails or links led to the inquiry.

2.6 SSM Machine Mobile App

SSM Machine is an Android app for keeping a factory's sewing machine register. It opens the SeamStream platform pages at app.ssm8.app, which Daehan Global DS, Inc. operates under this Policy. The app asks for two permissions only: internet and camera. It does not ask for location, contacts, microphone, or file storage.

• Sign-in: the account your company created for you (email address and name). The app does not create accounts.
• Camera: when you scan a QR label or a machine nameplate, the image is read on your phone by Google ML Kit. Only the resulting text, such as the QR code or the serial number, is sent to our server. Scanning images are processed on your phone and are not uploaded. A nameplate photo is uploaded only if you choose to save it, as described below.
• Nameplate photos: only if you choose to save a photo for a machine, the app uploads one JPEG photo (longest side 1,280 pixels or less). It is stored with that machine’s record. Your company’s authorized users can view it, and SeamStream personnel can access it only as needed to deliver the service, as described in Section 6.
• Machine register data you enter: machine type, brand, model, serial number, factory location, condition, repairs, moves and rentals, with the user and time of each change.
• Google ML Kit sends Google technical information about its own operation for diagnostics and usage analytics: device information (manufacturer, model, operating system version and build, and available machine-learning hardware), the app’s package name and version, per-installation identifiers that are not intended to identify you or your device, feature configuration and version, input and output sizes, event types, error codes, and performance metrics. It is sent encrypted over HTTPS and does not include your images or the text read from them. Google handles this information under the Google Privacy Policy and may process it outside Indonesia.

The app shows no ads. The platform pages it opens carry the Cloudflare Web Analytics described in Section 2.4. Machine register data belongs to your company in the same way as the data described in Section 5. For personal data in the register, such as who made each change, your company decides the purposes of processing, and Daehan Global DS, Inc. processes it on your company’s instructions to provide scanning, photo storage and change histories. This does not limit your rights under Section 12.

To delete your SSM Machine account and the personal data linked to it, ask your company administrator or email support@ssm8.app from the email address of the account. We handle the request as described in Section 12.

2.7 Cookies

Our public websites set no cookies. After you sign in to the SeamStream web applications (app.ssm8.app and the service addresses that open from it), we set only the cookies needed to run them. We use no advertising cookies.

• Sign-in session: keeps you signed in for up to 90 days, extended while you keep using the service
• Language: remembers the language you chose, for 1 year
• Extra verification: remembers for 30 minutes that you confirmed your identity again before a sensitive screen
• Selected company: remembers which company you chose on the customs screens, for 14 days
• TV screens (tv.ssm8.app): remember a paired screen for 400 days and a phone signed in to control it for 30 days, and hold a pairing code for 5 minutes

The list above covers the cookies of app.ssm8.app and tv.ssm8.app. Our other web applications that you sign in to separately, such as docs.ssm8.app, may also use cookies to keep you signed in and to remember your screen settings. You can block or delete cookies in your browser settings. If you block them, you cannot sign in to the web applications.

3. How We Use Your Information

Under Korea's Personal Information Protection Act, the bases are as follows. Sending product updates relies on your consent (Article 15(1)1). Responding to your website inquiry and preparing a consultation are steps taken at your request in the course of entering into a contract (Article 15(1)4), and where you have a contract with us yourself, the basis is performing that contract (Article 15(1)4). Compliance with law is a legal obligation (Article 15(1)2). Measuring website visits, seeing which of our emails or links led to inquiries, security monitoring, and giving you an account and running the platform under the contract we have with your company rely on our legitimate interests (Article 15(1)6). We carry out this processing only where it is necessary and our legitimate interests clearly override your rights, and only within a reasonable scope substantially related to those interests. Personal data in the manufacturing documents and production records that your company uploads to or creates on the platform is processed on your company's behalf, and your company is responsible for the legal basis of that processing (Article 26).

We do not use your manufacturing documents, supplier data, or production records for training our AI models without your explicit written consent.

4. AI Document Processing

SeamStream uses AI (SeamDocs) to extract structured data from uploaded manufacturing documents. You must be aware of the following:

• AI accuracy is not guaranteed. Our AI achieves high accuracy on standard document formats, but extraction errors can occur, particularly with handwritten documents, poor-quality scans, or non-standard formats.
• Verification is your responsibility. All AI-extracted data — including quantities, prices, delivery dates, and supplier names — must be verified against the source document before use in production decisions, payment processing, or financial records.
• Personal data embedded in documents (such as supplier contact names or purchasing manager information) is processed only as necessary to deliver the extraction service and is not used for any other purpose.

5. Customer Data Ownership

All data you upload to SeamStream — including purchase orders, invoices, production records, packing lists, and all associated files — remains your property.

SeamStream's rights to your data are strictly limited to:

• Technical processing necessary to operate the platform
• Storage and backup for service continuity
• Displaying data back to your authorized users
• Generating aggregated, anonymized platform performance metrics (which cannot identify your company or operations)

We will never sell, rent, or commercialize your manufacturing documents or operational data. We will never share your supplier relationships, pricing information, or production volumes with competitors or third parties for commercial purposes.

Upon account termination, you may export all your data. SeamStream will retain your data for 90 days after termination to allow for export, then permanently delete it from all live systems. From December 1, 2026, backup copies are destroyed within 32 days after deletion from the live systems (at most 122 days after termination); until then, as in the previous version, they are destroyed within 90 days after termination. Backups that are not deleted automatically are also checked and destroyed by our staff within these limits, and backup copies are used only to restore our systems. For personal data in documents, the deadlines in Section 8 apply first.

6. Confidentiality of Business Information

SeamStream recognizes that manufacturing data — including supplier pricing, buyer purchase order terms, production capacities, and quality specifications — constitutes confidential business information and trade secrets.

We commit to:

• Treating all customer data as strictly confidential
• Limiting access to your data to SeamStream personnel who require it to deliver the service, under binding confidentiality obligations
• Never disclosing your data to other SeamStream customers or using one customer's data to benefit another
• Implementing role-based access controls so that only your designated users can access your data

7. Information Sharing

We do not sell your personal data. We share it only as described in this section.

7.1 Service Providers

We entrust the following service providers with processing personal data on our behalf. The processing follows each provider's terms of service and, where the provider has them, its data processing terms. Section 10 lists where each of them processes the data.

• DigitalOcean: hosts the servers for our websites, the SeamStream platform, website inquiries, visit records and backups
• Cloudflare: carries and protects all traffic to our websites and the platform, and provides Cloudflare Web Analytics (Section 2.4)
• Slack: delivers website inquiries, daily visit summaries and platform notices to our team
• Google (Google Workspace): sends emails from the platform
• Resend: sends platform emails when Google Workspace cannot
• Anthropic, OpenAI and Google (Gemini): AI models that read the documents you upload to SeamDocs (Section 4). Anthropic also runs the AI features of the platform at app.ssm8.app
• ip-api.com: looks up the IP addresses in visit records (Section 2.4)
• Telegram: confirms your sign-in when you sign in with a Telegram account, and delivers our notices and messages sent through Telegram

7.2 Legal Requirements

We may disclose information when required by applicable law, including Korean and Indonesian law, a court order, or a request from a competent government authority. We will notify you of such requests to the extent permitted by law.

7.3 Business Transfers

If SeamStream or its parent company is acquired or merged, your data may be transferred as part of that transaction. We will notify you in advance and your data will remain subject to this Privacy Policy.

7.4 Our Group Companies

The server that receives our website inquiries (daehan.id) and the workspace of our team messaging service (Slack) are shared with the companies of the Daehan Global group. Our inquiries go to our own channel in that workspace. We do not provide website inquiries or visit records to any other company, including our group companies, for its own purposes.

8. Data Retention

You may request early deletion of personal data at any time. We will delete it from our live systems, including the copy in our team messaging channel, within 3×24 hours (72 hours) of receiving a verified request, except where the law requires us to keep it. Backup copies are removed as stated in the table above.

How we destroy personal data. When a retention period ends or the purpose of processing has been achieved, we destroy the personal data without delay. Electronic files are deleted permanently so that they cannot be restored. Paper records are shredded or incinerated. Personal data we must keep under another law is stored separately from other data, and only the items and period that law requires are kept. Our Privacy Officer (Section 13) is responsible for destruction. The Privacy Officer reviews personal data whose retention period has ended and decides on its destruction, and our staff then destroy it. Data that is deleted automatically on a fixed cycle, such as server log copies and backups, is deleted on that cycle.

9. IoT Device Data

SeamStream deploys IoT sensors on production lines to capture real-time manufacturing data. The following principles govern IoT data:

• Device ownership: The factory retains ownership of its production machinery and the operational data generated by IoT sensors installed on that machinery.
• Personal data in production data: IoT data is operational in nature (machine throughput, speed, fault codes) and does not normally constitute personal data. Where operator IDs or shift data could identify individual workers, such data is handled as personal data under this Policy.
• Data minimization: We collect only the data necessary for the service features you have activated (real-time monitoring, bottleneck detection, Telegram alerts).
• Retention: Raw IoT telemetry data is retained for 12 months. Aggregated production analytics are retained for the duration of the subscription.

10. Cross-Border Data Transfers

We are a company in the Republic of Korea, and our servers are in Singapore. Your personal data is therefore stored and processed outside Korea and outside Indonesia. For each recipient below we list the data, the country, when and how it is transferred, and how long it is kept. Transfers are made over the internet, over encrypted connections unless noted otherwise.

• DigitalOcean (contact: DigitalOcean Privacy Policy): all personal data we store (Sections 2 and 8). Country: Singapore. Transferred whenever data is created or changed, and kept for the periods in Section 8.
• Cloudflare (contact: Cloudflare Privacy Policy): everything passing between your browser and our websites, including your IP address and browser information, and the visit statistics in Section 2.4. Country: Cloudflare is a United States company; it carries traffic through whichever of its data centers around the world is near you, and processes the visit statistics where Cloudflare decides. Transferred each time you use our websites or the platform. Kept: for the periods in Cloudflare's terms of service and data processing terms; Section 8 covers the visit statistics.
• Slack (contact: Slack Privacy Policy): website inquiry details (Section 2.5), daily visit summaries and platform notices. Country: Slack is a United States company and processes the data in the United States or other places Slack decides. Transferred when an inquiry, summary or notice is sent. Kept: as for website inquiries in Section 8.
• Google (contact: Google Privacy Policy): names, email addresses and contents of platform emails; for Gemini, the documents you upload to SeamDocs; for Google Fonts, the IP address and browser information of the browser fetching a font; for Google ML Kit, the technical information in Section 2.6. Country: Google is a United States company and processes the data in the United States or other places Google decides. Transferred when an email is sent, a document is read, a font is fetched or the app scans. Kept: for the periods in Google's terms of service and data processing terms.
• Resend (contact: Resend Privacy Policy): names, email addresses and contents of platform emails. Country: Resend is a United States company and processes the data in the United States or other places Resend decides. Transferred when Google Workspace cannot send an email. Kept: for the periods in Resend's terms of service and data processing terms.
• Anthropic and OpenAI (contact: Anthropic Privacy Policy, OpenAI Privacy Policy): the documents and text sent to AI features. Country: both are United States companies and process the data in the United States or other places each company decides. Transferred when an AI feature runs. Kept: for the periods in each company's API terms and data processing terms.
• ip-api.com (contact: contact@ip-api.com): IP addresses in visit records. Country: ip-api.com does not state where it processes data. Every hour, when we process visit records, we send it the IP addresses we have not looked up yet, over an unencrypted connection (http). Kept: ip-api.com states that it discards the information it receives once a request is answered and does not log requests.
• jsDelivr (Volentio JSD Limited · contact: legal@jsdelivr.com): your IP address and browser information when your browser fetches a font (Section 2.4). Country: a company registered in England and Wales; it delivers files from whichever part of its worldwide network is near you. Transferred each time a font is fetched. Kept: jsDelivr states that it keeps this information briefly, to detect abuse, until it is analyzed and deleted.

Our team works in the Republic of Korea and Indonesia, reads website inquiries and visit records there, and keeps the IP lookup results on our computers there.

Legal basis for these transfers. Article 28-8(1)3(a) of Korea's Personal Information Protection Act allows the outsourcing and storage needed to enter into or perform a contract with the data subject, by disclosing the information above in the privacy policy. We rely on this basis only for outsourced processing or storage necessary to enter into or perform a contract with you as the data subject (servers, traffic delivery, email delivery, team messaging and AI features). Responding to an inquiry falls within this basis only where it is necessary for that contract; the fact that you contacted us, or our contract with your company, does not by itself establish this basis. Other transfers, namely visit statistics, fonts and IP lookups, and processing that your company entrusts to us, are not covered by that basis alone. Article 56 of Indonesia's UU PDP requires, in order, an equal or higher level of protection in the receiving country, appropriate and binding safeguards where that is not met, and the data subject's consent where neither is available. We are putting the bases for these transfers in place in line with both laws.

Refusing a transfer. You can refuse a transfer by not using the feature concerned, or by contacting us at the address in Section 13. We cannot provide our websites or the platform without DigitalOcean and Cloudflare, and we cannot receive inquiries through the form or chat window without Slack. You can block Cloudflare Web Analytics and the external fonts with a browser content blocker without losing any function of our websites; blocking the fonts only changes how the text looks. If you want your visit records and IP lookup results deleted, contact us at the address in Section 13. You can ask us for more information about these transfers and the safeguards in place.

11. Security

We implement technical and organizational measures to protect your data, including:

• Encryption in transit (HTTPS) between your browser and our websites and platform
• Passwords stored only as one-way hashes
• Role-based access controls limiting data access to authorized personnel
• Logical separation of each customer organization's data, with access limited by role

No system is completely immune to security incidents. If personal data is leaked or otherwise compromised, we will notify the affected individuals in writing within 72 hours (3×24 hours) of becoming aware of it. We will tell them what data was involved, when and how it happened, what they can do to reduce harm, what we are doing about it and how to seek remedies, the department and contact details for reporting harm, and their legal rights and how to exercise them, including claims for damages and statutory damages and dispute mediation, as Indonesia's UU PDP (Article 46) and Korea's Personal Information Protection Act (Article 34) require. Where Korean law requires notice of a possible leak, we will notify without delay everyone who may be affected. Under UU PDP Article 46, we will also notify the Indonesian personal data protection agency (lembaga) in writing within 3×24 hours. In the cases Korean law sets (data of 1,000 or more people, sensitive or unique identifying information, or unlawful access from outside), we will report to Korea's Personal Information Protection Commission or the Korea Internet & Security Agency (KISA) within 72 hours. Where we process the data for a customer, we will also notify that customer without delay.

12. Your Rights

If we process your personal data, you have the following rights under Indonesian law. You can exercise them yourself or through an authorized representative. Requests your company makes as the data controller are handled separately from requests made for an individual.

• Right to Information: Know what personal data we hold about you
• Right of Access: Obtain a copy of your personal data
• Right to Correct: Correct inaccurate personal data
• Right to Delete: Request deletion of personal data we no longer have a legal basis to hold
• Right to Restrict: Restrict processing of your personal data in certain circumstances
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object to Automated Decisions: Object to a decision based solely on automated processing, including profiling, that has legal effects on you or significantly affects you (Article 10)
• Right to Withdraw Consent: Withdraw any consent you have given at any time
• Right to Sue and Claim Compensation: Bring a claim and receive compensation for a violation in the processing of your personal data (Article 12)

In addition to these rights, we also accept objections to processing based on our legitimate interests.

Under Korea's Personal Information Protection Act, you can also ask us to let you access your personal data, to correct or delete it, and to suspend its processing or withdraw consent (Articles 35 to 37). You can ask for an explanation of a decision made by a fully automated system, and you can refuse such a decision if it significantly affects your rights or obligations, except in the cases Article 37-2(1) sets out. You can make these requests yourself or through a representative, and a legal representative can make them for a child under 14 (Article 38). If you disagree with how we handled your request, tell us at the address in Section 13 and we will review it again.

We handle verified requests within the deadlines set by UU PDP. Where UU PDP sets 3×24 hours, we count 72 hours from when we receive the request, including weekends and public holidays. To exercise your rights, contact us at the address in Section 13.

13. Contact

14. Changes to This Policy

We may update this Privacy Policy as the platform evolves or as legal requirements change. We post the updated Policy on this page. Material changes will be notified to registered users and announced on this website at least 14 days before taking effect. The updated Policy applies from its effective date. Where a change needs your consent, we will ask for it separately.