We are committed to transparent data governance. This notice sets out our operational rules, data processing terms and compliance under the GDPR, UK GDPR, Swiss FADP and related statutes.
1. Introduction and statutory scope
This notice supplements our Privacy Policy for people in the European Economic Area, the United Kingdom and Switzerland. It sets out the information required by Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (GDPR), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection (FADP).
It also describes how we apply the ePrivacy rules on cookies, and how we meet our parallel obligations under the California Consumer Privacy Act (CCPA/CPRA) and other applicable statutes.
2. Controller and processor roles
Sidiora Labs Inc. is the controller of personal data processed through sidioralabs.com, our marketing and correspondence, and the accounts we provide directly to individuals.
When a business customer uses our Services to process personal data about its own users, employees or customers, that business is the controller and Sidiora Labs acts as its processor under Article 28. In that case, requests about the data should go first to the business customer, and we will assist them.
Data protection contact: compliance@sidioralabs.com. Where Article 27 of the GDPR or UK GDPR requires us to appoint a representative in the EU or UK, their contact details will be published in this section.
3. Information we process
- Contact identifiers: full name, email address, phone number and correspondence, including messages sent to compliance@sidioralabs.com.
- Technical and log telemetry: IP address, browser version, operating system details and access timestamps.
- Cookies and session identifiers: first-party session tokens and, with consent, preference, analytics and marketing cookies.
- Usage analytics: aggregate visitor metrics, page latency and navigation telemetry.
- Account and commercial data: account profile, subscription and billing records.
- Service content: prompts, files, messages, code and outputs you submit to or receive from the Services.
4. Purposes and lawful bases
We process personal data only where Article 6 GDPR provides a lawful basis:
| Purpose | Data | Lawful basis |
|---|---|---|
| Provide accounts and the Services you request | Account, service content, billing | Contract, Art. 6(1)(b) |
| Process payments and keep financial records | Billing and transaction data | Contract and legal obligation, Art. 6(1)(b), (c) |
| Reply to enquiries and correspondence | Contact identifiers, correspondence | Legitimate interests, Art. 6(1)(f), or steps before a contract, Art. 6(1)(b) |
| Secure the platform and prevent abuse | Log telemetry, account data | Legitimate interests, Art. 6(1)(f) |
| Strictly necessary cookies | Session and consent identifiers | Legitimate interests; exempt from consent under ePrivacy |
| Preference, statistics and marketing cookies | Cookie identifiers, usage data | Consent, Art. 6(1)(a) |
| Marketing email | Name, email address | Consent, Art. 6(1)(a), or soft opt-in where permitted |
| Model training programmes | Service content you choose to contribute | Consent, Art. 6(1)(a) |
| Comply with law and respond to authorities | As required | Legal obligation, Art. 6(1)(c) |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can request a copy of that assessment. We do not intentionally process special category data under Article 9; please do not submit it to the Services unless a product explicitly supports it.
5. Cookies and consent
In line with Article 5(3) of the ePrivacy Directive and its national implementations, we set no cookie other than strictly necessary ones until you give consent through the Cookiebot banner. Consent is granular by category, as easy to withdraw as to give, and recorded with a timestamp and anonymised identifier so we can demonstrate it under Article 7(1).
Details, the live cookie declaration and the link to change your choice are in our Cookie Policy.
6. Recipients and sub-processors
We do not sell or monetise personal data. We disclose it only to the following categories of recipient, each bound by a data processing agreement that meets Article 28:
| Category | Purpose | Typical location |
|---|---|---|
| Cloud infrastructure and hosting | Run the website and Services, store data | United States, European Union |
| Payment processors (PCI-DSS certified) | Take payments, prevent fraud | United States, European Union |
| Transactional email delivery | Send account and service messages | United States |
| Consent management (Cookiebot by Usercentrics) | Record and honour cookie consent | European Union |
| AI model inference providers | Generate outputs you request; no training on your data | United States |
| Support and security tooling | Answer requests, detect abuse | United States |
A current list of named sub-processors is available on request. Business customers with a data processing agreement receive advance notice of new sub-processors and may object.
7. International transfers
Sidiora Labs is established in the United States. Transfers of personal data outside the EEA, UK or Switzerland rely on an adequacy decision (including the EU–US Data Privacy Framework, its UK Extension and the Swiss–US framework where the recipient is certified) or on the European Commission’s Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum and Swiss equivalents. We assess the laws of the destination country and apply supplementary measures, such as encryption in transit and at rest and strict access control, where needed. You may request a copy of the relevant safeguards.
8. Your rights
Subject to the conditions in the law, you have the right to:
- Access (Art. 15): obtain confirmation of processing and a copy of your personal data.
- Rectification (Art. 16): correct inaccurate or incomplete data.
- Erasure (Art. 17): have data deleted where it is no longer needed, consent is withdrawn or processing is unlawful, unless retention is legally required.
- Restriction (Art. 18): limit processing while accuracy or an objection is being considered.
- Portability (Art. 20): receive data you provided in a structured, machine-readable format, or have it sent to another controller.
- Objection (Art. 21): object to processing based on legitimate interests, and to direct marketing at any time without giving reasons.
- Withdraw consent (Art. 7(3)): at any time, without affecting earlier lawful processing.
- Not be subject to solely automated decisions (Art. 22) with legal or similarly significant effects.
- Complain (Art. 77) to a supervisory authority, described below.
Erasure cannot reach records already written to the public Paxeer X ledger, which no single party can change. We will erase or de-link the off-chain data we hold about you.
9. How to exercise your rights
Write to compliance@sidioralabs.com and state the right you wish to exercise. We may ask for information to confirm your identity. We will respond without undue delay and within one month, extendable by two further months for complex or numerous requests, in which case we will tell you why within the first month. Requests are free unless manifestly unfounded or excessive.
10. Automated decision-making and AI agents
We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing. Our agents act on instructions given by you or your organisation, and the products are designed to keep a person in control of consequential actions. Use of your content for model training requires your consent, as set out in our AI Training Data and Content Licensing Agreement.
11. Security standards and retention
We apply appropriate technical and organisational measures under Article 32, including TLS encryption, encryption at rest, secure session tokens, least-privilege access and staff confidentiality obligations. Personal data is kept only as long as necessary for its purpose or as required by law; the retention schedule is in our Privacy Policy. If a personal data breach is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours of becoming aware of it and inform you without undue delay where the risk is high.
12. Advertising and marketing networks
Where we use advertising or measurement partners such as Google, their identifiers are set only after you accept the marketing cookie category. We do not use personal data for targeted advertising without consent.
13. Commercial transactions and payment safeguards
Billing information is processed directly by PCI-DSS Level 1 certified payment processors. We never retain unencrypted card data on our infrastructure.
14. Data processing agreement for business customers
Business customers who use the Services to process personal data can request our data processing agreement, which incorporates the Standard Contractual Clauses and sets out our Article 28 commitments: processing only on documented instructions, confidentiality, security, sub-processor controls, assistance with data subject requests and impact assessments, deletion or return at the end of service, and audit cooperation. Write to compliance@sidioralabs.com.
15. Children
The Services are not intended for children under 16, or the lower age set by your member state under Article 8. We do not knowingly process their data and will delete it if we learn of it.
16. Supervisory authorities
We would like the chance to resolve your concern first, but you may complain at any time to the data protection authority in the EU member state where you live, work or where the alleged infringement occurred. In the UK, the authority is the Information Commissioner’s Office (ico.org.uk). In Switzerland, it is the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
17. Compliance contact information
- Operating entity: Sidiora Labs Inc.
- Compliance email: compliance@sidioralabs.com
- Official domain: www.sidioralabs.com
Questions about this document
Write to our compliance team.
compliance@sidioralabs.com · We aim to reply within 30 days.