1Who we are and how to reach us
1.1The controller of your personal data is [company name to be added], formed in [country of formation to be added], of [postal address to be added]. We run SiBear Security at sibearsecurity.com.
1.2Privacy contact: [privacy email address to be added]. Support: [support email address to be added].
1.3Representative in the EU or the UK, if one is required: [EU or UK representative, if one is required to be added].
2AI disclosure
2.1This service is run by AI agents. They run the scans, grade the replies and write the results. Paid reports are produced by automated agents too.
2.2Our AI agents have the least access they need. For example, the support assistant sees one customer's ticket at a time.
3Data we hold
3.1This table lists every kind of personal or customer data the product holds. How long we keep each is in clause 7.
| ID | Data | What it is | Required? |
|---|---|---|---|
| D1 | Email address | The address you enter, and the time you confirmed it. | Required |
| D2 | Name, company, phone | Optional contact details. | Optional |
| D3 | Agent address and request type | The https address of the chat endpoint, and the request shape (an OpenAI-style endpoint, or a JSON endpoint with the message field and reply path you name). | Required |
| D4 | Test key | The scoped test key you give us. Stored encrypted. | Required |
| D5 | Tokens | A single-use email confirmation token (stored only as a hash) and an ownership token for the DNS record or file. | Created by us |
| D6 | Authorization record | The version ids of the authorization text and the terms you accepted, the time, and the request id. | Required |
| D7 | Marketing-consent record | If you tick the marketing box: the exact text and its version, the time, the source (page and request id), and any withdrawal. | Only if you tick |
| D8 | Probe results | Outcome of each probe (held, leaked or unclear), scores, findings, masked excerpts of replies, the fix preview, and run details. | Created by us |
| D9 | Raw agent replies | What your agent answered to our tests. It can contain real secrets or personal data that the tests provoked. | Created by your agent |
| D10 | Logs | Technical logs with ids. They never contain keys, our test text, raw replies or contact details. | Created by us |
| D11 | Abuse log and block list | Records of refused resends, limit hits and blocks, with the source of the request. | Created by us |
| D12 | Name-and-logo permission register | Paying customers only: company legal name, signer's name and email, the exact text and its version, the time, the logo file or web address if given, the source, and any withdrawal. | Paid customers |
| D13 | Paid-engagement records | Paying customers only: intake answers, repository access if you choose to give it, reports, and payment references. | Paid customers |
| D14 | Support messages | What you write to support and our replies. | If you write to us |
4Where the data comes from
4.1From you: D1 to D4, D6, D7, D12, D13 and D14.
4.2From your agent: D9.
4.3From our systems: D5, D8, D10 and D11.
5Why we use it
5.1This table says what we use data for. The legal basis for each use: [legal bases to be added].
| ID | Purpose | Data |
|---|---|---|
| P1 | Send the confirmation link and confirm your email | D1, D5 |
| P2 | Test your agent, grade the replies and make your result | D3, D4, D8, D9 |
| P3 | Send the scan summary to your confirmed address | D1, D8 |
| P4 | Prevent abuse, enforce limits and keep the block list | D1, D3, D11 |
| P5 | Keep the product secure and working | D10 |
| P6 | Send marketing email, only if you ticked the box | D1, D2, D7 |
| P7 | Keep proof of what you agreed to | D6, D7, D12 |
| P8 | Run paid reviews and take payment | D1, D2, D13 |
| P9 | Use a paying customer's name and logo in marketing, only if permission is on file | D12 |
| P10 | Answer support requests | D1, D14 |
| P11 | Count scans and rates to measure the product, without identifying you | D8 (counts only) |
| P12 | Meet legal duties and defend legal claims | Any of the above |
5.2We never use your data to train any model.
5.3Your phone number is optional. We use it only for marketing, and only if you tick the marketing box.
6Automated processing and AI
6.1An AI model grades each reply from your agent. It reads one reply and a scoring rule. It returns a structured grade. It has no tools. A reply that does not give a valid grade is graded "unclear", never "held".
6.2An AI model writes the fix preview. It is generic to the category of the finding.
6.3We test agents, not people. We do not use these results to make decisions about a person that have legal or similarly significant effect.
7How long we keep it
7.1Retention:
| Data | How long |
|---|---|
| An unconfirmed request, including its encrypted test key | Deleted when the confirmation link expires. The link expires after 1 hour. |
| Email confirmation token | Works once. Stored only as a hash. Expires after 1 hour. |
| Ownership token | Expires after 24 hours. |
| Test key (D4) | Deleted when the scan ends or its request expires. It is not kept in backups. |
| Raw agent replies (D9) | Deleted after 30 days. |
| Contacts (D1, D2, D6) without marketing consent | Deleted 12 months after the last scan. |
| Contacts with marketing consent | Kept until consent is withdrawn. After withdrawal they are treated as contacts without consent: deleted 12 months after the last scan. |
| Marketing-consent records (D7) | [period to be added] |
| Probe results (D8) | [period to be added] |
| Logs (D10) | [period to be added] |
| Abuse log and block list (D11) | [period to be added] |
| Name-and-logo permission register (D12) | [period to be added] |
| Paid-engagement records and reports (D13) | [period to be added] |
| Repository access and any copies of code (D13) | [period to be added] |
| Support messages (D14) | [period to be added] |
| Backups | [period to be added]. We make a nightly copy to storage away from the main server. The copy does not include the test-key table. Deleted data can stay in a backup until the backup expires. |
7.2The owner approved the automatic deletions once, as policy: test keys, unconfirmed requests and the retention schedule above. Any other deletion of customer data is approved by a person.
8Who receives your data
8.1We use these providers. Each acts for us.
| Recipient | What it receives | Where |
|---|---|---|
| Hosted AI model provider: [provider name to be added] | One reply at a time (capped in length) with the probe id, the category and the scoring rule, for grading. Category information for the fix preview. Never your test key and never your contact details. | [country to be added] |
| Email service: [provider name to be added] | Your email address and the text of the emails we send you. | [country to be added] |
| Hosting: [provider name to be added] | All data held by the product, except as in clause 7. | [country to be added] |
| Backup storage: [provider name to be added] | Nightly copies of the database, without the test-key table. | [country to be added] |
| Payments provider (when paid checkout exists): [provider name to be added] | Billing and payment details of paying customers. | [country to be added] |
8.2The model provider's own rules for keeping and training on data: [provider's retention and training terms to be added].
8.3We do not sell your data. We give it to public authorities only where the law requires.
9International transfers
9.1We are in [country of formation to be added]. Our providers are in the countries in clause 8. Your data may therefore cross borders.
9.2How we protect transfers: [statement on how transfers are protected to be added].
10Security
10.1Test keys are encrypted. Logs hold ids, not secrets. Our test text is private. Our AI agents have limited access.
10.2No system is perfectly secure. If someone took over the whole server, they could reach both the key-encryption key and the stored keys. This is why you should use a throwaway key and revoke it (Terms of Service, clause 4.7).
11Your rights and how to use them
11.1You may ask us for: a copy of your data; correction; deletion; a limit on use; to object to use; and your data in a portable form. You may withdraw consent at any time. Which of these apply depends on the law where you live.
11.2To use a right, write to [privacy email address to be added]. For your protection we reply only to the address we hold for you, and we may ask you to prove you control it.
11.3We answer within [number of days to be added]. A person approves any deletion of customer data.
11.4To withdraw marketing consent, use the unsubscribe link or write to [privacy email address to be added]. To withdraw a name-and-logo permission, use the link in your receipt email or write to [support email address to be added].
11.5You may complain to your data protection authority. In Israel this is the Privacy Protection Authority.
12Marketing email
12.1We send marketing email only if you ticked the separate marketing box. Every message has an unsubscribe link.
12.2The confirmation email and the scan summary are sent to deliver the scan you asked for. They are not sent because of the marketing box. The scan summary has a button to book a review.
12.3The automatic emails the product sends are the confirmation link, the scan summary and, for paying customers, a receipt with a withdrawal link. Replies to your support requests come from an AI assistant that says so. A person approves every marketing message before it is sent.
13Children
13.1The product is for business use. It is not for anyone under [minimum age to be added]. We do not knowingly collect data from them. If we learn we have, we delete it.
14Other people's data in replies
14.1Your agent's replies can contain personal data of other people, for example your users. The tests can provoke this. We store raw replies privately, we mask personal-looking and secret-looking values in anything customers see, and we delete raw replies after 30 days.
14.2If your data appears in a reply from someone else's agent, write to [privacy email address to be added].
15Website analytics and cookies
15.1[statement on website analytics and cookies to be added]
16Changes to this policy
16.1This policy has the version id [version id to be added]. It takes effect on [effective date to be added]. We post each new version on the website at least [number of days to be added] before it takes effect.