Privacy Policy

Overview

This policy describes how SINGULANCE (“we,” “us,” “our”) collects, processes, and protects information across our products — HIVEMIND (memory engine), Tara (voice agent), and Sentinel Agents (autonomous digital employees), together the “Services.” SINGULANCE is built EU-first: single-tenant deployments, EU-hosted infrastructure, and data handling designed around GDPR, DORA, and the EU AI Act from day one. These design goals support customer compliance obligations; they are not a legal certification or a substitute for each customer’s own assessment.

Website Data, Cookies & Similar Technology

Our edge provider necessarily processes request information such as IP address, user agent, requested URL, status code, and timestamp to deliver and protect the site. We store your versioned cookie choices in the strictly necessary first-party cookie singulance_cookie_consent_v1. Optional preferences, PostHog EU product analytics and autocapture remain disabled until you opt in. Session replay remains disabled. We currently install no advertising or retargeting tracker. See our Cookie Policy for the provider, purpose, category, and duration of each browser technology.

Lawful Bases

• Contract or steps requested before contract (GDPR Art. 6(1)(b)): accounts, authentication, requested product functions, support, and billing
• Consent (Art. 6(1)(a)): optional analytics, marketing technology, and consent-based communications; consent can be withdrawn at any time
• Legitimate interests (Art. 6(1)(f)): essential security, fraud prevention, service reliability, and responding to business inquiries, balanced against your rights
• Legal obligation (Art. 6(1)(c)): tax, accounting, regulatory, and lawful-request records where applicable

Access to the public site and core contractual service is not conditional on accepting optional analytics or marketing technology.

Information We Collect

Account information you provide directly:

• Full name and email address
• Organization name and role
• Billing and plan information (processed via our payment provider — we do not store card numbers)

Content and data created within the Services:

• Memories, documents, and conversations you save to HIVEMIND
• Voice recordings and transcripts processed by Tara, where enabled
• Configuration, agent instructions, and workflow data for Sentinel Agents

Technical information necessary for security and operation:

• Authentication and session logs
• API and connector usage logs
• System performance and error metrics

Connected Services

With your explicit consent, you may connect third-party services so HIVEMIND can ingest, recall, or act on your behalf — for example Gmail, Google Calendar, Google Drive, Slack, Notion, GitHub, LinkedIn, and others available in your Connectors page. Each connection requires:

• Explicit authorization through that service’s own OAuth consent screen — we never see your password
• A scope grant limited to what the connected feature actually uses
• Your ability to disconnect and revoke access at any time from the Connectors page

Data accessed through a connected service is processed only for the purpose you authorized (ingestion, recall, or an action you requested) and is subject to that service’s own terms as well.

AI Processing

When you use HIVEMIND’s recall, chat, or agent features, your content may be processed by model providers routed through our controlled AI gateway solely to generate the response or action you requested. We do not permit these providers to train on your data. Where a connector routes execution through a third-party platform (for example, Composio for certain tool integrations), the same principle applies — processing happens at your direction, for your request, and nothing else.

Use of Information

• Operating and authenticating your account
• Storing, indexing, and recalling memory as you request it
• Executing connector actions you explicitly authorize
• Billing, plan enforcement, and fraud prevention
• Essential service communications
• Security monitoring and abuse prevention
• Compliance with legal obligations under GDPR, DORA, and applicable law

Data Residency & Hosting

Hosted HIVEMIND workspaces apply organization and user scope across application, database, vector-search, and graph paths. Dedicated and self-hosted deployment options provide additional physical isolation where contracted. Primary application and memory infrastructure is operated in Europe; a connector or model provider you deliberately invoke may process the minimum necessary request outside the EEA under an applicable transfer mechanism described below.

Service Providers & Sub-processors

Depending on the product and configuration you use, service providers may include:

• Cloudflare for DNS, edge delivery, security controls, Workers, and controlled AI routing
• EU infrastructure providers, including Hetzner, for application, database, and memory services
• PostHog EU Cloud for optional aggregate product analytics only after consent; session replay is disabled
• Stripe for checkout, subscriptions, and payment records; SINGULANCE does not store full card numbers
• Google or other identity providers when you choose their sign-in method
• Model and connector providers needed for a feature you request, subject to the selected deployment and routing configuration

We review this list when providers or processing purposes change and update this notice before materially different optional processing is enabled.

Information Disclosure

We do not sell, rent, or commercially trade your personal information. We disclose information only:

• To infrastructure and processing subprocessors necessary to run the Services (see Infrastructure Partners)
• To third-party AI providers, solely to fulfil a request you made
• To services you explicitly connected, per the scope you authorized
• When required by law, regulation, or valid legal process
• To protect the rights, safety, or property of SINGULANCE, our users, or others
• In connection with a merger, acquisition, or asset transfer, with continuity of this policy

Data Retention & Deletion

We retain account and memory data for as long as your account is active, or as needed to provide the Services, subject to configured retention and legal obligations. Consent records are retained for the stated cookie lifetime, optional analytics identifiers for the period listed in the Cookie Policy, and payment or tax records for applicable statutory periods. You may delete individual memories, disconnect a connector, or request full account deletion at any time. Disconnecting a service stops new sync but does not automatically delete previously ingested data unless you request it. Full-account deletion requests are honored subject to legal retention requirements and reasonable processing time.

Your Rights (GDPR)

As a data subject under GDPR (and equivalent rights under other applicable law), you may:

• Request access to the personal data we hold about you
• Request correction of inaccurate data
• Request erasure of your data (“right to be forgotten”)
• Request restriction of, or object to, certain processing
• Request data portability in a structured, commonly-used format
• Withdraw consent for a connected service at any time
• Lodge a complaint with your local data protection authority

To exercise any of these rights, contact us — see Contact below.

We normally respond within one month after verifying the request. You may also complain to your competent supervisory authority, including the State Commissioner for Data Protection of Lower Saxony where applicable.

International Transfers

Where a connected service or AI provider you authorize is based outside the EU/EEA, we rely on that provider’s Standard Contractual Clauses or equivalent safeguard, and only transfer the minimum data necessary to fulfil the request you made.

Policy Updates

We may update this policy as our Services evolve. Material changes are communicated by email to account holders or a prominent notice in the product before they take effect.

Contact

For privacy requests, security disclosures, or general questions about this policy, contact us at privacy@singulancelabs.com. For security vulnerability reports specifically, use security@singulancelabs.com.

SINGULANCE · Hannover, Germany