GDPR Notice

This GDPR Notice supplements our Privacy Policy and provides specific information required under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR as retained in UK law. It applies to individuals located in the European Economic Area (EEA) and the United Kingdom whose personal data is processed by Individual Entrepreneur Polshchykov Roman (Registration No: 2939422257), trading as Sigmalion.

The data controller responsible for your personal data is:

Because we are established outside the European Economic Area but offer our services to data subjects in the Union, the GDPR applies to our processing under Article 3(2)(a).

We do not currently have a statutory obligation to appoint a Data Protection Officer (DPO). For all data-protection enquiries, contact us directly at the email above or via our EU Representative (see Section 3).

Under Article 27 GDPR, as a controller established outside the Union processing personal data of EU data subjects, we have designated a representative in the Union to act as a point of contact for supervisory authorities and data subjects on all matters related to GDPR compliance.

Until the formal appointment is finalised, please direct all GDPR enquiries to team@sigmalion.io and we will route them appropriately.

We rely on the following lawful bases under Article 6 GDPR:

As a data subject under the GDPR or UK GDPR, you have the following rights:

To exercise any of these rights, email team@sigmalion.io. We will respond within 30 days (or 3 months for complex requests, with notice). We will not charge a fee unless requests are manifestly unfounded or excessive.

We engage the following sub-processors under written contracts compliant with Article 28 GDPR. These processors act only on our documented instructions and are bound to equivalent confidentiality and security obligations.

Google retains prompts and responses sent to the Gemini API for a limited period (paid tier; not used for model training), as described in the Gemini API Additional Terms of Service. The exact retention period is being clarified with Google Cloud Support and will be published here once confirmed.

The current list of indirect sub-processors used by our providers (e.g. Supabase's underlying cloud infrastructure) is available on request at team@sigmalion.io.

Where personal data is transferred outside the European Economic Area, we rely on the following safeguards under Chapter V GDPR:

• Transfers to Google LLC (USA) — covered by the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), with the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) as a contractual fallback.
• Transfers to Supabase Inc. and Vercel Inc. (USA) — covered by signed Data Processing Addenda incorporating the EU Standard Contractual Clauses under Article 46(2)(c) GDPR, with supplementary measures as recommended by the European Data Protection Board.

The EU–US Data Privacy Framework is currently subject to legal challenge in Case T-553/23 Latombe v Commission, which was dismissed by the EU General Court on 3 September 2025; an appeal before the Court of Justice of the European Union is pending. Should the DPF be invalidated, transfers to Google LLC will rely on the SCCs with supplementary measures.

In accordance with the storage-limitation principle (Article 5(1)(e) GDPR), we retain personal data only as long as necessary:

• Lead / contact-form submissions — 7 years (UA / EU accounting and tax obligations).
• AI chat messages — 90 days, then automatically purged by a scheduled database job.
• Admin access logs — 30 days, then automatically purged.
• Email correspondence and engagement records — 7 years.

You may request earlier deletion of your data where no statutory retention obligation applies.

If you believe we have not handled your personal data in accordance with applicable data protection law, you have the right to lodge a complaint with a supervisory authority.

We ask that you contact us first at team@sigmalion.io so we have the opportunity to resolve your concern directly.

We may update this GDPR Notice from time to time to reflect changes in our practices or applicable law. When we do, we will revise the effective date above. We encourage you to review this page periodically.