Privacy

The default

Sigilline scores a message and does not keep the text. Message history is off. It stays off until you turn it on and the plan allows it. That switch is not available yet.

Kept for every call

For every call we keep the verdict, the winning rule key, confidence when a score was stored, the language code (the one you send, or "en" when you send none), the latencies, the rule count, the model id, the key that made the call, and the request id. The key is stored as a prefix and a hash, not as the secret. Confidence is metadata. It is not the message.

That record has no message text. Usage and billing are calculated from it.

When you send an Idempotency-Key, the response can be replayed for 24 hours. The stored response does not include the message.

Never kept

We do not store the message text, or the earlier turns you send.

We do not store the rule descriptions and examples sent in a call.

Server logs hold a status, a request id, latency, and the model id. They do not hold a request body. A validation error names the field and the limit. It does not quote the message.

History

Message history is off by default. It is not available yet. A later plan may include the option. It cannot be turned on until you choose how long messages are kept.

The number of days is being finalized. Until it is chosen, no message text is stored.

If history is turned on later, the stored text is encrypted before it is written, kept only for the period you chose, and deletable by you.

Your account

Sign-in uses your email and a session. We store the address and the session so you can sign in again.

A sign-in email contains only the code. It does not contain chat.

One workspace cannot read another's rows.

Contact requests

A contact request stores your name, work email, company, and the optional message, so a person can reply. If you are signed in, we also link the request to your account.

How long we keep a contact request is being finalized. Deleting the account does not delete the request, so the reply can still be sent.

Playground

A playground run keeps the same metadata as any other call: the verdict, the winning rule key, the language, the latencies, the rule count, and the model id. It does not keep the message, the earlier turns, or the rule text. It is not billed.

A saved test case keeps the message and the earlier turns, plus the channel, the sender role, and the verdict you expected. It does not keep the rules. The text stays until you delete that case, or until the account is deleted.

Rule assist

Rule assist sends the rule you are writing, and your other rules' names, keys, and descriptions, to OpenAI so it can suggest wording. Assist does not send your users' chat messages.

A policy import sends the text you paste or upload to OpenAI, then discards it. That text is not stored.

We keep a count of assists: who asked, what kind of help, and how many it cost. We do not keep the prompt, the policy, or the suggestion.

Who else processes it

The companies in each role are being finalized. They are described here by role.

Hosting holds the call in memory while it is scored, then drops it. The text is not written to a log.

The database holds the rows described on this page. When history is on, the message text is encrypted before it is written.

Rule assist uses OpenAI. It receives the rule text and the other rules' names, keys, and descriptions, and the policy text you paste or upload. Policy text is not stored. Assist does not receive your users' chat messages.

A workspace can be scored by OpenAI instead of our own model. When it is, that decision sends the message, the earlier turns, the channel, the sender role, and the rules in scope. We do not store that prompt. OpenAI may keep it for abuse monitoring for up to 30 days. A workspace that is not assigned is scored on our own model, and that chat is not sent to OpenAI.

Email delivery sends the sign-in code. That email does not contain chat.

Payments processes checkout and invoices for a paid plan. We do not store the card number.

An error tracker is not in use. If one is added, it does not receive a request or response body.

Deleting an account

Deleting an account removes memberships, API keys, stored message text, idempotent responses, and saved test cases.

Usage records may remain: counts, verdicts, rule keys, confidence, and latencies, with no message text. A playground run is one of those records. It is not billed.

A record of account actions may remain, with no message text. A count of rule assists may remain, with no rule text and no policy text. A contact request may remain so we can reply.