Legal
Privacy Policy
In short. We hold the personal data needed to run your account — your email, name, sign-in and security records, and billing contacts. We do not sell it, we run no advertising or analytics trackers, and this website sets no cookies. What your clusters contain stays yours: Kubernetes Secret values are never stored, and raw metrics, logs and traces stay in your cluster.
1. Who is responsible
Seylo Labs Private Limited, registered office 39/3, Palayapalayam, Erode - 638011, Tamil Nadu, India, is responsible for the personal data described here (the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023, and the “controller” where the EU or UK GDPR applies).
For data that your organisation brings into the Service from its clusters, we act on your organisation’s behalf (as a “data processor”). That processing is described on our data-handling page and in our Data Processing Addendum.
2. What we collect
| Category | What it includes |
|---|---|
| Account | Email address, display name, organisation and role. If you sign in with a password, a salted scrypt hash of it — never the password itself. If you enrol multi-factor authentication, an encrypted authenticator secret and hashed recovery codes. If you use single sign-on, the identifier your identity provider sends. |
| Sign-in and security | For each session: IP address, user agent, and when it was created and last used. Failed and successful sign-in attempts with the email and IP used. Sign-up and join requests with the IP they came from. |
| Activity | An audit trail of actions taken in your organisation — who proposed, approved or changed what, and when — including the actor’s email. |
| Billing | Your organisation’s billing email and billing details (legal name, address, country and, if you give one, GSTIN), and the invoices issued to it. |
| Email we send | A record of transactional emails sent to you (recipient, type, time) and your notification preferences. We do not keep the message bodies. |
| Integrations you connect | If you connect GitHub: your GitHub login and an encrypted access token. For coding-agent tokens: who created the token and the IP it was last used from. |
| Messages to us | What you send to support@seylo.in or through Help & support in the app, and our replies. |
| Reports of AI responses | If you report a response written by an AI feature, the report becomes a support request holding the response you reported, the reason and comment you give, where in the app it appeared, and the app and its version. We use it to investigate the report and improve the Service. |
We do not ask for, and the Service is not designed to hold, sensitive categories of personal data such as health, financial account or government identity information.
3. This website
seylo.in sets no cookies and runs no analytics, advertising or tracking scripts. Our hosting and network provider, Cloudflare, processes your IP address to deliver and protect the site. The site loads its typeface from Google Fonts, which receives your IP address and browser details when it does.
4. Cookies in the app
portal.seylo.in uses three cookies, all strictly necessary: a session cookie, a session-refresh cookie, and a security token that protects you against cross-site request forgery. The two session cookies are HttpOnly; all three are Secure and SameSite=Lax. The security token is readable by the page because that is how it works. The app also stores interface preferences — theme, sidebar state, your last organisation — in your browser’s local storage. There are no advertising or analytics cookies.
The desktop app
The Seylo desktop app keeps your sign-in on your computer, encrypted with your operating system’s own protection (on Windows, your Windows account’s data protection), and tells Seylo its version when you sign in. Its coding agent runs on your computer: the prompts you write and the files it reads in the folder you open are sent directly to the AI model provider you choose, with the key you give it, under that provider’s terms; Seylo does not receive them. When the coding agent uses Seylo’s own tools, such as a deploy, those requests reach Seylo like any action in the portal and are recorded in your organisation’s audit trail. The app has no advertising or analytics tracking. If you install it from the Microsoft Store, Microsoft handles the download and updates under its own privacy statement.
5. How we use it
- To provide the Service: sign you in, apply your organisation’s roles, run approvals and keep the audit trail.
- To keep it secure: detect abuse and credential attacks, show you your active sessions, and investigate incidents.
- To bill your organisation: measure the usage we charge for and send invoices.
- To communicate: send transactional emails such as verification codes, approval requests and alerts you have subscribed to, and reply to you.
- To meet legal obligations, such as tax and accounting records.
We do not sell personal data, use it for advertising, or use it to train AI models. If your organisation opts in to a model Seylo provides, that provider’s terms are shown when you opt in and listed on our sub-processors page.
6. Why we are allowed to
We process personal data because it is necessary to provide the Service your organisation signed up for, to keep it secure, and to comply with the law. Where the GDPR applies, our bases are performance of a contract, our legitimate interests in securing and improving the Service, and legal obligation. Where we rely on consent, you may withdraw it at any time.
7. Who we share it with
- Sub-processors that host and operate the Service for us, listed on our sub-processors page.
- Services you choose to connect — your identity provider, chat or paging tools, Git host, or model provider. Those are your choices and governed by your agreements with them.
- Seylo staff, only when needed to support or secure your organisation. Staff access to an organisation is recorded in that organisation’s audit trail.
- Authorities, when the law requires it.
- A successor, if Seylo is merged or acquired, under the same protections.
8. Where it is stored
Personal data is stored on Microsoft Azure in the United States, and processed by the sub-processors listed on our sub-processors page. We may add a region in India. Where the GDPR applies, transfers out of the EU or UK rely on the European Commission’s Standard Contractual Clauses and the UK Addendum.
9. How long we keep it
By default:
- Sign-in attempts and the record of emails sent: 30 days.
- Email verification and reset tokens, and unfinished sign-ups: 7 days.
- Sessions: until they expire.
- The audit trail: kept for the life of your organisation and not deleted automatically, because it is the record of who changed what.
- Account and billing records: while your account is active, and afterwards as long as tax and accounting law requires.
When an organisation closes its account, we delete its data within 90 days of a written request from one of its administrators. We keep the audit trail, and the billing and tax records the law requires, only for as long as they are needed. Deletion is carried out by Seylo; it is not yet a self-service action.
10. Your rights
You can ask us to:
- tell you what personal data we hold about you and who it has been shared with;
- correct or complete it;
- erase it, where we are not required to keep it — for example, audit records may need to be kept to protect your organisation and meet legal obligations;
- withdraw consent you have given;
- under India’s DPDP Act, nominate someone to exercise your rights if you die or become incapacitated;
- where the GDPR applies, restrict or object to processing, or receive your data in a portable form.
Write to support@seylo.in. We will reply within 30 days. If your account belongs to an organisation, some requests are handled together with its administrators.
11. How we protect it
See our security page. In short: encrypted connections, hashed passwords and tokens, encryption of stored credentials and secrets, role-based access, and an audit trail of administrative actions.
12. Children
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect children’s personal data.
13. Grievance officer and complaints
Questions, requests and complaints about personal data go to the Grievance Officer, Seylo Labs Private Limited, 39/3, Palayapalayam, Erode - 638011, Tamil Nadu — support@seylo.in.
If you are not satisfied with our response, you may complain to the Data Protection Board of India or, where the GDPR applies, to your local data protection authority.
14. Changes
We will post updates here and change the date at the top. For material changes we will also email your organisation’s administrators before they take effect.