Privacy Policy
Last updated October 10, 2026
Who we are
SigWise operates the SigWise website, console, docs and API. You can reach us about privacy at privacy@sigwise.ai.
This policy covers the website, console and docs, and the account data we hold about the people who use them. It does not cover the events and messages that our customers send through the API about their own users. For that data, the customer decides why and how it is processed and we act as its processor under our Data Processing Agreement. If you are one of a customer's users, please contact that customer.
What we collect
- Account data. Your email address, a bcrypt hash of your password (never the password itself), your role, and, if you use them, your Google or GitHub identity and your two-factor authentication secret (stored encrypted). We also keep your API key IDs and encrypted key secrets, and the signals, rules and webhook endpoints you configure.
- Billing data. Your prepaid balance, top-ups and usage by day, signal and model. Card payments are taken by Stripe: we receive your billing email and the amounts, and we do not see your card number.
- Technical data. Requests to the API and console, with IP address, timestamps, request IDs and outcomes, kept in server logs and Cloudflare's request logs. We do not write message content to application logs.
- Emails. We send account emails, such as verification and password reset, and the alerts you configure, and keep a record of what was sent.
- Cookies. The console sets only the cookies it needs to work:
analyze_session(your sign-in) andanalyze_csrf(protection against forged requests). We do not use advertising or analytics cookies.
Why we use it
| Purpose | Data | Legal basis |
|---|---|---|
| Provide the service and your account | Account, billing, technical data | Contract |
| Take payment and keep financial records | Billing data | Contract; legal obligation |
| Keep the service secure and prevent abuse | Technical data, account data | Legitimate interests |
| Send service emails | Account data | Contract |
| Answer your requests | What you send us | Legitimate interests |
Who receives it
We use the services on our Sub-processors page. For your account data this means hosting by Railway and Cloudflare, payments by Stripe, email by Resend and, if you choose them, sign-in by Google or GitHub. We do not sell personal data and we do not share it for advertising.
How long we keep it
- Account data: while your account is open.
- Billing ledger: as long as financial records must be kept. It is never pruned.
- Sent-email records: 90 days by default.
- Webhook delivery records and rule firings: 30 and 90 days by default.
Customers control how long the events they send are kept; see Data retention.
International transfers
Our providers may process data in countries other than yours. Where the law requires a transfer mechanism, such as standard contractual clauses, we rely on it, and our Data Processing Agreement covers it for customer data.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict some processing, and to complain to your data protection authority. To use them, write to privacy@sigwise.ai. We will verify that the request comes from the account holder before acting on it.
Security
See Security for how requests, secrets and message content are protected.
Changes
We post changes on this page and change the date at the top. For material changes we will also email account holders.