Privacy Policy

Last updated: July 6, 2026

Working draft. This document is pending formal legal review ahead of general availability. It reflects how we actually operate today, but wording may change once counsel signs off.

1. Who we are

Sapilon operates this website (sapilon.com) and the Sapilon platform. For personal data described in this policy, Sapilon is the controller, except for the content of your projects on the platform, where you are the controller and we act as your processor under the Data Processing Agreement. Contact us at we@sapilon.com with any privacy question or request.

2. What we collect

On the website

Waitlist and contact details you submit: email address and, if you provide it, your name and company.
Anonymous analytics (Google Analytics 4), loaded only after you consent via the cookie banner.

On the platform

Account data: name, email, company, sign-in and billing records.
Project content: the code, prompts, artifacts, and data you bring to or create in your projects. We process this on your instructions as your processor; it may incidentally contain personal data you control.
Usage and audit records: actions taken by you and by the AI in your projects. Keeping this trail is a product feature: every AI action is logged, diffable, and reversible.
Payment data: wallet top-ups are handled by our payment provider (Stripe); we receive transaction confirmations, never full card numbers.

3. How we use it

To provide the service: operating your account, projects, environments, and the experts marketplace (performance of contract).
To respond to you: waitlist, support, and contact requests (legitimate interest or pre-contractual steps).
To bill you: wallet, invoices, tax records (contract and legal obligation).
To keep the platform secure: audit trails, abuse prevention (legitimate interest).
To understand site usage: consent-gated analytics (consent).

We do not sell personal data, and we do not use your data for third-party advertising.

4. Cookies & analytics

We use Google Analytics 4 to understand website usage. Analytics cookies load only after you opt in through the cookie banner; declining does not limit the site in any way. We honor Google Consent Mode, and you can change your choice at any time by clearing the site's cookies. The platform sets the strictly necessary cookies needed to keep you signed in.

5. AI processing

AI work on the platform is performed by Anthropic's Claude models. When you or the platform's agents run AI tasks, the relevant prompts and project content are sent to Anthropic for processing under commercial terms that prohibit using your content to train models. Neither Sapilon nor Anthropic trains AI models on your code or data. AI activity in your projects is recorded in your project's audit trail so you can inspect and reverse it.

We share personal data only with the service providers needed to run Sapilon, under data-processing terms:

AWS: hosting for the platform and your environments.
Anthropic: AI model processing (section 5).
Stripe: payment processing.
Google: consent-gated website analytics.

The current list, purposes, and locations are maintained in the DPA. Beyond these, we disclose data only if the law requires it, and we will tell you when we are allowed to.

7. International transfers

Platform data is hosted in AWS regions in the European Union by default. Where a sub-processor processes data outside the EU/EEA (for example, parts of Anthropic's or Stripe's infrastructure), the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision.

8. Retention

Waitlist and contact data: as long as needed to respond to you or run the early-access program, then deleted.
Account and project data: for the life of your account; after termination we keep project data available for export for at least 30 days, then delete it.
Billing records: as long as tax law requires.
Analytics: per the GA4 retention settings, capped at 14 months.

9. Your rights (GDPR)

If you are in the EU/EEA (and in many other places), you have the right to access, correct, delete, and export your personal data, to restrict or object to processing, and to withdraw consent at any time without affecting prior processing. Email we@sapilon.com and we will respond within one month. You also have the right to lodge a complaint with your local supervisory authority. For personal data inside your projects, where you are the controller, we will refer requests from your users to you and assist as the DPA describes.

10. Security

Data is encrypted in transit and at rest, environments are isolated, and AI actions are constrained by ownership zones and recorded in audit trails. The Trust & Security page describes our practices in detail, including how to report a vulnerability.

11. Changes & contact

We will update this policy as the product evolves and note the date at the top of the page; material changes are announced to account holders by email. Questions, requests, or concerns: we@sapilon.com.