Privacy Policy

1. Who we are and what this coversCopy Anchor Link

Sieve AI ("Sieve", "we", "us") is an independent research lab in Hyderabad, India. This Privacy Policy explains how we handle personal data about people who use our console, API, playground, documentation and website, who write to us, or who apply to work with us.

For this data, Sieve is the data fiduciary under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"). When a customer sends personal data about its own users through the API, the customer decides why and how it is processed, and we act on its instructions.

Our Master Customer Agreement and Data retention page should be read with this policy.

2. What we collectCopy Anchor Link

• Account details: name, email address, password hash or sign-in provider (Google, GitHub, Hugging Face), passkeys and two-factor settings, and your role in your organisation.
• Organisation and billing details: organisation name, country, billing address, GSTIN or other tax ID, invoices, and records of payments, refunds and credit balances.
• Payment details: Razorpay and Stripe process card and other payments. They give us a payment reference, the last digits and type of the card, and the result. We never see or store full card numbers or CVV codes.
• Usage metadata: for each API request, the time, IP address, API key ID, request ID, model, status, latency and token counts. Not the content of your requests or answers.
• Device and location data: IP address, browser and device type, and the approximate country we derive from your IP address. We use this for security, fraud checks and tax.
• Security records: sign-in events, active sessions and an audit log of changes made in the console.
• Onboarding survey: if you answer it, your company size and how you heard about us. Every survey question is optional.
• Communications: messages you send to support, sales or legal, and our replies.
• Job applications: if you apply to work with us, your CV, contact details and anything else you choose to send.
• Consents: which version of our Master Customer Agreement and this policy you accepted and when, and whether you chose to receive product emails.

3. Your Input is not collectedCopy Anchor Link

We don't store or log the text, JSON or images you send to the API, or the answers it returns. They are processed in memory only, and we never use them to train models without your written agreement. The narrow exceptions for flagged content and content the law requires us to preserve are listed in Data retention.

4. CookiesCopy Anchor Link

• The console and admin apps set only strictly necessary cookies: a session cookie that keeps you signed in, and the cookies our sign-in and security checks need.
• The console and admin apps load no analytics, advertising or tracking scripts. Our documentation site sets no cookies.
• Our public marketing website uses analytics tools. Its own cookie notice describes them. TODO: lawyer-check the website cookie notice.

Because we use only strictly necessary cookies in the console, we do not show a cookie banner there. If you block them, you will not be able to sign in.

5. EmailsCopy Anchor Link

• We send account and security emails, such as sign-in alerts, verification links, invoices and changes to these policies. You cannot turn these off while you have an account.
• We send product news only if you opt in. You can withdraw that consent at any time in the console settings.
• Our emails contain no tracking pixels and no click-tracking links. We do not record whether you open them.

6. How we use personal dataCopy Anchor Link

• To create and run your account, sign you in and keep the Services secure.
• To provide the Services, meter usage, and bill you.
• To prevent fraud and abuse and enforce our Acceptable use policy.
• To provide support and reply to you.
• To understand who uses Sieve and improve the Services, using survey answers and usage metadata.
• To send the emails described in section 5.
• To assess job applications.
• To meet legal duties, including tax, accounting, CERT-In and DPDP record-keeping, and to respond to lawful requests.

We rely on your consent, or on a legitimate use the DPDP Act allows, such as meeting a legal duty or a purpose you gave the data for.

7. Who we share it withCopy Anchor Link

• Service providers who help us run the Services, such as hosting, content delivery, email delivery, error monitoring and payment processing. They may use the data only to serve us, under contracts that require them to protect it. TODO: publish the sub-processor list.
• Affiliates that are part of the Sieve group, under this policy.
• Authorities, when the law, a court or a government order requires it, or to protect people from harm.
• A buyer or successor, if we are involved in a merger, acquisition or sale of assets, under this policy.
• Anyone else you ask us to share with, with your consent.

We do not sell personal data, and we do not share it with advertisers.

8. Your rightsCopy Anchor Link

Under the DPDP Act you can:

• get a summary of the personal data we hold about you and how we use it;
• ask us to correct, complete or update it;
• ask us to erase it, unless we must keep it by law;
• withdraw any consent you gave, as easily as you gave it;
• nominate someone to act for you if you die or become unable to act; and
• raise a grievance with us, and then, if you are not satisfied, complain to the Data Protection Board of India.

Write to support@sthanika.ai to use these rights. You can also update your account details and email choices in the console. We will verify your identity and reply within the time the DPDP Rules require. TODO: lawyer-check the response period.

If you are in the European Union or the United Kingdom, you also have rights under the GDPR, including access, correction, erasure, restriction, portability and objection, and the right to complain to your local supervisory authority.

9. How long we keep itCopy Anchor Link

We keep personal data only as long as we need it or the law requires. Data retention lists each kind of record, how long we keep it and why. Job applications are kept for 12 months after the hiring decision unless you ask us to delete them sooner. TODO: lawyer-check.

10. SecurityCopy Anchor Link

We protect personal data with encryption in transit and at rest, hashed passwords and API keys, two-factor authentication, role-based access and an append-only audit log. See Security. No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board as the law requires.

11. ChildrenCopy Anchor Link

The Services are not for anyone under 18. Because we do not collect verifiable parental consent, we do not knowingly let minors open accounts. If you believe a minor has given us personal data, write to support@sthanika.ai and we will delete it.

12. Where data is processedCopy Anchor Link

A copy of account, billing and security records is kept in India. API requests are processed in India and are not stored. TODO: confirm hosting regions before launch. Some service providers, such as email and payment providers, may process account data outside India. We transfer data only to countries the Government of India has not restricted, under contracts that protect it.

Vault runs entirely in your own environment and sends us no content, logs or personal data.

13. Changes to this policyCopy Anchor Link

When this policy changes in a way that matters, we show the new version in the console and ask you to review and accept it before you continue. The version and date at the top always show the current text.

14. Grievance officer and contactCopy Anchor Link

Grievance officer: TODO: name. Email: support@sthanika.ai. Postal address: TODO: registered address.