Legal
Privacy notice
Last updated
How Sigmix collects, uses, stores and shares personal data, written to the shape required by the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations.
This build carries draft wording. Every section marked as a placeholder must be settled with Saudi counsel before launch.
01Who we are
Placeholder — counsel review required
Sigmix Inference API is operated from Riyadh, Kingdom of Saudi Arabia. For the personal data described in this notice we act as the data controller, except where the Data Processing Addendum applies and we act as your processor.
[PLACEHOLDER — counsel to confirm: the exact registered legal entity name, commercial registration number, registered address, and whether the controller is the operating company or a group parent. Until that is settled, no entity name is asserted here.]
02What this notice covers
This notice covers the Sigmix website, the customer console, and the inference API. It describes personal data about you as an account holder or website visitor.
Where you send us personal data belonging to other people inside an API request, you are the controller of that data and we process it on your instructions. That relationship is governed by the Data Processing Addendum, not by this notice.
03Personal data we collect
We collect the minimum needed to run an account and bill it accurately.
- Account data — name, work email address, organisation name, and where you supply it, a phone number.
- Authentication data — a one-way hash of your password, session identifiers, and the times and source addresses of sign-in attempts.
- Commercial data — VAT registration number, commercial registration number, billing address, invoices and payment records.
- Technical data — IP address, user agent, request timestamps, and error diagnostics.
- Usage metadata — for each API request: the model identifier, the API key used, token counts, latency, HTTP status and computed cost.
- Correspondence — the content of support tickets and emails you send us.
04Prompt and response content
Prompt and response bodies are processed in memory to serve the request and to compute the cost of that request. We do not use them to train or fine-tune any model, and we do not sell them.
We retain the metadata listed above so that you can audit and reconcile your own usage. Retaining prompt or response bodies is off by default. Where an enterprise agreement enables retention for debugging, the retention window and the access controls are set out in that agreement.
Do not send data you are not licensed to send. If you process health, financial, biometric or credit data, or data about children, tell us before you begin so the correct controls and classification are applied to your keys.
05Why we process it, and on what basis
We rely on the legal bases available under the PDPL and its Implementing Regulations.
- Performance of a contract — creating and running your account, routing requests, metering, invoicing and support.
- Legitimate interests — securing the service, preventing abuse and fraud, and improving reliability, where those interests do not override your rights.
- Compliance with a legal obligation — tax, accounting, commercial-registry and law-enforcement obligations under Saudi law.
- Consent — marketing email, and any optional processing we describe to you at the point of collection. You can withdraw consent at any time without affecting the service.
06Who we share it with
Placeholder — counsel review required
We share personal data only with subprocessors that are necessary to run the service, and only under a written contract that binds them to the standards in this notice.
[PLACEHOLDER — counsel and engineering to confirm: the final list of subprocessors, each one named with its role, its processing location and the safeguards in place. A subprocessor list that is not complete and not current is a defect, not a formality.]
We do not sell personal data, and we do not share it for advertising.
07Where your data is processed
Placeholder — counsel review required
Where a request is served depends on its route. Requests on the sovereign route are served inside the Kingdom of Saudi Arabia only — on Sigmix GPUs or by in-Kingdom partners — and are never sent abroad. Requests on the international route may be served outside the Kingdom, by the providers named on that route's model list. Our gateway, our database and our backups run in the Kingdom.
[PLACEHOLDER — counsel to confirm: the Article 29 basis and safeguards for international-route requests, which the customer chooses to send abroad by using an international key; and confirmation that no support or telemetry access to sovereign-route systems occurs from outside the Kingdom.]
08How long we keep it
Account and authentication data is kept for as long as the account is open, then deleted or anonymised.
Usage metadata and invoices are kept for the period required by Saudi tax and commercial law, because we are obliged to be able to reproduce a bill.
Support correspondence is kept for as long as needed to resolve the matter and to defend a claim arising from it.
When a retention period ends, the data is destroyed or irreversibly anonymised.
09Your rights
Under the PDPL you have the right to be informed, the right to access your personal data, the right to obtain a copy of it in a readable format, the right to request its correction, completion or update, and the right to request its destruction where we no longer need it.
Exercise any of these by writing to the contact address below from the email address on the account. We will verify who you are before acting, and we will answer within the period required by the Implementing Regulations.
There is no charge for a first request. We may charge a reasonable fee for repeated or manifestly excessive requests, and we will tell you before we do.
10Automated decision-making
Routing chooses which model serves a request. It does not make decisions about you, and it produces no legal or similarly significant effect on any individual.
Fraud and abuse controls may automatically suspend an API key or an account. A suspension can always be reviewed by a person on request.
11Security
Traffic is encrypted in transit. The credentials we hold for model providers are encrypted at rest with AES-256-GCM under a key held outside the database. API keys are stored only as SHA-256 fingerprints, and passwords only as scrypt hashes.
Access to production systems is limited to named staff, is authenticated individually, and is logged.
No control set removes all risk. If you find a weakness, report it to the contact address below rather than exercising it.
12Personal data breaches
Placeholder — counsel review required
If a breach occurs that meets the reporting threshold, we notify the Saudi Data and Artificial Intelligence Authority within the period set by the Implementing Regulations, and we notify affected individuals where the breach is likely to cause them serious harm.
[PLACEHOLDER — counsel to confirm: the current notification deadline and threshold under the Implementing Regulations as amended, and the named person accountable for making the notification.]
13Cookies and similar technologies
We set a small number of first-party cookies and local storage entries, and no third-party tracking cookies.
A session cookie keeps you signed in. It is httpOnly and is cleared when you sign out.
Two preference entries remember your chosen language and display currency. They hold no personal data and are stored in your browser.
There are no advertising, analytics or social-media cookies on this site.
14Children
The service is sold to organisations and is not directed at children. We do not knowingly create accounts for anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.
15Changes to this notice
We publish the date of the most recent change at the top of this page. Where a change materially affects how we handle your personal data, we tell account holders by email before it takes effect.
16Contact and complaints
Placeholder — counsel review required
[PLACEHOLDER — counsel to confirm: the data protection officer or accountable contact, their email address, and the postal address for formal notices. PDPL requires a reachable contact point; a generic inbox is not sufficient for a regulator.]
If you are not satisfied with our answer, you may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA), which supervises the PDPL.