This Privacy Policy explains what information Sigil ("we", "us") collects when a company and its team members use the Service, how we use it, and the choices available to you.
| Category | Examples |
|---|---|
| Account information | Name, email address, password (stored in hashed form by our authentication provider, never in plain text) |
| Company information | Company name, join code, list of members and their roles |
| Request data | Whatever fields your company's approval templates collect — this can include names, monetary amounts, dates, and any other business information your team enters |
| File attachments | Documents or images your team uploads to a request (e.g. receipts, evidence of payment) |
| Usage data | Basic activity like sign-in times and which requests you've interacted with, used to make the product work (e.g. showing your pending approvals) |
We do not sell your data, and we do not use your company's request data for advertising.
Sigil is built on Google Firebase (authentication, database, file storage, and hosting infrastructure) and uses a third-party transactional email provider to deliver notification emails. These providers process data on our behalf under their own security and privacy commitments; we don't control their infrastructure directly, but we choose providers with strong industry-standard security practices.
Each company's data is logically separated in our database and protected by access rules so that one company's members cannot read another company's requests, templates, or team information.
We retain your data for as long as your company's workspace remains active. If a company or account is deleted, we will remove the associated data within a reasonable period, except where we're required to retain it for legal or accounting reasons.
Depending on where you're located, you may have rights to access, correct, or request deletion of your personal information. Company administrators can manage most of this directly (deactivating a member, editing team information); for anything else, contact us using the details below.
The Service uses your browser's authentication session (managed by our sign-in provider) to keep you logged in. We do not use advertising or third-party tracking cookies.
The Service is intended for business use by adults acting on behalf of a company and is not directed at children. We do not knowingly collect information from children.
We may update this Privacy Policy from time to time. We'll take reasonable steps to notify users of material changes.
Questions about this Privacy Policy, or requests relating to your personal data, can be sent to [insert contact email].