Privacy Policy

1. Introduction

This Privacy Policy explains how SigmaPointPi Inc. ("SigmaPointPi", "SPP", "we", "us", or "our") collects, uses, discloses, and protects information in connection with our websites, applications, software platforms, communications, and any other online or offline services that link to or reference this Privacy Policy (collectively, the "Services").

This policy also describes how SigmaPointPi handles personal and business information when you use the SigmaPointPi financial operating system (the "Service").

SigmaPointPi Inc. is a Delaware C corporation operating live software platforms for financial operating systems, treasury, payments, intelligence infrastructure, and related enterprise services. We are not a registered broker dealer, investment adviser, or trading firm, and we do not execute trades or provide investment advisory services.

By accessing or using the Services, you acknowledge that you have read this Privacy Policy and understand how we process your information.

2. Scope

This Privacy Policy applies to information we collect:

Through our websites, including sigmapointpi.com and any subdomains.
Through any future mobile or desktop applications that reference this policy.
Through forms, waitlists, newsletters, investor or partnership inquiries, and other communications with us.
Through any beta, pilot, sandbox, or enterprise deployment environments that we may provide from time to time, subject to separate terms where applicable.
From account holders, team members invited into a workspace, and visitors to our sign-in surfaces.

This Privacy Policy does not apply to:

Third party websites, applications, or services that are linked from our Services.
Information collected in the course of any formal client engagements governed by separate agreements and regulatory obligations.
Employees, contractors, or applicants, who may be subject to separate notices.

3. Information We Collect

We may collect the following categories of information.

3.1 Information you provide directly

Contact and identity information such as name, email address, phone number, employer, role, and jurisdiction when you fill out forms, join waitlists, subscribe to our newsroom, or contact us.
Account information such as username, password, basic profile details, and settings if we enable account based access, including "Client Login" or early access portals. We store a password hash and never store plaintext passwords. We may also store multi-factor enrollment data (TOTP secrets, passkey public keys) and the organization profile you provide during onboarding (business type, address, EIN, team size, vertical-specific answers).
Investor and partner inquiry information such as your indication of interest, investment profile (for example institutional, accredited, or strategic), and any information you choose to share in connection with potential investment or partnership discussions.
Professional and academic information if you submit a job application, collaboration proposal, or similar materials.
Communications content including emails, messages, and other correspondence with us.

3.2 Information collected automatically

When you use the Services, we may automatically collect:

Usage data such as pages visited, links clicked, content viewed, time spent, navigation patterns, and in-product events.
Device and technical data such as IP address, browser type, operating system, device identifiers, and referring URLs.
Log data including access times and dates, error logs, timestamps, and system activity for security and operational purposes.
Trace identifiers including W3C trace identifiers we attach to API requests so support can investigate the exact request you report. Error reports may be processed by Sentry when error monitoring is enabled.

We and our service providers may use cookies, pixels, and similar technologies to collect some of this information and to operate and improve the Services. You may be able to manage cookies through your browser settings, but certain features may not function properly if cookies are disabled.

3.3 Information from third parties

We may receive information about you from:

Service providers and partners such as analytics providers, email service providers, cloud hosting, or CRM tools.
Public sources such as professional profiles, academic or conference listings, or media coverage.
Referrals if someone with an existing relationship to SigmaPointPi introduces or refers you to us.

3.4 Financial data you connect

When you link a source, we retrieve what that source exposes: bank balances and transactions (via Plaid), invoices, bills, payroll summaries, commerce orders, claims, or fund records, depending on the integration. We retrieve this data to operate your workspace — we do not sell it.

4. How We Use Information

We use the information we collect for the following purposes:

Provide and operate the Services including website functionality, client portals, platform features, waitlists, and account access. This includes rendering your dashboards, computing KPIs, and running the automations you enable.
Product development and improvement including designing, testing, and improving algorithms, models, data pipelines, and system architectures that power our platforms, and aggregate, de-identified usage analysis.
Communications including responding to your inquiries, sending administrative messages, and delivering newsletters or announcements about our research, events, or roadmap where permitted.
Support including investigating incidents you report, using the trace id you quote.
Investor and partnership discussions including evaluating potential strategic, institutional, or accredited investors and partners and managing confidential communications with them.
Security and integrity including authentication, monitoring for fraud, abuse, or unauthorized access, fraud and risk scoring, audit trails, protecting our infrastructure, and enforcing our Terms of Service and policies.
Legal, regulatory, and compliance purposes including complying with applicable laws, regulations, legal processes, and regulatory expectations, exercising or defending legal claims, and meeting tax, accounting, sanctions, and anti-money-laundering rules where money movement is enabled.
Analytics and improvement including understanding usage patterns, improving user experience, and refining our communication and product strategy.

We may aggregate or de identify information so that it is not reasonably capable of identifying you. We may use and share such aggregated or de identified information for any legitimate business purpose, subject to applicable law.

The Service includes AI-assisted features. AI analysis (insights, anomaly detection, natural-language answers) runs on your workspace data to serve your workspace. AI features cannot move money without explicit human approval, and their actions are recorded.

5. Legal Bases for Processing

Where required by applicable law (for example the laws of the European Economic Area, United Kingdom, or similar jurisdictions), we process personal information based on the following legal bases:

Your consent, where you have actively given it, for example when you opt in to certain communications.
Performance of a contract or pre contractual steps, where processing is necessary to provide the Services you request.
Our legitimate interests, including research and development, security, and business operations, provided such interests are not overridden by your rights and interests.
Compliance with legal obligations, where processing is necessary to comply with applicable law, regulation, or legal process.

We may share information as follows:

With service providers that perform services on our behalf, such as hosting, analytics, email delivery, security, and professional advisers. These parties are authorized to use personal information only as necessary to provide services to us. This includes service providers that process information under contract for us, including cloud hosting on AWS, authentication and database infrastructure on Supabase, bank connectivity via Plaid, regulated banking and payment partners when money movement is enabled, and error monitoring via Sentry.
With your workspace so teammates see what their role permits.
Within SigmaPointPi including future affiliates or entities, for research, operations, and governance.
With potential investors and strategic partners on a confidential basis, where appropriate and subject to safeguards, particularly in connection with due diligence and investment or partnership discussions.
For legal and compliance purposes where we believe disclosure is reasonably necessary to comply with law or legal process, respond to governmental or regulatory requests, enforce our terms and policies, or protect the rights, property, or safety of SigmaPointPi, our users, or the public. We share with authorities when required by law and, where lawful, after notice to you.
In connection with corporate events such as a merger, acquisition, investment, reorganization, or sale of assets, where personal information may be transferred as part of the transaction, subject to appropriate protections. A successor in a merger or acquisition remains subject to this policy's protections.
With your consent or at your direction when you instruct us to share information or when such sharing is reasonably evident from the context.

We do not sell your personal information in the sense typically defined under state privacy laws. If this changes in the future, we will update this Privacy Policy and provide any required notices. We do not sell personal information and we do not share it for cross-context behavioral advertising.

7. Data Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, including for research and development, communications, legal, and security purposes, unless a longer retention period is required or permitted by law. When information is no longer needed, we will delete or de identify it in accordance with our data retention practices and applicable law.

Account and workspace data persist while your account is active. Financial records may be retained as required by tax, accounting, and financial-services law even after disconnection of a source. After account closure we delete or de-identify personal information on a scheduled cycle, except where retention is legally required; you may export your data for 30 days after closure.

8. Security

We use reasonable technical, organizational, and administrative safeguards designed to protect personal information from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no system or transmission is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of any credentials associated with your use of the Services.

Data is encrypted in transit (TLS) and at rest. Workspaces are isolated with database row-level security so one tenant can never read another's rows. High-stakes actions support step-up verification (passkeys/MFA). Money-movement capability is disabled by default and fail-closed until the required partner credentials and verification exist. No system is perfectly secure; report suspected issues to privacy@sigmapointpi.com and we will investigate promptly.

9. International Data Transfers

SigmaPointPi is currently based in the United States. If you access the Services from outside the United States, your information may be transferred to, stored, and processed in the United States and other jurisdictions that may have different data protection laws than your country of residence. Where required by law, we will take steps to implement appropriate safeguards for such transfers.

We process data in the United States and in the regions our infrastructure providers operate; where required we rely on appropriate transfer safeguards.

10. Your Rights and Choices

Depending on your jurisdiction, you may have certain rights regarding your personal information, such as the right to:

Access, correct, or update your personal information.
Request deletion of your personal information.
Object to or restrict certain processing.
Withdraw consent where we rely on consent, without affecting the lawfulness of processing prior to withdrawal.
Receive a copy of your data in a portable format where technically feasible.
Export personal information.

You may exercise these rights by contacting us at the email address below, or by sending requests to privacy@sigmapointpi.com. We may need to verify your identity before responding and may be unable to fully comply with requests where legal or regulatory obligations require us to retain certain information. We will verify the request and respond within the time the applicable law sets.

Workspace owners control business records inside their workspace; if you are a team member, some requests will be routed through your workspace owner.

You may also opt out of marketing emails by following the unsubscribe instructions in those communications. Even if you opt out, we may still send you non promotional communications, such as administrative or service messages.

11. Google User Data

When you connect a Google account, we access only the data needed for the features you use: reading the specific Drive files you choose in Google's own file picker (and nothing else in your Drive), and creating, updating, and staying in step with the calendar events you manage through the product. Calendar and Drive are separate connections, so each can use a different Google account, and the connected address is always shown. We never access your email. SigmaPointPi's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never sold, never used for advertising, and never used to train generalized artificial intelligence or machine learning models, whether by us or by anyone we work with. Disconnecting Google Workspace in the Integration Hub revokes our access immediately, and you can also revoke it at any time from your Google Account security settings.

Some features process Google user data with artificial intelligence models to serve you: extracting totals and vendors from an invoice attachment, or answering a question that involves your schedule. This processing runs exclusively through paid, business-tier model APIs whose terms prohibit using customer API data to train or improve their models. Google user data is transmitted to a model only to produce your requested result, is not retained by us beyond that feature's output, and is never transferred to any service that would train on it.

12. Children's Privacy

The Services are not directed to children under the age of 16, and we do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16 without appropriate consent, we will take reasonable steps to delete it. The Service is for business use and not directed to children under 16.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective date" above and may provide additional notice as required by law. We will notify you of material changes to this policy in-product or by email before they take effect. Your continued use of the Services after any update constitutes your acceptance of the revised Privacy Policy.

14. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact:

SigmaPointPi

Attn: Privacy

Email: privacy@sigmapointpi.com

Phone: +1 (413) 428-5439