SIA Agents - privacy policy

Sia ("we", "us", "our") operates the Sia Agents platform, accessible at https://siagents.ai and https://app.siagpt.ai (the "Platform"). This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you access or use the Platform, including its generative AI features, AI agents, document processing capabilities, and related services.

Sia is committed to protecting your privacy and processing your personal data in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the French Data Protection Act (Loi Informatique et Libertés), and any other applicable data protection legislation.

By using the Platform, you acknowledge that you have read and understood this Privacy Policy.

The data controller for the processing of personal data described in this Privacy Policy is:

Sia, 21 rue de Berri, 75008 Paris, France Email: SIA-PARTNERS-CONFORMITE-RGPD@sia-partners.com

We collect and process the following categories of personal data.

1. Account and identification data. When you or your organization register on the Platform, we collect your name, email address, job title, organization name, and authentication credentials.
2. Usage data. We collect information about how you interact with the Platform, including queries submitted to AI models, agents used, features accessed, session timestamps, IP addresses, browser type, device information, and referring URLs.
3. Content data. When you use the Platform's features, we may process the content you submit, including text prompts, documents uploaded for Retrieval-Augmented Generation (RAG), images, files shared through the collaboration features, and AI agent configurations you create.
4. Communication data. When you contact us through the Platform's contact form or by email, we collect the information you provide in your message, including your name, email address, and the content of your inquiry.
5. Technical and log data. We automatically collect technical data such as IP addresses, HTTP protocol elements, browsing footprint, and cookies, as described in our Cookie Policy.

We process your personal data for the following purposes and on the corresponding legal bases.

1. Providing and operating the Platform. We process your account data, content data, and usage data to deliver the Platform's services, including AI chat, agent execution, document processing, RAG, batch queries, and collaboration features. Legal basis: performance of our contract with you or your organization.
2. Platform improvement and analytics. We analyze aggregated and anonymized usage patterns to improve the Platform's performance, develop new features, and enhance the user experience. Legal basis: our legitimate interest in improving our services.
3. Security and fraud prevention. We process technical and usage data to detect, prevent, and address security incidents, abuse, and unauthorized access. Legal basis: our legitimate interest in maintaining the security and integrity of the Platform, and compliance with our legal obligations.
4. Customer support and communication. We use your identification and communication data to respond to your inquiries, provide technical support, and send service-related notifications. Legal basis: performance of our contract and our legitimate interest in managing customer relationships.
5. Compliance with legal obligations. We may process your data to comply with applicable laws, regulations, court orders, or governmental requests. Legal basis: compliance with a legal obligation.

The Platform enables you to interact with multiple Large Language Models (LLMs) and AI agents. The following principles govern how your data is handled in this context.

1. Prompt and content processing. The text prompts, documents, and other content you submit are transmitted to the selected LLM provider(s) solely to generate the requested output. We do not use your prompts or content to train, fine-tune, or improve any foundational AI model.
2. Document collections (RAG). Documents you upload to create collections for Retrieval-Augmented Generation are stored securely within the Platform's infrastructure. They are indexed and processed to enable accurate information retrieval when you query them. These documents are not shared with other organizations or users outside your designated workspace.
3. AI agent configurations. Custom agents you create remain within your organization's environment. Shared agents are only visible to users within your organization unless you explicitly configure broader access.
4. Sub-processors for AI inference. The Platform operates on a multi-cloud, multi-LLM architecture. AI inference requests may be routed to third-party LLM providers under strict data processing agreements. These providers process data solely to return inference results and do not retain your data for their own purposes. Details on current sub-processors are available upon request.

We may share your personal data with the following categories of recipients.

1. Within Sia. Authorized personnel within Sia who need access to your data to operate, maintain, and support the Platform.
2. Cloud infrastructure providers. Hosting and cloud services providers who store and process data on our behalf, under appropriate data processing agreements.
3. LLM providers. Third-party AI model providers who process your prompts and content solely for the purpose of generating outputs, as described in Section 5.
4. Service providers. Third parties who assist us with analytics, security, customer support, or other operational functions, under contractual obligations to protect your data.
5. Legal and regulatory authorities. When required by applicable law, regulation, legal process, or governmental request.

We do not sell your personal data to any third party.

Sia prioritizes hosting and processing data within the European Union. Where data transfers outside the EU/EEA are necessary (for instance, to route an inference request to an LLM provider), we ensure that appropriate safeguards are in place, including the European Commission's Standard Contractual Clauses or an adequacy decision, in accordance with Chapter V of the GDPR.

We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, or as required by applicable law. The retention periods vary depending on the nature of the data and the purpose of processing.

Account data is retained for the duration of your contractual relationship with us and for up to three years following its termination for customer relationship management purposes, unless a longer period is required by law.

Content data (prompts, uploaded documents, agent outputs) is retained for the duration of your subscription. Upon termination, content data is deleted within 90 days, unless you request earlier deletion.

Technical and log data is retained for up to 12 months for security and analytics purposes.

Sia implements robust technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. The Platform is ISO 27001 certified, reflecting our commitment to information security management best practices. Measures include, but are not limited to, encryption of data in transit and at rest, access controls, regular security audits, incident detection and response procedures, and employee awareness training.

In accordance with the GDPR, you have the following rights regarding your personal data:

• Right of access. You may request confirmation of whether we process your personal data and, if so, obtain a copy of that data along with information about the processing.
• Right to rectification. You may request that we correct or complete inaccurate or incomplete personal data.
• Right to erasure. You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw your consent.
• Right to restriction. You may request that we restrict the processing of your personal data in certain circumstances.
• Right to data portability. You may request to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller where technically feasible. This right applies only to data you have directly provided.
• Right to object. You may object to the processing of your personal data based on our legitimate interests, including for direct marketing purposes.
• Right to withdraw consent. Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.
• Right to determine the fate of your data after death. You may provide instructions regarding the retention, erasure, or communication of your personal data after your death.

You may exercise your rights by contacting us at:

• By email: SIA-PARTNERS-CONFORMITE-RGPD@sia-partners.com
• By post: Sia, Legal Department, 21 rue de Berri, 75008 Paris, France

Please include a copy of an identity document with your request. We will respond within one month. In the case of complex or numerous requests, this period may be extended by up to two additional months, and we will inform you accordingly.

The Platform uses cookies and similar technologies for authentication, security, analytics, and preference management. During your first visit, you will have the opportunity to accept or refuse cookies and to configure your preferences in detail. For more information, please refer to our Cookie Policy.

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third-party sites. We encourage you to read the privacy policies of any third-party site you visit.

The Platform is designed for business use and is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete that data promptly.

If you believe that your data protection rights have not been respected, you have the right to file a complaint with the relevant supervisory authority. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL):

• Website: www.cnil.fr
• Address: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform's features, or applicable legal requirements. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. We encourage you to review this page periodically.

For any questions or concerns regarding this Privacy Policy or our data processing practices, please contact us at:

Sia — Data Protection, 21 rue de Berri, 75008 Paris, France Email: SIA-PARTNERS-CONFORMITE-RGPD@sia-partners.com