Sibylline Platform Privacy Policy

Document control

1. Who we are

1.1 Sibylline Labs Limited ("Sibylline", "we") is the controller of the personal data described in this policy. We are registered in England and Wales under company number 14632125, with our registered office at 9 Cwrt-Y-Coed, Brackla, Bridgend, Wales, CF31 2ST.

1.2 Questions about this policy, or requests to exercise your rights, go to contact@sibylline.group.

2. What this policy covers, and our two roles

2.1 This policy covers the Sibylline platform: the Portal at dash.sibylline.group and yak.sibylline.group, the API at api.sibylline.group, the eris CLI when it is connected to the platform, Eris Yaks and any other Product, and our support channels. The marketing website at sibylline.group has its own Website Privacy Policy.

2.2 We handle personal data in two roles.

• As a controller for Account Data and Usage Data: the information we need to run an Organisation's account, authenticate its Users, bill it, support it and secure the platform. This policy describes that processing.
• As a processor for Customer Data: the contents of Reports that an Organisation's Users and Agents submit, which we process on the Organisation's instructions to deliver into its Linear workspace. The Organisation is the controller of that data. Our Data Processing Agreement with the Organisation governs it, and section 5 below summarises what happens to it.

2.3 If you are a User of an Organisation's workspace and want to know how the Organisation uses data about you, ask the Organisation. If you want to exercise rights over Customer Data, we will pass your request to the Organisation and help it respond.

2.4 Capitalised terms have the meanings given in the Sibylline Platform Terms of Service.

3. The personal data we collect as controller

3.1 Identity and account data from Linear. When an Administrator connects a Linear workspace or a User signs in, Linear gives us the User's name, email address, avatar, Linear user ID, the workspace ID and name, and whether the User is a workspace admin. We also store the role we assign to the User in the Organisation.

3.2 Authentication data. For each credential issued by eris login we store a hash of the credential (never the credential itself), the User it belongs to, a device identifier, the device-code approval record, and the IP address, user agent and timestamps of sign-ins and token use.

3.3 Billing data. The Billing Administrator's name and email address, the Organisation's Stripe customer ID, subscription state, Seat count history, invoices and payment status. Stripe collects and holds payment card details; we never see full card numbers.

3.4 Support and Vendor Report data. Emails you send to contact@sibylline.group, and the content of Vendor Reports, which carry the reporting User's name, the Organisation's identifier and whatever the User or Agent wrote.

3.5 Usage and audit data. Logs and metrics about requests to the API and Portal, and audit events recording changes to an Organisation (a credential issued, a Seat added, a Report received or delivered). Audit events contain identifiers, counts and hashes, not the content of Reports.

3.6 Communications. Notices we send you about the platform, your subscription or security, and your replies.

3.7 We do not collect special category data about you and we do not want it in Reports (Terms, clause 7.1(b)).

4. How we use personal data, and the lawful bases

4.1 We do not send marketing emails to Users. If we start to, we will ask first and every message will carry an unsubscribe link.

4.2 We do not make decisions about you by automated means that have legal or similarly significant effects.

4.3 We do not sell personal data, and we do not use personal data, Customer Data or Vendor Reports to train machine-learning or AI models.

5. Customer Data: Reports and Vendor Reports

5.1 A Report contains what the User or Agent writes and attaches, plus provenance: the CLI version, the type of agent or harness, a device identifier, an execution identifier, the git identity (name and email address) configured on the machine, and the names of the repositories concerned. The git identity and the reporting User's Linear name are personal data. The body of a Report may contain personal data if the User or Agent puts it there.

5.2 We process Reports as the Organisation's processor, and only to receive, store, redact, cluster and deduplicate them, deliver them to the Organisation's Linear workspace, enforce caps, and support the Organisation. Our staff read the body of a Report only in the cases set out in clause 10.8 of the Terms.

5.3 Thirty days after a Report is delivered to Linear we delete its body and evidence. We keep its metadata (identifiers, timestamps, verb, cluster, deduplication fingerprint and the Linear issue reference) for the life of the Organisation. An undelivered Report is kept until it is delivered or the Organisation deletes it.

5.4 A Vendor Report is different. When a User files a Report about the eris CLI with --vendor, it comes to us, and we process it as a controller to investigate, support, fix and improve the CLI and the Services. We delete the body of a Vendor Report 30 days after it is delivered to our workspace, and keep its metadata for the life of the Organisation it was filed into.

5.5 All Reports, Vendor Reports and the data stores that hold them are in the United States.

6. Who we share personal data with

6.1 We use these service providers. Each acts on our instructions under a written contract.

6.2 Linear receives Reports when we deliver them to your Linear workspace, and gives us your identity data when you sign in. Linear processes your data for the Organisation under the Organisation's own agreement with Linear, and under Linear's privacy policy. It is not our service provider.

6.3 Stripe is an independent controller for some of its own purposes, such as fraud prevention and compliance with financial regulation. Stripe's privacy policy describes that processing.

6.4 We may also share personal data with our professional advisers and insurers; with courts, regulators and law enforcement where the law requires or allows it; and with a buyer or successor if our business is sold or reorganised, in which case we will tell you before your data is transferred.

7. International transfers

7.1 We are based in the United Kingdom. The platform is hosted in the United States by Cloudflare, so the personal data in this policy is stored and processed there.

7.2 For personal data protected by the UK GDPR, our transfers to providers in the United States are restricted transfers. We rely on the UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework) where the provider is certified under it, and otherwise on the Information Commissioner's International Data Transfer Addendum to the EU Standard Contractual Clauses. Cloudflare states that it complies with the Data Privacy Framework, including the UK Extension, and its contract with us includes the Addendum as a fallback. Our contract with Pydantic Services Inc. relies on the Addendum. Stripe, LLC is self-certified under the Data Privacy Framework, including the UK Extension, and Stripe's Data Transfers Addendum includes the Addendum as a fallback.

7.3 For personal data protected by the EU GDPR, the transfer to us in the United Kingdom is covered by the European Commission's adequacy decision for the United Kingdom, and the onward transfer to the United States is covered by the EU Standard Contractual Clauses in our providers' contracts.

7.4 You can ask contact@sibylline.group for a copy of the safeguards we rely on.

8. How long we keep personal data

8.1 Where we need to keep data longer to deal with a dispute, a legal claim or a regulator's request, we keep only what is needed for that purpose.

9. Security

9.1 Each Organisation's data is held in its own data store. Credentials are stored as SHA-256 hashes, never in clear. Linear access tokens are encrypted with a key specific to the Organisation. All traffic to the API and Portal uses TLS. Reports are redacted on the User's machine and again on receipt. Audit events never contain the body of a Report. Annex 2 of the Data Processing Agreement lists the measures in full.

9.2 No system is perfectly secure. If we confirm a breach affecting your personal data and it is likely to put you at risk, we will tell the affected Organisation without undue delay and, where the law requires, the Information Commissioner's Office.

10. Your rights

10.1 Under the UK GDPR, and the EU GDPR if you are in the EEA, you have the right to:

• access the personal data we hold about you, and receive a copy;
• have inaccurate data corrected;
• have your data erased, in some circumstances;
• restrict how we use your data, in some circumstances;
• receive data you gave us in a portable format, where we process it under a contract or with your consent;
• object to processing we carry out on the basis of legitimate interests; and
• withdraw consent at any time, where consent is the basis.

10.2 To exercise a right, email contact@sibylline.group. We may ask you to confirm your identity. We respond within one month, or tell you within that month if we need longer for a complex request.

10.3 Where your request concerns Customer Data, the Organisation is the controller. We will forward your request to it and help it respond.

10.4 If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. If you are in the EEA, you can complain to your national supervisory authority. We would welcome the chance to resolve the matter first.

11. If you are outside the United Kingdom

11.1 We offer the platform to businesses worldwide. Wherever you are, the rights in section 10 are available to you on the same terms.

11.2 We do not sell personal data or share it for cross-context behavioural advertising, and we have not done so in the past twelve months.

12. Children

12.1 The platform is for businesses and their staff. It is not directed at anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe we hold such data, tell us at contact@sibylline.group and we will delete it.

13. Changes to this policy

13.1 We may update this policy. The current version is always at the address in the document control table, with its effective date and a change log. For a material change we will tell Billing Administrators by email and show a notice in the Portal at least 30 days before it takes effect.

14. Contact

14.1 Privacy questions and rights requests: contact@sibylline.group.

14.2 Post: Sibylline Labs Limited, 9 Cwrt-Y-Coed, Brackla, Bridgend, Wales, CF31 2ST, marked "Privacy".

Change log