Privacy Policy

1Who is responsible

Silo Data Technology Ltd is the data controller for the personal data described in this policy. We are registered in England and Wales, company number 16676782, at Cell Block Studios, College Road, H M Naval Base, Portsmouth, Hampshire, England, PO1 3LJ.

Write to hello@silohq.io about anything in this policy, including to exercise a right under it. We do not operate a telephone line.

This policy covers data we hold as controller: about people who visit this site, join our waitlist, or use Silo as part of a customer organisation. When Silo queries a customer’s own systems, we act as a processor for that customer instead, and the Data Processing Addendum governs it.

2The important part first

Silo answers questions by querying the systems you already run, where they sit. It is designed not to take a copy. Query results pass through memory with a time to live and are then gone. There is no standing warehouse of your business data here to be breached, audited or deleted.

The exceptions are deliberate and visible: a Silo, which is a store you create on purpose and fill with a named dataset, and which is off unless you turn it on. In the sovereign build that subsystem is compiled out of the binary entirely.

3What we collect, and why

If you visit this site

• Request data your browser sends: IP address, user agent, the page requested and when. We use it to keep the site up and to spot abuse. Our basis is our legitimate interest in operating a secure website.
• If, and only if, you allow analytics: the pages you view, roughly where you are, and which site sent you, through Google Analytics. Our basis is your consent, which you give by choosing Allow and can withdraw at any time.
• If, and only if, you also tick the advertising option: the same data may be used to show you Silo adverts on other websites, and to measure whether those adverts worked. Our basis is your consent, given separately from the analytics one. We do not advertise today; this applies only if we start.

If you join the waitlist

• Your email address, and your company name if you give it. We use it to tell you when Silo opens and, occasionally, what we are building. Our basis is consent, which you give by submitting the form and can withdraw from any message we send.

If you use Silo

• Account data: name, work email, the organisation you belong to, your role and permissions, and authentication data including a hashed password and any second-factor enrolment. We use it to give you an account and to enforce who can do what. Our basis is performing our contract with your organisation.
• Usage and audit data: which questions were compiled, which writes were proposed and who approved them, when a credential was decrypted and the stated reason. We use it to meter tokens, to keep the service secure, and to give your organisation the audit record it is entitled to. Our basis is our contract and our legitimate interest in a service that can be audited.
• Billing data: your plan, seats, token consumption and invoices. Card details are handled by our payment processor and never reach us. Our basis is our contract and our legal obligation to keep accounting records.
• Support correspondence: what you write to us and what we write back. Our basis is our legitimate interest in answering you.

What we do not do

• We do not use your business data, or the content of your questions, to train models. Model calls run under a zero-retention arrangement with our provider.
• We do not sell personal data. We do not share it for advertising unless you chose the advertising option on the banner, and never for anybody’s advertising but our own.
• We do not make decisions about you by automated means that produce a legal or similarly significant effect on you.

4Cookies, and the choice you have

On this website

We use Google Analytics to see which pages people read. It sets cookies, and it sends your IP address and details of the page to Google. Analytics is not strictly necessary, so we ask first: on your first visit a banner offers “Allow” and “No thanks”, and until you choose Allow no Google script is loaded, no request is made to Google, and no cookie is set.

Declining costs you nothing and the site works identically. Your answer is kept in your browser’s local storage rather than in a cookie, so it is never sent to us. Clearing your browser data clears it, and the banner will ask again.

We have turned on IP anonymisation and we do not link analytics to anything else we hold. Google acts as our processor for this and is listed in the Data Processing Addendum.

Advertising

The banner asks two questions rather than one, because measuring which pages people read and showing you adverts elsewhere are different things. Allowing the first does not allow the second, and refusing the second does not cost you the first.

We do not advertise today. If you tick the advertising option, Google’s advertising features are enabled for you and nothing else changes until we actually start. If you do not, they stay switched off for you and we tell Google so explicitly rather than leaving it to be inferred.

We will not use anything collected under the analytics answer for advertising. If we begin advertising and want to reach people who only agreed to measurement, we will ask them again first. Consent given for one purpose is not consent for another, and quietly widening it is the thing this section exists to rule out.

In the product

Silo sets the cookies it needs to keep you signed in and to protect the session against cross-site request forgery. Those are strictly necessary, so we do not ask consent for them, and there is no analytics tag in the product at all.

5Who else touches it

We use a small number of providers to run Silo. Each is bound by contract to process personal data only on our instructions and to protect it to a standard at least equivalent to our own.

• A cloud infrastructure provider, which hosts the service and its database.
• A model provider, which compiles questions. It operates under a zero-retention arrangement: prompts are not stored and are not used for training.
• A payment processor, which takes payment and holds card details.
• An email provider, which delivers account, service and waitlist email.
• Google Analytics, on this website only, and only for visitors who accepted the banner.

The current list, naming each provider and what it does, is published on our sub-processors page and in the DPA. Customers are told before we add a new one.

We may also disclose data where the law requires it, to establish or defend a legal claim, or to a buyer if the business is sold, in which case this policy continues to apply until they tell you otherwise.

6Where it is held

Silo runs in the United Kingdom by default. European Union and North American regions are available, and a UK sovereign deployment runs on UK infrastructure, administered by UK staff, with the optional storage subsystem removed from the build.

Where personal data leaves the UK or the EEA, we rely on an adequacy decision where one exists, and otherwise on the UK International Data Transfer Addendum or the Standard Contractual Clauses, with a transfer risk assessment behind them.

7How long we keep it

• Query results. Held in memory with a time to live and expired. Not written to disk.
• Account data. For as long as the account exists, then 30 days, then deleted.
• Audit and approval records. Six years. They exist so somebody can prove who approved a change, which is a purpose that outlives the account.
• Billing records. Six years after the end of the accounting period, because tax law requires it.
• Waitlist entries. Until you unsubscribe or ask us to remove you, and in any case no more than 24 months after the last time you heard from us.
• Support correspondence. Two years after the matter closes.

8Keeping it safe

Credentials for your systems are encrypted individually, each under its own key, and those keys are wrapped by a master key held in a managed key service that never enters our application process. Production refuses to start without it rather than falling back to a local key. Only the last few characters of a credential are stored in readable form, and every decryption is logged with a reason.

Access to production is limited to the people who need it, is authenticated with a second factor, and is logged. Permissions are enforced in the database as well as in the application, and a field a person may not see is removed when the query is compiled, so it never enters the plan that runs.

If a breach occurs that is likely to result in a risk to people’s rights, we will report it to the Information Commissioner within 72 hours of becoming aware of it, and tell affected people without undue delay where the risk to them is high.

9Your rights

Under UK data protection law you may ask us to:

• confirm what personal data we hold about you, and give you a copy;
• correct it if it is wrong, or complete it if it is partial;
• delete it, where we no longer need it and no legal obligation requires us to keep it;
• restrict what we do with it while a dispute about it is resolved;
• give it to you, or to somebody else, in a structured, commonly used, machine readable form;
• stop processing it where we rely on legitimate interest, including for direct marketing, which we will stop on request with no further test applied.

Where we rely on consent you may withdraw it at any time, and that does not affect what we did before you withdrew it. The analytics and advertising answers are separate and can be withdrawn separately: clear this site’s data in your browser and the banner will ask again, or write to us and we will confirm what we have removed.

Write to hello@silohq.io. We answer within one month and will not charge you. If you are an employee of a customer organisation and your request concerns data inside that organisation’s own systems, we will pass it to them, because for that data they decide and we do not.

You may also complain to the Information Commissioner’s Office at ico.org.uk. We would rather you raised it with us first, but you are not required to.

10Children

Silo is a product for organisations and is not directed at children. We do not knowingly collect personal data about anybody under 16. If you believe we have, tell us and we will delete it.

11Changes to this policy

When we change this policy we change the date at the top of it. If a change materially affects your rights we will tell customers by email at least 30 days before it takes effect, rather than relying on you to notice.