Privacy Policy

This policy explains what personal data Sigma AI FZE ("Sigma AI", "we", "us") collects on this website (sigmai.ae) and in its services (our web and mobile applications and APIs), why, and the control you have over it. If your organisation runs a service on its own infrastructure under a signed agreement, that agreement and your organisation's own policies also apply.

Controller and processor

For website enquiries, account data, support conversations and product-usage data, Sigma AI is the controller: we decide why and how that data is used.

For the data your organisation keeps in the services, such as records about its people or its customers, your organisation decides why and how it is used, and we process it on its instructions to provide the service. If you need a signed data processing agreement, write to [email protected].

What we collect

• Enquiries, access requests and waiting lists: what you enter in our forms (such as your name, work email, mobile number, organisation and message), and the messages we exchange afterwards.
• Account and sign-in data: your name, email address and mobile number, a hashed password (never the password itself), your role and permissions, and a record of sign-ins, including the time, IP address and browser.
• Organisation details: your organisation's name, licence and tax registration details and documents, and its billing contacts and address.
• Your organisation's content: the records, files and data your organisation enters, uploads or connects, and what the services produce from them, including location data where a feature uses it.
• Credentials for connected systems: stored encrypted in a key vault and used only when a call needs them.
• Messages we send: one-time codes and notices by email and SMS, and a record that they were sent.
• Usage, audit and security records: what was done in your account, by whom and when, which your organisation uses to govern its account.
• Operational logs: basic request and error logs that keep the website and the services running and secure.

What we do not do

We do not sell personal data. We do not show advertising. We do not train AI models on your organisation's content.

AI features

AI features process only what a person or a schedule points them at, such as a document, a conversation or a record, never your account wholesale. Under their business terms, the AI providers we use do not train their models on data sent through their APIs, and may keep requests for a limited period for abuse and safety monitoring. If your organisation connects its own AI provider account, that provider's terms govern that use.

Where your data lives

That depends on the service and the deployment. Our managed cloud runs on Microsoft Azure and Amazon Web Services. Where a service is hosted in the UAE (Microsoft Azure, UAE North), its database, files and stored credentials stay in the UAE. Other services run in regions inside and outside the UAE, and some can run in your organisation's own cloud account or on its premises. The services listed below may process some data outside the UAE.

Services we use

We name them here rather than asking you to write in for a list. Each receives only what it needs for the purpose shown:

• Microsoft Azure (UAE and other regions): hosting, databases, file storage and the key vault for stored credentials.
• Amazon Web Services (region chosen for the deployment): hosting, and Amazon Bedrock Guardrails for prompt-attack and personal-data checks where a service uses them.
• OpenAI (United States): AI models, including reading the documents you upload where a service offers it.
• Anthropic (United States): AI models.
• Pinecone (United States): the search index for documents, where a service offers document search.
• Twilio (United States): SMS, such as one-time codes and notices.
• Microsoft 365: our email, and delivery of the enquiries and notices we send.
• Google Maps Platform (Google, United States): address search, maps and routes inside the services, and the map on our Contact page.
• Zoho: invoicing and accounting records for paying customers.
• Google Analytics (Google, United States): statistics on how our websites are used, only for visitors who accept analytics cookies.

We publish changes to this list here before a new service starts processing customer personal data. If your signed agreement requires advance notice, that notice period applies.

International transfers

Some of these services process data outside the United Arab Emirates, including in the United States, so personal data may be transferred out of the country you are in. We rely on the providers' data processing terms, including standard contractual clauses where they apply, together with encryption in transit, in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and other laws that apply.

How long we keep it

• Account data: for as long as the account exists.
• Your organisation's content: until your organisation deletes it, or asks us to delete the account.
• Records we must keep by law, such as invoices: for as long as the law requires.
• Enquiries, access requests and waiting lists: for as long as they are relevant to our conversation with you, and deleted on request.
• Operational logs: for a limited rolling period, then removed.

Deleted data is removed from the live service. Backups expire through their normal rotation and are used only to recover from an incident.

Cookies and analytics

Our websites and web applications use Google Analytics to understand how they are used, but only if you accept analytics cookies in the cookie banner; until then nothing is loaded from Google. If you accept, Google sets the cookies _ga and _ga_<id>, which last up to two years, and receives the pages you view, your approximate location and your device type. We have switched off Google signals and advertising features. You can withdraw consent at any time with Cookie settings. Your cookie choice, your theme and your sign-in are remembered in your own browser so the applications work.

Deletion and your rights

Depending on where you are, you may have the right to access, correct, export or delete your personal data, to restrict or object to certain processing, and to withdraw consent. You can export your organisation's content from within the services at any time. Write to [email protected] with the subject "Privacy request"; we will confirm who you are and reply within the period the law allows.

If your data is in an account run by an organisation that uses our services, that organisation decides what happens to it, so it is usually the right first contact; tell us and we will point you to it and help. You can also complain to the data protection authority where you live.

Children

Our services are for organisations. They are not meant for anyone under 18, and we do not knowingly collect their data.

Changes to this policy

We update this policy as our services change and show the new date at the top. If a change materially affects how we use personal data, we tell account administrators before it takes effect.

Contact

Questions about this policy or your data: [email protected]. Sigma AI FZE, Office G-D-FLEX-G113D, Techno Hub Building, Dubai Silicon Oasis, Dubai, United Arab Emirates.