Privacy Policy | provisio sigil

A2Z Holdings KS, LLC, a Kansas limited liability company, doing business as "Provisio Sigil" ("Provisio Sigil," "we," "us," or "our"), operates the Provisio Sigil website and platform (together, the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have.

This policy works alongside our Terms of Service and, where a data processing agreement applies, our Data Processing Agreement, available on request at dev@provisiosigil.com.

1. Information We Collect

Information You Provide

Account details. Name, email address, company name, and job title when you create an account or apply for access.
Agent configurations. The AI agent definitions, guardrail settings, and related setup you enter into the platform.
Uploaded knowledge. Documents you upload so your agents can use them, along with the search embeddings we build from that content.
Co-Pilot questions and answers. The questions you ask the Co-Pilot and the answers it returns are stored so the feature can work and so we can improve it.
Your keys and connection tokens. Your AI provider API keys and the OAuth tokens for connectors you authorize. These are held in an encrypted store (encrypted at rest). For platform API keys we generate, we store a hashed reference, not the key itself.
Communications. Messages you send us through support, demo requests, or email, and any feedback text you provide.
Payment details. If you subscribe to a paid plan, payment is handled by our third-party payment processor, Stripe. We do not store full card numbers on our servers.

Information Collected Automatically

Product usage and analytics. Features used, actions taken, and session activity within the platform.
Security events. Records we keep to protect the Service, which include your IP address and browser user agent.
Compliance results. The results of compliance analysis you run on your agents.

A Note on Deployed-Agent Conversations

We do not keep a record of the conversations your deployed agents have with their end users. We have no database or log that stores that content.

At run time, that data does travel to the AI provider you chose (on your own key) and through the connectors you authorized, so it can pass through those systems while your agent runs. We do not use it to train AI models. For how your chosen AI provider and connectors handle that data, see their own terms.

2. The Two AI Paths

There are two separate AI paths in the Service, and they use different keys:

Platform features run on our key. Features we operate, such as the Co-Pilot and compliance analysis, run on our own AI infrastructure. The setup text you enter is processed to make these features work.
Your deployed agents run on your key. Your agents run on the AI provider you choose, using your own API key. Whatever your agent sends at run time goes to that provider under your account and its own terms.

We keep these paths distinct. Your provider key is used only to run your own agents.

3. How We Use Your Information

We use the information we collect to:

Provide the Service. Run the platform, power the Co-Pilot, run compliance analysis, and let your agents connect and deploy.
Improve the platform. Understand usage to fix bugs, improve features, and keep the Service reliable.
Communicate with you. Send service updates, respond to support, and share relevant product information.
Keep the Service secure. Detect and prevent unauthorized access, fraud, and abuse. This is why we log security events, including IP address and user agent.
Meet legal obligations. Comply with applicable laws and respond to lawful requests.

We do not sell your personal information, and we do not use your data for advertising. We do not use Your Content to train AI or machine learning models.

4. How We Share Your Information

We share information only in these limited ways:

Sub-processors. We use a small set of trusted providers to run the Service. Each one processes data only as needed to provide the Service, under data-protection terms. A current list is available on request at dev@provisiosigil.com.
Your chosen AI provider and connectors. When your agents run, data flows to the AI provider and connectors you selected and authorized, using your own keys and permissions.
Legal requirements. When required by law, court order, or a lawful government request.
Business transfers. In connection with a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change.
With your consent. When you ask us to share your information.

We do not share your agent configurations or compliance results with third parties except as needed to provide the Service (for example, storage) or as described above.

5. Our Sub-processors

We use a small set of trusted providers ("sub-processors") to run the Service. They fall into these categories:

Cloud hosting and storage for the platform and the content you upload.
Account database and sign-in services.
AI providers. Our own AI infrastructure for platform features, and the AI provider you choose for your deployed agents, on your own key.
Search indexing for the knowledge you upload.
Connectors you authorize (for example Google Drive, GitHub, and others). Only the connectors you turn on, based on the permissions you grant.

Each sub-processor processes data only as needed to provide the Service, under data-protection terms. The current named list is available on request at dev@provisiosigil.com. Customers with a Data Processing Agreement (also available on request) receive the list and notice of changes as described there.

6. Data Security

We take reasonable steps to protect your information:

Data in transit between your browser and our servers is encrypted using TLS.
Your AI provider keys and connector tokens are held in an encrypted store (encrypted at rest).
Access to customer data is limited to authorized personnel on a need-to-know basis.

No system is perfectly secure. While we take reasonable precautions, we cannot guarantee absolute security.

7. Data Retention

Account details are kept while your account is active.
Agent configurations and uploaded knowledge are kept while your account is active. You may export or delete them where the Service supports it.
Co-Pilot questions and answers, compliance results, and product usage are kept while your account is active.
Security events are kept as needed to protect the Service.

We keep your data while your account is active. When you close your account or ask us to delete it, we remove it within 30 days, except for backups or records we are required to keep longer by law.

8. Your Rights

Depending on where you live, you may have some or all of the following rights.

For All Users

Access. Request a copy of the personal data we hold about you.
Correction. Ask us to correct inaccurate personal data.
Deletion. Ask us to delete your personal data and account.
Portability. Request your data in a structured, machine-readable format.

For EU/EEA and UK Users (GDPR)

In addition to the above:

Object. Object to processing for certain purposes.
Restrict. Ask us to restrict processing in certain cases.
Withdraw consent. Withdraw consent at any time where processing is based on consent.
Complain. File a complaint with your local data protection authority.

Our legal bases for processing are: (a) performance of a contract (providing the Service), (b) legitimate interests (improving and securing the Service), (c) consent (where applicable), and (d) legal obligation.

For California Users (CCPA/CPRA)

Right to know what personal information we collect, use, and share.
Right to delete your personal information.
Right to correct inaccurate personal information.
Right to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of.
Non-discrimination. We will not treat you differently for exercising your rights.

To exercise any of these rights, contact us at dev@provisiosigil.com.

9. Controller and Processor Roles

For the personal data of your own account (your name, email, and similar), we act as the controller.

For the data your deployed agents handle on your behalf, including data about your end users, you are the controller and we act as your processor. In that role we process that data on your instructions and under our Data Processing Agreement, available on request. Where your agents send that data to the AI provider and connectors you chose, you are directing that sub-processing. We do not record or store your deployed agents' conversations. Message content passes through the Service only to run your agent and its compliance checks, and is not retained afterward.

10. International Data Transfers

We process data primarily in the United States, and our sub-processors may process data in other regions where they operate.

If you are located outside the country where a given store operates, your information will be transferred across borders. Where required, we rely on appropriate safeguards for these transfers, such as the Standard Contractual Clauses approved by the European Commission, together with any additional measures needed.

11. Cookies

Our website uses minimal cookies:

Essential cookies are required for the site and platform to work (session management and security). These cannot be turned off.
Analytics cookies are not used. We do not use third-party analytics services.

We do not use third-party advertising cookies or tracking pixels.

12. Children's Privacy

The Service is not directed to individuals under 18, and it is a business tool intended for organizations. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy with a new "Last Updated" date and, where appropriate, notify you. Your continued use of the Service after changes take effect means you accept the updated policy.

14. Contact Us

Questions about this Privacy Policy or our data practices:

Company: A2Z Holdings KS, LLC (doing business as Provisio Sigil)
Email: dev@provisiosigil.com
Mailing address: 10420 S Ridgeview Rd #1097, Olathe, KS 66061, United States