Privacy Policy

Sigilora is operated by EdenTouch CoLab Ltd, trading as Sigilora ("Sigilora", "we", "us" or "our").

Registered office: 182-184 High Street North, Office 13177, London, Newham, E6 2JA. Privacy requests: use our contact form at sigilora.co.uk/contact, selecting 'Privacy' as the reason for contact.

We act as a data controller when we decide why and how personal information is used for account administration, sales, billing, security, support and marketing. We may act as a data processor when an agency customer uploads client, team-member or event information and determines why that information is processed. Controller and processor responsibilities depend on the actual processing relationship and should be documented contractually.

This policy applies when you:

• Visit our website
• Request a demonstration
• Apply to the Founding Agency Program
• Create or use a Sigilora account
• Upload event briefs or brand content
• Invite users or approvers
• Request merchandise quotations
• Contact support
• Receive communications from us

We may collect:

Account information: Name, business email, job title, organisation, country, login information and account role.

Event and organisation information: Organisation profile, event name, brief, dates, locations, objectives, audience descriptions and required deliverables.

Customer content: Brand guidelines, logos, images, text, comments, creative instructions, generated assets and production artwork.

Merchandise information: Product preferences, quantities, decoration methods, delivery details, quotations, supplier proofs and order status.

Payment information: Subscription, invoice and payment references. Payment-card information may be collected directly by our payment provider and not stored by Sigilora.

Technical information: IP address, browser, device information, session events, security logs, feature activity and diagnostic information.

Communications: Support enquiries, demo requests, interview responses, feedback and marketing preferences.

Sigilora allows users to sign in using their Google Account. When a user chooses Continue with Google, Sigilora receives only the Google Account information permitted by the OAuth permissions requested by Sigilora. For basic authentication, this may include:

• A Google Account identifier
• Name
• Email address
• Basic profile information required for authentication

Sigilora does not receive the user's Google password. Only Google data actually made available through the OAuth scopes configured for Sigilora is received.

Google-derived account information is used only for purposes such as authenticating the user; creating or identifying the user's Sigilora account; associating the user with the appropriate agency, organisation or workspace; displaying appropriate account or profile information; maintaining account security; and providing the Sigilora service requested by the user.

Sigilora does not access Gmail, Google Drive, Google Calendar, contacts, files or other Google services through Google Sign-In unless such access is genuinely requested and implemented.

Sigilora's use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including the Limited Use requirements where applicable. Google-derived user data is not used for unrelated advertising, resale, data-broker activity or purposes unrelated to delivering legitimate user-facing Sigilora functionality.

Sigilora may allow users to sign in using a Microsoft account or organisational Microsoft identity. When a user chooses Continue with Microsoft, Sigilora may receive basic identity information authorised through Microsoft's identity platform, such as:

• Microsoft account or directory identifier
• Name/display name
• Email address or username where available
• Basic profile information necessary for authentication

Sigilora does not receive the user's Microsoft password. Only information and permissions that Sigilora actually requests are received.

Microsoft-derived identity information is used only for legitimate purposes such as authenticating users; creating or identifying Sigilora accounts; associating users with the correct agency, organisation or workspace; displaying account information; maintaining security; and providing Sigilora functionality requested by the user.

Sigilora does not access Outlook email, OneDrive, SharePoint, Teams, calendars, contacts or organisational directories through Microsoft Sign-In unless those integrations are genuinely implemented and separately authorised.

We may use information to:

• Provide and administer the platform
• Authenticate users
• Manage organisation permissions
• Generate AI-assisted brand proposals
• Manage approvals and versions
• Coordinate merchandise quotations and orders
• Process subscriptions and payments
• Send operational notifications
• Provide customer support
• Protect the platform against misuse
• Improve platform performance
• Meet accounting and legal obligations
• Send marketing where lawful

Information from an event brief may be sent to approved AI providers to produce proposed creative directions, text or visual assets. AI output is labelled as a draft and requires human review. Sigilora does not intend to use AI to make solely automated legal or similarly significant decisions about individuals.

Users should not upload unnecessary personal data, special-category information, passwords, financial credentials or content they are not authorised to use.

Depending on the activity, we may rely on:

• Contract: to provide accounts, subscriptions and requested services
• Pre-contractual steps: to arrange demonstrations or proposals
• Legitimate interests: to operate, secure and improve our B2B service
• Legal obligation: for tax, accounting or lawful requests
• Consent: for optional marketing or non-essential cookies where required

We will identify the appropriate lawful basis before processing begins.

We may share information with providers supporting hosting and storage; authentication; AI generation; payment processing; email delivery; analytics; customer support; merchandise production and fulfilment; and professional advice.

We may also disclose information when required by law or reasonably necessary to protect Sigilora, our users or other people. We do not sell Google or Microsoft authentication information.

Our current subprocessor list: Base44 (hosting/platform), Stripe (payment processing). Additional providers will be listed at sigilora.co.uk/subprocessors as they are confirmed.

Some providers may process information outside the UK. Where a restricted transfer occurs, we will assess the transfer and use an appropriate mechanism, which may include UK adequacy regulations, the International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses.

We retain information only for the period reasonably required for its purpose.

We use essential technologies for login, authentication, security and service operation. Optional analytics or marketing technologies will be activated only where lawfully permitted. Users must receive clear information about cookies, and non-essential cookies generally require an active consent choice. A live cookie table will be published at sigilora.co.uk/cookies.

We use proportionate organisational and technical measures, including access controls, organisation-level permissions, server-side secrets, logging and security testing. No internet service is completely secure. Users must protect their credentials and notify us promptly of suspected unauthorised access.

Subject to applicable law, you may have rights to:

• Access your information
• Correct inaccurate information
• Request deletion
• Restrict processing
• Object to processing
• Receive portable information
• Withdraw consent
• Complain to the ICO

Send requests using our contact form at sigilora.co.uk/contact, selecting 'Privacy' as the reason for contact. Data-protection rights requests generally require a response without undue delay and normally within one calendar month.

Contact us first using our contact form at sigilora.co.uk/contact, selecting 'Privacy' as the reason for contact. You may also complain to the Information Commissioner's Office at ico.org.uk.

Sigilora is a business service and is not directed to children. Account holders must be at least 18 years old or otherwise legally authorised to enter a business agreement.

We may update this policy when our services, providers or legal obligations change. Material changes will be communicated through the website, platform or email where appropriate.