Privacy Policy

Spiron is provided by Sylphx Limited, a company registered in England and Wales (company number 16438428), registered office 128 City Road, London EC1V 2NX, United Kingdom (“we”, “us”). We are the controller of the personal data in your account: your sign-in, billing, and how you use the service. Write to us about your data at privacy@spiron.ai.

Your agents also handle personal data about other people — for example the messages of people who write to your agent, or the contacts in a mailbox you connect. When a school, business, or other organization uses Spiron, that organization is the controller of that data and we process it on its instructions, under the processing terms in the Terms of Service.

This website uses no third-party analytics, advertising, or tracking scripts. We do not sell personal data or share it for advertising.

Please do not give your agents sensitive data — such as health, religious, or biometric data — unless the job needs it. If you do, you are responsible for having the right to share it, and we process it only to do that job for you.

Where we rely on legitimate interests, we have weighed them against your rights and freedoms. You can ask us for details of that assessment.

We do not use your content to train AI models, and we make no decisions about you by automated means that have legal or similarly significant effects on you.

Besides the subprocessors below, we may share personal data with our professional advisers, auditors, and insurers; with a buyer or successor as described above; and with courts, regulators, or law enforcement where the law requires it or it is needed to protect our rights, our users, or others.

Sign-in, account email, billing, the AI gateway, and the cloud computers your agents use run on infrastructure we operate ourselves, on the servers above. Each AI model provider handles what it receives under its own API terms, including how long it keeps it.

The channels you connect — Telegram, Slack, Feishu/Lark, DingTalk, WeCom, WeChat, Twilio, Telnyx, or a webhook you set up — carry your agent’s messages under their own terms and privacy policies. You choose to use them, and they process those messages as independent providers, not on our behalf.

Spiron’s servers and backups are in the European Union. AI model providers and model hosts process step context in other countries, including the United States and China, and channel providers process messages where they operate. The default model provider, DeepSeek, is in China.

When we send personal data from the UK or the European Economic Area to a country without an adequacy decision, we use the European Commission’s standard contractual clauses and, for UK data, the UK International Data Transfer Addendum or Agreement. You can ask us for a copy at privacy@spiron.ai. If you do not want your agents’ work to go to a particular provider, choose a different model for those agents.

We keep your account and your agents’ data for as long as your account is open. You can correct or delete memory entries, conversations, credentials, and agents at any time.

Conversations are kept until you delete them or your account, unless the workspace owner chooses a retention period in Settings. With one set, a conversation with no activity for the chosen period — 30, 90, 180, or 365 days — is erased with its messages and attachments. A conversation with work still open is kept until that work ends. A data export can be downloaded for 7 days, unless the workspace owner sets a different period.

When you delete your account from Settings, you are signed out everywhere and your sign-in is removed. If other members remain in your workspace, the workspace and its agents stay with them. If you are the last member, we stop your agents’ running work and erase the workspace: its agents, memory, conversations, files, credentials, channel connections, cloud computers, and schedules.

Deleted data can remain in encrypted backups and technical logs for a limited period until they are overwritten. We keep billing records for as long as tax and accounting law requires, and we may keep other data where we need it to meet a legal duty, resolve a dispute, prevent fraud or abuse, or enforce our terms.

Under UK and EU data protection law you have the right to access your personal data, to have it corrected or deleted, to restrict how we use it, and to receive it in a portable format. Many of these you can use yourself:

• Access and portability: the workspace owner can download everything the workspace holds as one file from Settings → Your data. Credential values are left out.
• Correction: edit your profile, memory entries, and agents in the dashboard.
• Deletion: delete single items, or your whole account from Settings.

Your right to object. Where we rely on legitimate interests, you have the right to object to that use of your data on grounds relating to your situation. You can object to direct marketing at any time, and we will stop.

For anything else — or if you are not the workspace owner — email privacy@spiron.ai. We may ask you to confirm your identity, and we answer within one month; if a request is complex we may take up to two more months and will tell you why within the first month. We search for your data in a reasonable and proportionate way. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse it, as the law allows.

You can complain to the UK Information Commissioner’s Office at ico.org.uk, to the data protection authority where you live or work in the EU, or in Hong Kong to the Privacy Commissioner for Personal Data. We would like the chance to help first.

If you wrote to an agent that belongs to one of our customers, please contact that customer first: they decide how those messages are used.

Spiron sets two cookies, both strictly necessary: one keeps you signed in, and a short-lived one protects sign-in through another provider such as Google. Your browser also stores your light or dark theme choice. Cloudflare may set a security cookie to filter malicious traffic. We use no analytics or advertising cookies, so we do not ask for cookie consent. If we add a cookie that the law requires consent for, we will ask first.

We use technical and organisational measures appropriate to the risk, such as encrypting credentials, isolating each workspace’s data from every other workspace’s, and recording important actions. The security page describes them. No system is completely secure. If a personal data breach happens, we notify the regulator where the law requires, and we tell you directly where it is likely to result in a high risk to your rights and freedoms.

An account holder must be at least 18, or the age of majority where they live if that is higher. Spiron is not meant for children to sign up to. If we learn that a child holds an account, we may close it and delete its data; a parent or guardian can tell us at privacy@spiron.ai.

A family or a school may set up an agent that children talk to. The parent, guardian, or school holding the account decides what data about those children the agent handles, and is responsible for having the authority the law requires — for a child under the age of digital consent where they live (13 in the UK, and between 13 and 16 in EU countries), the consent of a parent or guardian. A school may rely instead on its own lawful basis. We use children’s data only to provide the service to the account holder, never for advertising or profiling.

We may update this policy. We will post changes here and update the date above. Before we use your personal data for a new purpose, we will tell you, as the law requires. Questions go to privacy@spiron.ai.