Privacy Policy

1. Data controller

The data controller responsible for your personal information is Tomás Sexenian, operating Sibyl from Solymar, Ciudad de la Costa, Canelones, Uruguay. You can reach us at contact@hellosibyl.com.

2. What data we collect

We collect only what is necessary to operate the service:

• Account & access data — your email address, collected when you request beta access or create an account.
• Run inputs & outputs — the ideas, descriptions, or URLs you submit to the simulation, and the verdicts Sibyl produces. Inputs are redacted for personally identifiable information before entering the simulation pipeline.
• Payment data — billing name, payment method details, and transaction records. Payment data is processed directly by our payment processors (dLocal Go, and Mercado Pago in some regions); we do not store raw card numbers on our servers.
• BYOK API keys (optional) — if you bring your own OpenAI key, it is encrypted at rest before storage; we display only a masked hint (last 4 characters).
• Usage data — page visits, feature interactions, and error logs collected to operate and improve the service.

3. How we use your data

We use your data to:

• Provide, operate, and improve the Sibyl simulation service.
• Process payments and manage your subscription or pay-per-run credits.
• Send transactional communications (receipts, run results, account notices).
• Diagnose technical issues and maintain service security.

We do not sell your data. We do not use your run inputs to train AI models without your explicit consent.

4. Legal basis for processing

Processing is based on: (a) performance of a contract when you use the paid service; (b) our legitimate interests in operating and securing the platform; and (c) your consent where we ask for it specifically.

5. Sub-processors and third parties

We share data with the following service providers acting as sub-processors:

• dLocal Go and Mercado Pago — payment processing. Each processes payment data under its own privacy policy and PCI-DSS compliance program. See dlocalgo.com/en/privacy-policy.
• Vercel — hosting and edge infrastructure for this site. Vercel may process request metadata (IP, headers) to serve the application.
• AWS — compute, storage, and transactional email delivery for the Sibyl app.
• OpenAI, Anthropic, NVIDIA NIM, and OpenRouter— AI inference for simulation runs. Redacted validation inputs are sent to one or more of these providers under each provider’s own data-processing terms. Users who supply their own API key (BYOK) route their run through that provider directly under their own account.

We require all sub-processors to maintain appropriate security standards and to process data only as instructed.

6. Data retention

We retain your account data for as long as your account is active plus 90 days after closure, to allow for dispute resolution. Run inputs (redacted) and outputs are retained until you delete the run or request account/data deletion — there is no fixed automatic expiry, since re-opening a past verdict with its full methodology is a core product feature. Payment records are retained for 7 years to comply with applicable tax and accounting obligations. You may request earlier deletion at any time (see Section 8).

7. International transfers

Sibyl operates from Uruguay. Our sub-processors — Vercel, OpenAI, Anthropic, NVIDIA NIM, OpenRouter, dLocal Go, and Mercado Pago — may process data in the United States or other jurisdictions. We rely on standard contractual clauses or equivalent safeguards where required by applicable law.

8. Your rights

Depending on your location, you may have rights to: access the personal data we hold about you; correct inaccurate data; request deletion of your data; restrict or object to certain processing; and data portability. To exercise any of these rights, email us at contact@hellosibyl.com. We will respond within 30 days.

9. Cookies and tracking

We use a single functional cookie (sibyl_locale) to remember your language preference. We do not use advertising cookies or cross-site trackers.

10. Security

We implement industry-standard security measures including HTTPS encryption in transit, access controls, and isolated run environments. No system is completely secure; if you discover a vulnerability, please report it to contact@hellosibyl.com.

11. Children

Sibyl is not directed at children under 18. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it promptly.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or by a notice on this page. The date at the top of this page reflects the most recent revision.

13. Contact

For any privacy questions, requests, or complaints: contact@hellosibyl.com.