--- title: "Privacy policy" language: "en-US" description: "Siglata stores the minimum needed to run organizations and files. This page is the public description of that data. It is not a substitute for the contract of a specific customer, and it does not apply to content you store in files. File bytes belong to the organization that uploaded them." canonical: "https://www.siglata.com/en-US/privacy" last_updated: "2026-10-27" --- # Privacy policy Siglata stores the minimum needed to run organizations and files. This page is the public description of that data. It is not a substitute for the contract of a specific customer, and it does not apply to content you store in files. File bytes belong to the organization that uploaded them. ## Who operates Siglata Siglata is operated by Siglata Tecnologia Ltda, CNPJ 69.277.307/0001-30, which serves customers in Brazil. Customers outside Brazil are served by Estirpia Technologies Pte. Ltd. (UEN 202633281R), Singapore. Contact: contato@siglata.com. Siglata Tecnologia Ltda is the controller of the personal data of users in Brazil under the Brazilian General Data Protection Law (LGPD, Law 13.709/2018). Estirpia Technologies Pte. Ltd. is the controller of the personal data of users outside Brazil. The data protection officer (encarregado) of Siglata Tecnologia Ltda is Benjamin Tang Hao Zhe, at privacidade@siglata.com. ## Account data Sign-in is available by one-time email magic link or Google; an account Siglata provisions itself, such as a directory reviewer's, may also sign in with a password Siglata issued. We store the sign-in email, name, session records, and organization membership (role and invitation state). When you sign in with Google, Google shares your name, email address and profile photo, and we store the Google account identifier. Google is used only to confirm who signs in, so we do not keep the access, refresh or ID tokens Google returns. We do not store a password for accounts you create; for a provisioned account we store only a scrypt hash of its password. Magic-link messages are sent through our mail provider. Locale preference may be stored in a cookie named `siglata-locale` so the site and transactional mail match the language you picked. ## Organization and file data File names, sizes, media types, folder membership, visibility, and access grants are stored with the organization. File bytes are stored in object storage addressed by immutable identifiers. Trashed files remain until the 30-day recovery window ends, then they are deleted. Storage usage counts active and trashed files against the organization's quota. ## Agent access MCP clients receive an OAuth grant bound to one organization and a list of scopes. Tokens are validated against the live session and current membership on every tool call and byte transfer. Open listen streams recheck access about every 30 seconds and may keep sending updates until the next check. Ending the session or removing the member prevents subsequent access after revalidation. We do not issue long-lived unscoped API keys. ## Stored credentials An organization can store logins that its agent's local scripts need, such as a portal's username and password. They are typed on a Siglata page opened from a one-time link that expires after one hour, never in the agent conversation. The one-time token in each credential link sits in the part of the link after the “#”, which browsers and scripts do not send in the request, so Siglata's request logs and traces never hold it. The values are encrypted with AES-GCM under a key of their own, and that key is encrypted under a key only Siglata's API server holds, so the database keeps only the encrypted form. Each person's credential is personal: only that person can use it, and the organization's owners and admins see only that it exists, so they can delete it when someone leaves. An owner or admin can also store a company-wide credential for the whole organization, or for the members and teams it is shared with. Each use hands the values once to a local script through a link that expires after 60 seconds, and records who used which credential and when. Deleting a credential deletes its encrypted values. ## Social listening When an agent uses social listening, Siglata sends the network and the account, post link, place or search terms the agent asked for to treg, which fetches the public profiles, posts, comments, news or Google Maps reviews and returns them to the agent. The organization's ID goes to treg as a billing tag. Siglata does not store what treg returns. Each call is charged to the organization's credits; the credit ledger records the organization, the operation, the treg endpoint, the cost and the time, never the request or its results. ## Web search and page reading When an agent searches the web or reads web pages through Siglata, Siglata sends Context.dev the search terms as the agent wrote them, with a language or region only when the agent passes one, or the public addresses of the pages to read. Siglata reads only public http or https addresses and refuses search terms that hold a CPF, an NF-e key or a boleto line; it never sends Context.dev a customer's files. Context.dev returns the results to the agent. Siglata sends Context.dev no user or organization identifier and does not store what it returns. ## Portal connections On the Business plan, a person can connect a portal the company uses, such as an ERP, so agents can work in its pages. The person logs in to the portal on a Kernel page Siglata opens and types the username, password and authenticator code there; Siglata never receives them. Kernel stores that login, including the password, in its own credential store and the browser profile with the session cookies, both hosted in the United States, uses the login to log in again when the session expires, and records each login to diagnose failures. When an agent works in the portal, Kernel opens a browser with that profile, and the pages the agent reads and the actions it takes go through Kernel. Siglata stores the connection's domain and status, each session's steps until it is closed (a session that expires open stays until the portal is disconnected) and, in Activity, the record of each portal operation. For this data the organization is the controller, Siglata its processor and Kernel Siglata's sub-processor; data-subject requests go to the organization. ## Emails sent by the agent On the Business plan, a person's agent can send email on their behalf to the organization's members and to the contacts in the company's Contatos table; any other address is refused. Messages go out from a Siglata address on mail.siglata.com, with the person's name as the sender, and replies go to the person's email. Siglata keeps each message sent, with its recipient, subject, text, the files attached or sent as links, and its delivery status; the sender sees their own messages, and owners and admins see all of them. Messages carry no tracking pixel: the history shows only whether a message was delivered or bounced, as reported by the email provider, and the first time the recipient opened a file sent as a link. Those links expire after 7 days. Every message has an unsubscribe link; anyone who unsubscribes, or whose address permanently rejects the message, goes on the company's suppression list and gets no more email from that company through Siglata. For this data the organization is the controller and Siglata is the processor; data subject requests go to the organization, and an unsubscribe takes effect at once. ## Audio transcription When an agent asks to transcribe a recording stored in Siglata, Siglata sends ElevenLabs the audio file, the language, the number of speakers and the terms (such as product names) the agent passed. ElevenLabs returns the text with its speakers and times, and Siglata stores it as a new file in the recording's folder, with the same visibility. Siglata sends ElevenLabs no user or organization identifier. ## Where data is stored Each company's Registros, the tables your agent queries and changes, are kept in a database of the company's own, hosted by Neon on Amazon Web Services in the United States (region us-east-1). Arquivo files are kept in Cloudflare object storage in eastern North America. Accounts, sign-in sessions and Siglata's control data, such as companies, members, plans and usage, are kept on Cloudflare. Transactional emails and the emails agents send go out through Cloudflare Email Service. Until it is deleted, the data of Siglata's previous versions stays in PlanetScale's and Neon's databases on Amazon Web Services in São Paulo (region sa-east-1). ## Your agent's provider Your agent runs with the provider your organization chose: OpenAI (Codex, ChatGPT), Anthropic (Claude Code) or any other MCP client you connect. That provider receives the data the agent reads through Siglata and processes it under your account's or organization's own agreement with it, not as Siglata's service provider; processing may happen outside Brazil. ## Model training Siglata doesn't use customer data to train AI models. ## Service providers that process data We use these providers to run Siglata: - Cloudflare: network, software runtime, the database of accounts and sign-in sessions, Siglata's control data, the object storage of the Arquivo (in eastern North America), transactional email, the emails agents send, and logs for each app and API Worker invocation, including request/response metadata and operational diagnostics. - Neon (Databricks, Inc.) and Amazon Web Services: the database of each company's Registros (United States, region us-east-1) and, until it is deleted, the data of Siglata's previous versions (São Paulo, Brazil). - PlanetScale and Amazon Web Services: the database of Siglata's previous version, while that data has not been deleted (São Paulo, Brazil). - Google: identity provider used when you choose Google sign-in. - Axiom: in production, receives traces from app and API Worker executions and operational API logs: each agent MCP request and each app request, with the agent client's identity (OAuth client and client name and version), MCP operation names, the route, outcome, error codes, timing, and user and organization IDs. Traces and logs are retained for 30 days. - PostHog (EU): when configured, records page views on the marketing site and in the app, with the page address and the referrer address stripped of query parameters and fragments. On the marketing site, page views also record the campaign parameters of the visit URL (utm_source, utm_medium, utm_campaign, utm_content and utm_term, plus ad click identifiers such as gclid and fbclid); the app records none. The marketing site records clicks and form submissions or changes, with the text and attributes of elements masked; the app records no interactions automatically. Neither site records sessions or uses heatmaps, performance metrics, error capture or feature flags. Browser analytics identifiers are stored in local storage and cookies. When a visit arrives from an AI assistant (ChatGPT, Claude, Perplexity, Gemini or Copilot), the assistant's name is kept for 90 days in a cookie named siglata-ai-source and recorded as first_touch_ai_source on page views, on the person and on the sign-up event. Events identify the user by user ID, without an email address, and are grouped by organization ID. The server records sign-ups, sign-ins and organization creation; in the console, file downloads (ID and size), completed uploads, and agent connections and revocations, with the IDs of the items involved; and each agent MCP tool call, with the agent client's family (such as ChatGPT, Codex or Claude), the OAuth client ID, the protocol version, the member's role, the granted scopes, the connection's session ID, the names of the operations called, the outcome, error codes, timing, counts and credits used. The browser records the magic-link request (without the email address), sign-out, the choice of an organization, and accepted or declined invitations, with the matching IDs. For practice calls, the server records the start and end of each call, with the user ID, the organization, the scenario, the call ID, the outcome, error code and duration, never the transcript or the audio. PostHog and Axiom never receive file contents, file names, SQL, search text, scripts, cell values or transcripts. - treg: fetches the public social media, news and Google Maps data that social listening asks for. - Context.dev: searches the public web, with zero data retention, and reads the public pages an agent asks for. - Kernel (Kernel Technologies, Inc., hosted in the United States): for portal automation on the Business plan only, stores the logins, including the passwords, and the browser profiles with the session cookies of connected portals and runs the browsers agents use to work in them. - ElevenLabs: transcribes the recordings an agent asks to transcribe. - Meta (WhatsApp Business Platform): carries the WhatsApp messages and media between a company's number and its registered contacts, through the Cloud API with storage in Brazil (local storage). It also carries messages from senders who aren't registered contacts; Siglata holds those messages without processing them. - OpenAI: provides the voice of practice calls; the call audio is streamed live to OpenAI during the call. ## International transfers Some providers may process personal data outside Brazil, as described above. Meta and OpenAI may process data outside Brazil; those transfers rely on each one's data processing terms (https://www.whatsapp.com/legal/business-data-processing-terms and https://openai.com/policies/data-processing-addendum/), which include standard contractual clauses. Kernel, in the United States, stores the logins, including passwords, and the browser profiles with session cookies, and receives the content of connected portals, on the Business plan only. This transfer happens because the organization, as controller, decides to connect each portal knowing where the data goes: the Business contract the customer signs names Kernel, says it is in the United States and what it stores. treg, in the United States, receives the social listening searches the agent asks for; this transfer happens because the organization decides to use social listening knowing, from this policy and, on the Business plan, from the contract, that treg runs them in the United States. Kernel doesn't store Siglata's connection records, session steps or activity records. The transfer of audio to ElevenLabs relies on its data processing agreement (https://elevenlabs.io/dpa, section 11), which includes the standard contractual clauses approved by Brazil's ANPD. Neon keeps each company's Registros in the United States (region us-east-1) and, until it is deleted, the data of Siglata's previous versions in São Paulo (region sa-east-1). Cloudflare keeps the Arquivo files in eastern North America. Contact us at the address below with questions about these transfers. ## How long data is kept - Account data is kept while the account exists. To delete an account, email the address below; an organization the account alone owns must be deleted or handed to another owner first. - Sign-in sessions are deleted 30 days after they expire. - Files and folders moved to the trash are deleted for good, with their processed data, 30 days after they were trashed, or sooner when someone deletes them from the trash. Records and tables moved to the trash, with all their history, can be recovered for 30 days and are then erased for good; an organization admin can erase them sooner on request. - Deleting an organization deletes its files, folders, processed data, access grants, stored credentials, credential-use records and weekly agent call counts at once. - An agent connection expires after 30 days without use, and ends at once when revoked. - The credit ledger is kept for five full years after the end of the calendar year it belongs to, as Singapore and Brazilian record-keeping rules require, and is then deleted automatically. - Request logs and traces in Axiom are deleted after 30 days. Cloudflare keeps Worker logs for at most 7 days. - Siglata stores no listening results. treg, which fetches them, does not store request or response contents; it keeps each call's method, path, status code and time while Siglata's treg team exists (treg privacy policy: https://treg.to/privacy). - Siglata stores no web search results or pages it read. Context.dev runs each web search under zero data retention, keeping no copy of the query or its results. For each page read, Context.dev may keep the request and the page under its own privacy policy: https://www.context.dev/privacy. - The transcript stays in the organization's files and follows the same rules as other files. ElevenLabs processes the audio it receives under its own privacy policy: https://elevenlabs.io/privacy-policy. - Disconnecting a portal immediately deletes the connection at Siglata and, at Kernel, the connection, the stored login and the browser profile; deleting the organization does the same for all its connections. Kernel keeps login recordings under its data processing agreement and privacy policy. Kernel's privacy policy: https://www.kernel.sh/privacy. - Email history and the suppression list are kept while the organization exists and are deleted with it; Siglata staff remove an address from the suppression list only at the organization's request. - PostHog keeps product analytics events for 1 year and then deletes them; ask us at the address below to delete them sooner. ## Requests For personal-data questions, account exports or deletion, contact contato@siglata.com. For security issues, email suporte@siglata.com.