Privacy Policy

This policy explains what personal data Sigma AI FZE ("Sigma AI", "we", "us") collects on this website (sigmai.ae) and in the Sigma platform, including Sigma's cloud (platform.sigmai.ae), why, and the control you have over it. If your organisation runs Sigma on its own infrastructure under a signed agreement, that agreement and your organisation's own policies also apply.

Controller and processor

For website enquiries, account data, support conversations and product-usage data, Sigma AI is the controller: we decide why and how that data is used.

For the content your organisation puts into Sigma, such as documents in Spaces, conversations with agents, agent instructions and skills, and data agents read from your connected systems, your organisation decides why and how it is used, and we process it on its instructions to provide the service. If you need a signed data processing agreement for procurement or due diligence, write to [email protected].

What we collect

• Enquiries and access requests: what you enter in our contact and request-access forms (name, work email, organisation, job title, country, organisation type and size, deployment preference, preferred language and your message), and the emails we exchange afterwards.
• Account data: your name, email address, a hashed password (never the password itself), and the groups and permissions your organisation gives you.
• Your organisation's content: documents, conversations, files, agent configurations, memory and outputs in its workspace, and the data agents read from the systems it connects.
• Credentials for connected systems: stored encrypted in the platform's vault and used only when a call needs them.
• Usage, audit and security records: token usage per person and model, session transcripts and timelines, approvals, Protect findings, the audit log and record history, which your organisation uses to govern its agents.
• Operational logs: basic request and error logs that keep the website and the platform running and secure.

This website uses Google Analytics to understand how visitors use it, but only if you accept analytics cookies in the cookie banner; until then nothing is loaded from Google. If you accept, Google sets the cookies _ga and _ga_<ID>, which last up to two years, and receives the pages you view, your approximate location and your device type. We have switched off Google signals and advertising features. You can withdraw consent at any time with Cookie settings at the bottom of every page. The site also remembers your cookie choice and your light or dark theme in your own browser, and those never reach us. The Contact page shows our office on an embedded Google Maps map, which loads from Google and is covered by Google's privacy policy.

What we do not do

We do not sell personal data. We do not show advertising. We do not train AI models on your organisation's content.

AI features

Agents process only what a person or a schedule points them at. For each step, the platform sends the model provider chosen for that agent (OpenAI or Anthropic today) what that step needs: the agent's instructions, the conversation, and the passages, files or tool results it is working with, never the workspace wholesale. Under their business API terms, OpenAI and Anthropic do not train their models on data sent through their APIs, and may keep requests for a limited period for abuse and safety monitoring.

Documents added to a Space are split into passages, converted into embeddings and indexed by Pinecone so agents can search them and cite the source. When an administrator switches on Protect, each message is checked before it reaches the model: Sigma's own pattern and word checks run inside the platform, and prompt-attack and personal-data checks run in Amazon Bedrock Guardrails. Protect stores no message text.

These AI and search services are used through your organisation's own accounts and agreements with each provider (see Services below).

Where your data lives

That depends on the deployment your organisation chooses: Sigma's cloud, your own cloud account, or your own premises. Sigma's cloud runs on Amazon Web Services and Microsoft Azure, in regions inside and outside the United Arab Emirates. When you run Sigma yourself, the platform, its data store, credentials and audit trail stay in your environment.

In every deployment today, model requests go to the chosen model provider and document search uses Pinecone (AWS us-east-1 by default; the region is chosen when the index is created). Self-hosted models and a local search index are on our roadmap. If your organisation needs data to stay in a specific country, talk to us about the deployment.

Services

We name them here rather than asking you to write in for a list. The AI and search services are contracted and paid for by your organisation, under its own accounts and agreements:

• OpenAI (United States): AI models for agents that use an OpenAI model.
• Anthropic (United States): AI models for agents that use an Anthropic model.
• Pinecone (United States): embeddings and the search index for documents in Spaces.
• Amazon Web Services, Amazon Bedrock Guardrails (region chosen by your organisation): Protect's prompt-attack and personal-data checks, when Protect is switched on.

For our own operations, we use:

• Amazon Web Services and Microsoft Azure: hosting for Sigma's cloud.
• Microsoft 365: our email, and delivery of the enquiries you send through this website.
• Zoho: invoicing and accounting records for paying customers.
• Google Analytics (Google, United States): statistics on how this website is used, only for visitors who accept analytics cookies.

We publish changes to this list here before a new service starts processing customer personal data. If your signed agreement requires advance notice, that notice period applies.

International transfers

Some of these services process data outside the United Arab Emirates, including in the United States, so personal data may be transferred out of the country you are in. We rely on the providers' data processing terms, including standard contractual clauses where they apply, together with encryption in transit, in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and other laws that apply. Where local law requires in-country processing, your organisation can run Sigma on its own infrastructure; talk to us about what that covers today.

How long we keep it

• Account data: for as long as the account exists.
• Your organisation's content: until your organisation deletes it, or asks us to delete the account. We do not delete it automatically when an account closes; tell us and we will.
• Audit and history records: Sigma archives records rather than erasing them, so your organisation keeps an accurate audit trail. When an account is deleted at your organisation's request, they are deleted with it, except where we must keep something to meet a legal obligation.
• Live conversation streams: about one day, after which the session keeps its stored transcript.
• Enquiries and access requests: for as long as they are relevant to our conversation with you, and deleted on request.
• Operational logs: for a limited rolling period, then removed.

Deleted data is removed from the live service. Backups of Sigma's cloud are taken daily and kept for 14 days, then deleted; they are used only to recover from an incident.

Deletion and your rights

Depending on where you are, you may have the right to access, correct, export or delete your personal data, to restrict or object to certain processing, and to withdraw consent. Write to [email protected] with the subject "Privacy request". We will confirm who you are and reply within the period the law allows. On request, we export your organisation's content for it.

If your data is in a workspace run by an organisation that uses Sigma, that organisation decides what happens to it, so it is usually the right first contact; tell us and we will point you to it and help. You can also complain to the data protection authority where you live.

Children

Sigma is a service for organisations. It is not meant for anyone under 18, and we do not knowingly collect their data.

Changes to this policy

We update this policy as Sigma changes and show the new date at the top. If a change materially affects how we use personal data, we tell account administrators before it takes effect.

Contact

Questions about this policy or your data: [email protected]. Sigma AI FZE, Office G-D-FLEX-G113D, Techno Hub Building, Dubai Silicon Oasis, Dubai, United Arab Emirates.