Privacy Notice

1. Who we are

This Privacy Notice explains how Siparium ("Siparium", "we", "us") collects and uses personal data when you visit our website or use our service. For the personal data we collect about you in connection with the Siparium service, we act as the data controller.

2. Data we collect

Account & profile data

• Name and email address
• Authentication credentials (hashed) and OAuth identifiers if you sign in with a third-party provider
• Profile details and display name

Content you create

• Roster, contact, deal, release, and contract data you save in the workspace
• Prompts you submit to AI features and the resulting outputs
• Files and documents you upload

Usage & technical data

• Log data: IP address, browser type, device identifiers, referring URLs
• Telemetry: pages visited, features used, AI session counts, error reports
• Cookies and similar technologies (see Cookies below)

Support data

• Messages you send us and metadata about those interactions

Payment data. When you purchase a paid plan, payment is processed by Stripe. We do not collect or store your full card number. We receive limited transaction metadata (e.g. plan, status, country, customer and subscription identifier) needed to provision your access.

3. How we use your data and our legal bases

• Provide the service — to create your account, deliver features, and run AI workloads on your Prompts. Legal basis: performance of our contract with you.
• Billing & access — to provision Pro access from Stripe subscription events and honour cancellations. Legal basis: performance of our contract; legal obligation.
• Security & fraud prevention — to detect abuse, secure accounts, and investigate incidents. Legal basis: legitimate interests in keeping the service safe.
• Product improvement — to analyse aggregated usage, fix bugs, and improve features. Legal basis: legitimate interests; consent where required.
• Customer support — to respond to your questions. Legal basis: performance of our contract; legitimate interests.
• Marketing — to send product updates and relevant offers. Legal basis: consent (you can opt out at any time) or legitimate interests for transactional and service emails.
• Legal compliance — to meet tax, accounting, and other legal obligations. Legal basis: legal obligation.

4. AI processing

When you use AI features, your Prompts and relevant context are sent to model providers we engage as subprocessors to generate outputs. We instruct subprocessors not to use your Prompts or outputs to train their general-purpose models. We do not use your private workspace content to train Siparium's own models without your explicit consent.

5. Who we share data with

• Stripe — our payment processor, for the sale of paid plans, subscription management, payment processing, invoicing, and refunds.
• Hosting & infrastructure providers — to operate the database, application servers, and storage that run Siparium.
• AI model providers — to process your Prompts and return AI Outputs.
• Analytics, error monitoring, and support tooling — to operate the service and respond to issues.
• Professional advisers — accountants, lawyers, and auditors when needed.
• Authorities — where we are required to share data to comply with law, valid legal process, or to protect rights, safety, or property.

We do not sell your personal data.

6. International transfers

Your data may be processed in countries outside your own, including outside the UK and EEA. Where we transfer personal data internationally, we rely on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, or equivalent mechanisms.

7. Data retention

We keep personal data only for as long as needed to provide the service, comply with our legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must retain it (e.g. tax records, fraud investigations).

8. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data; the right to data portability; and the right to withdraw consent where processing is based on consent. EU/UK users also have the right to lodge a complaint with their local supervisory authority. We aim to respond to verified requests within one month. To exercise any of these rights, email siparium.co@gmail.com.

9. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, and least-privilege principles for our team. No system is perfectly secure, but we treat security as a first-class concern.

10. Cookies

We use a small number of cookies and similar technologies. Essential cookies keep you signed in and remember your preferences. Analytics cookies help us understand how the service is used. Marketing cookies, where used, are only set with your consent. You can manage cookies in your browser settings.

11. Children

The Service is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to this notice

We may update this Privacy Notice from time to time. If we make material changes, we will notify you. The "Last updated" date at the top reflects the latest revision.

13. Contact

Questions about your data or this notice? Email siparium.co@gmail.com.