Sidiora Labs builds systems that let machines work alongside people. That work depends on trust, so we keep data collection narrow, explain it plainly and give you control over it.
1. Who we are and what this policy covers
This Privacy Policy explains how Sidiora Labs Inc. (“Sidiora Labs”, “we”, “us”) collects, uses, discloses and protects personal information when you visit sidioralabs.com, contact us, or use our products and services, including Paxeer X, Protention, Centra and Gideon, Hyperfide and related developer tools (together, the “Services”).
It is written to meet the requirements of the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), other US state privacy laws, and applicable commercial statutes. People in the EEA, UK and Switzerland should also read our GDPR and Data Protection Notice, which sets out additional detail required by those laws.
Some products publish their own privacy notice or terms. Where they do, that notice supplements this policy and governs if the two conflict for that product.
2. Information we collect
Information you give us
- Contact identifiers: your name, email address, phone number, company and role when you write to us, request investor materials, join a waitlist or sign up for a product.
- Correspondence: the content of messages you send to any of our addresses, including compliance@sidioralabs.com, and records of our replies.
- Account information: login credentials, profile details, workspace settings and authentication tokens from identity providers you choose to connect, such as GitHub.
- Commercial information: subscription plan, purchase history and billing contact. Card details are entered directly with our payment processor; we never store full card numbers.
- Content you submit to the Services: prompts, files, code, repositories, messages and calls you direct to an agent (for example, text messages or calls to Protention), and the outputs generated for you. Our use of this content is limited as described in the AI Training Data and Content Licensing Agreement.
Information collected automatically
- Technical and log data: IP address, browser type and version, operating system, device identifiers, referring URL, pages viewed and access timestamps.
- Cookies and similar technologies: session tokens, consent records, preference cookies and, only with your consent, analytics and marketing cookies. See our Cookie Policy.
- Usage and performance telemetry: feature usage, error reports, latency and aggregate visitor metrics.
- Approximate location: country or region inferred from your IP address. We do not collect precise geolocation from the website.
Information from other sources
- Identity providers and integrations you connect (such as GitHub), limited to the scopes you approve.
- Payment processors, which confirm payment status and provide fraud signals.
- Public blockchain data on the Paxeer X network, such as wallet addresses and transaction history.
- Business contacts and partners who introduce you to us, and publicly available professional information.
Public ledgers are permanent. Transactions and records written to the Paxeer X network are visible to anyone and cannot be altered or deleted by Sidiora Labs. Avoid placing personal information on chain.
3. How we use information
- To provide the Services: create and secure accounts, run agents and workflows you request, process payments and deliver support.
- To communicate with you: reply to enquiries, send service and security notices, and, where you have opted in, send product news.
- To protect the Services: detect, investigate and prevent fraud, abuse, security incidents and violations of our terms.
- To improve the Services: diagnose faults, measure performance and understand how features are used, preferring aggregated or de-identified data.
- For research: our published research uses aggregated, de-identified or synthetic data, or data contributed with explicit permission.
- To meet legal obligations: tax and accounting records, responses to lawful requests, and enforcement of our rights.
4. AI models and your content
Your proprietary business data and private documents are not used to pre-train public foundation models. We use content you submit to the Services only to provide them to you, keep them safe and meet legal requirements, unless you opt in to a training programme. You may revoke any training permission at any time.
Where a Service relies on a third-party model provider, we contractually prohibit that provider from training its models on your content. Full terms, including ownership of outputs, are in the AI Training Data and Content Licensing Agreement.
5. Legal bases for processing
Where the GDPR or similar laws apply, we rely on the following legal bases:
- Consent: for non-essential cookies, marketing communications and any optional data programmes. You can withdraw consent at any time without affecting prior processing.
- Contract: to provision accounts, process orders and deliver the Services you request.
- Legal obligation: to satisfy tax, accounting, anti-fraud and other statutory duties.
- Legitimate interests: to secure our infrastructure, prevent abuse, understand aggregate usage and respond to business enquiries, balanced against your rights.
A purpose-by-purpose table is in our GDPR and Data Protection Notice.
6. Cookies and tracking technologies
We use a consent management platform, Cookiebot, to ask for your permission before setting any cookie that is not strictly necessary. Cookies fall into four categories: strictly necessary, preferences, statistics and marketing. Only strictly necessary cookies are set before you choose.
You can change or withdraw your consent at any time: . The full, automatically maintained list of cookies is in our Cookie Policy.
7. How we share information
We do not sell your personal information, and we do not share it for cross-context behavioural advertising as those terms are defined under the CCPA. We disclose personal information only to:
- Service providers and sub-processors acting on our instructions under written contracts: cloud hosting and infrastructure, storage and content delivery, PCI-DSS certified payment processors, transactional email delivery, customer support tooling, security monitoring and AI model inference providers.
- Consent and analytics providers, including Cookiebot for consent records and, only with your consent, analytics or marketing measurement partners.
- Affiliates and divisions of Sidiora Labs, including Paxeer X and Centra AI, bound by this policy.
- Integrations you connect, when you instruct a Service to act in another system on your behalf.
- Authorities and other parties where required by law, legal process or to protect the rights, property or safety of our users, the public or Sidiora Labs.
- A successor entity in connection with a merger, acquisition, financing or sale of assets, subject to this policy.
- Anyone else, with your consent or at your direction.
8. Advertising and marketing
If we work with advertising or marketing networks (for example, Google advertising products) to measure campaigns or show relevant advertisements, those partners may place their own identifiers. They run only after you accept the marketing category in the consent banner, and stop once you withdraw.
You can unsubscribe from marketing email using the link in every message, or by writing to compliance@sidioralabs.com. Service and security messages will continue while you have an account.
9. Commercial transactions and payment safeguards
When you buy a subscription or service, billing information is collected and processed directly by PCI-DSS Level 1 certified payment processors. We receive only a token, the last four digits, card brand, expiry and billing contact needed to manage your account. We never retain unencrypted card data on our infrastructure.
10. Your privacy rights
Depending on where you live, you may have the right to:
- Access and know: confirm whether we process your personal information and obtain a copy, including the categories, sources, purposes and recipients.
- Correction: fix inaccurate or incomplete records.
- Deletion: ask us to delete personal information, subject to legal retention duties and the permanence of public ledgers.
- Portability: receive your data in a structured, machine-readable format.
- Opt out: of the sale or sharing of personal information, targeted advertising and profiling with legal or similarly significant effects. We do not sell or share, but you may still submit a request.
- Limit use of sensitive personal information: we use sensitive information, such as account credentials, only for purposes permitted without a limit request.
- Non-discrimination: we will not deny service, charge different prices or provide a different quality of service because you exercised a right.
- Appeal: if we decline your request, you may appeal by replying to our decision. If the appeal is denied, you may contact your state attorney general.
These rights apply to residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other states with comparable laws, to the extent each law applies. Rights for people in the EEA, UK and Switzerland are set out in our GDPR and Data Protection Notice.
How to submit a request
Email compliance@sidioralabs.com with the right you wish to exercise. We will verify your identity by matching information we already hold, and may ask for more if the request concerns sensitive data. An authorised agent may submit a request on your behalf with signed permission; we may still verify your identity directly. We respond within 45 days (extendable once by 45 days where permitted) and free of charge unless a request is manifestly unfounded or excessive.
Global Privacy Control
We honour the Global Privacy Control (GPC) browser signal as a valid opt-out of sale, sharing and targeted advertising for that browser. Our website does not otherwise respond to Do Not Track signals, because no common standard exists.
11. California notice at collection
In the preceding 12 months we have collected the following categories of personal information, for the purposes described in this policy:
| Category | Examples | Disclosed for a business purpose to | Sold or shared |
|---|---|---|---|
| Identifiers | Name, email, phone number, IP address, account ID, wallet address | Hosting, email, support and security providers | No |
| Customer records | Billing contact, correspondence | Payment processors, support providers | No |
| Commercial information | Plans purchased, transaction history | Payment processors, accounting providers | No |
| Internet or network activity | Pages viewed, log data, feature usage | Hosting and, with consent, analytics providers | No |
| Geolocation (approximate) | Country or region from IP address | Hosting and security providers | No |
| Audio and electronic information | Messages and calls you direct to an agent | Hosting and AI inference providers | No |
| Professional information | Company, role, business contact details | Customer relationship tooling | No |
| Sensitive personal information | Account login credentials | Authentication providers | No |
| Inferences | Product preferences derived from usage | Not disclosed | No |
We do not knowingly sell or share the personal information of consumers under 16.
12. Data retention
We keep personal information only as long as needed for the purpose it was collected, then delete or de-identify it. Typical periods are:
| Record | Retention |
|---|---|
| Account and workspace data | For the life of the account, then deleted within 90 days of closure |
| Content submitted to the Services | As configured in the product, and deleted within 30 days of your deletion request, except backups which expire within 90 days |
| Correspondence and support records | Up to 3 years after the last interaction |
| Billing and tax records | 7 years, as required by tax and accounting law |
| Security and access logs | Up to 12 months |
| Consent records | Up to 12 months from the date of consent, then you are asked again |
| Public blockchain records | Permanent; outside our control |
We may keep information longer where needed to resolve disputes, enforce agreements or comply with a legal hold.
13. Security
We apply administrative, technical and physical safeguards appropriate to the risk, including TLS encryption in transit, encryption at rest, least-privilege access controls, multi-factor authentication for staff, secure session tokens, logging and monitoring, and vendor security review. No system is perfectly secure. If you discover a vulnerability, please report it through our security disclosure route. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.
14. International data transfers
Sidiora Labs is based in the United States, and our providers may process data in other countries. When we transfer personal information from the EEA, UK or Switzerland, we rely on adequacy decisions (including the EU–US Data Privacy Framework where the recipient is certified), the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or other lawful mechanisms, together with supplementary safeguards where needed.
15. Children
The Services are not directed to children under 13, or under 16 in the EEA and UK, and we do not knowingly collect their personal information. If you believe a child has provided us with personal information, contact compliance@sidioralabs.com and we will delete it.
16. Third-party sites and services
Our website links to services we do not operate, including GitHub, Discord, X, developer documentation and the PaxScan explorer. Their privacy practices are governed by their own policies. The website also loads fonts from Google Fonts, which receives your IP address to deliver them.
17. Changes to this policy
We may update this policy as our Services and the law change. We will post the new version here with a new effective date and, for material changes, notify account holders by email or in the product before the change takes effect.
18. Contact information
- Operating entity: Sidiora Labs Inc.
- Compliance email: compliance@sidioralabs.com
- Official domain: www.sidioralabs.com
Questions about this document
Write to our compliance team.
compliance@sidioralabs.com · We aim to reply within 30 days.