Secton ("we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how personal information is collected, used, disclosed, stored, and otherwise processed when you use our website, developer platform, application programming interfaces ("APIs"), artificial intelligence models, software, documentation, or any other products or services that reference this Privacy Policy (collectively, the "Services").
This Privacy Policy applies globally unless a separate privacy notice or agreement governs a particular Service.
1. Scope
This Privacy Policy applies to personal information processed in connection with:
- the Secton website;
- Secton Console;
- developer accounts and organizations;
- APIs;
- AI model inference services;
- customer support;
- documentation;
- communications with us;
- security and abuse prevention systems;
- any additional Services that link to this Privacy Policy.
It does not apply to services or websites operated by third parties that may be linked from the Services.
Certain enterprise customers may be subject to separate contractual terms, including Data Processing Agreements or negotiated agreements, which supplement this Privacy Policy where applicable.
2. Definitions
Unless otherwise defined, the following terms have the meanings below.
Account
An account registered to access one or more Services.
Authorized User
An individual authorized by an account owner or organization administrator to access an organization or other Service.
Console
Secton's developer platform for managing organizations, credentials, usage, and access to AI services.
Customer
Any individual or legal entity that accesses or uses the Services.
Customer Content
Content submitted to or generated through the Services, including Inputs and Outputs.
Customer Content may include personal information depending on how the Services are used.
Input
Any prompt, file, image, audio, structured data, instruction, or other content submitted to a Service for processing.
Output
Content generated by a Service in response to an Input.
Outputs may include text, code, structured data, classifications, summaries, images, or other supported formats.
Personal Information
Information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable individual.
The meaning of Personal Information includes equivalent concepts such as "personal data" where required by applicable law.
Services
The websites, APIs, Console, AI models, software, documentation, applications, and related products made available by Secton.
Usage Information
Information generated through use of the Services, including operational logs, events, request metadata, device information, diagnostic information, and service performance metrics.
3. Roles and Responsibilities
The role we perform when processing information depends on how the Services are used.
When We Act as a Controller
We generally act as the data controller with respect to information relating to:
- account creation;
- authentication;
- billing;
- subscriptions;
- communications;
- website usage;
- customer support;
- security monitoring;
- compliance with legal obligations.
As controller, we determine the purposes and means of processing personal information.
When We Act as a Processor
When a customer submits personal information through the Services on behalf of another individual or organization, processing may occur solely on that customer's instructions.
Examples include applications built using the APIs, AI model requests submitted on behalf of end users, or enterprise integrations.
In those situations:
- the customer determines the purposes of processing;
- the customer is responsible for providing any required notices and obtaining any necessary permissions;
- processing is performed in accordance with applicable agreements and documented instructions.
Where required by law or contract, additional terms governing processor obligations may apply, including a Data Processing Agreement.
4. Information We Collect
The categories of information collected depend on the Services used, account settings, and how you interact with the platform.
Not every category described below is collected in every circumstance.
4.1 Information You Provide
Information may be provided directly when creating an account, contacting support, joining an organization, subscribing to services, participating in surveys, or otherwise communicating with us.
Depending on the circumstances, this may include:
- full name;
- email address;
- username;
- organization name;
- organization information;
- billing contact information;
- payment-related information;
- profile information;
- support requests;
- communications;
- files or attachments voluntarily provided.
If you are invited to join an organization, information associated with that invitation (such as your email address, invitation status, and organization membership) may also be processed.
Please avoid submitting sensitive personal information unless it is reasonably necessary for your intended use of the Services.
4.2 Account, Authentication, and Security
To authenticate users, secure accounts, detect unauthorized access, and maintain the integrity of the Services, information such as the following may be collected:
- authentication events;
- login timestamps;
- password reset activity;
- email verification status;
- IP addresses;
- approximate geographic region inferred from network information;
- browser type and version;
- operating system;
- device identifiers;
- session identifiers;
- security events;
- failed authentication attempts;
- fraud and abuse detection signals.
This information is processed for security, fraud prevention, operational integrity, and compliance purposes.
4.3 Organizations
The Services support both personal organizations and team organizations.
Information associated with collaborative use of the Services may include:
- organization names;
- organization identifiers;
- member lists;
- invitation records;
- roles and permissions;
- organization settings;
- administrative actions;
- audit events necessary for security and operational purposes.
Organization administrators are responsible for managing access to organizations and ensuring that invited users have appropriate authorization to access shared resources.
4.4 AI Services
Use of AI services necessarily involves processing Customer Content.
Depending on the Service, Customer Content may include:
- text;
- prompts;
- uploaded documents;
- source code;
- images;
- audio;
- structured datasets;
- configuration instructions;
- conversation history;
- generated Outputs.
The categories of Customer Content processed depend entirely on how the Services are used by customers.
Customer Content may contain Personal Information where submitted by or on behalf of a customer.
4.5 API and Platform
When APIs or developer tools are used, operational information may be generated, including:
- API credentials and identifiers;
- request metadata;
- timestamps;
- model identifiers;
- organization identifiers;
- usage measurements;
- token or compute consumption;
- latency and performance metrics;
- error reports;
- diagnostic information.
This information is used to operate, secure, measure, and improve the Services and to administer customer accounts.
4.6 Information Collected Automatically
Certain information is collected automatically when the Services are accessed or used.
Depending on the Service and your device, this may include:
- network information;
- IP address;
- browser and device characteristics;
- operating system;
- language preferences;
- referring URLs;
- pages viewed;
- interactions with documentation and interfaces;
- timestamps;
- session information;
- error reports;
- diagnostic information;
- performance metrics.
This information helps operate, maintain, secure, and improve the Services.
Information collected automatically is generally processed independently from Customer Content, except where reasonably necessary for security, troubleshooting, or service operation.
4.7 Cookies and Similar Technologies
The Services use cookies and similar technologies, including local storage, pixels, and comparable technologies, to provide functionality, improve performance, remember preferences, understand usage patterns, and protect accounts.
These technologies may be used to:
- authenticate users;
- maintain active sessions;
- remember preferences;
- measure Service performance;
- understand feature usage;
- detect abuse;
- improve reliability;
- provide security protections.
Some cookies are required for the Services to function properly and cannot reasonably be disabled.
Most browsers allow users to manage or remove cookies through browser settings. Disabling certain cookies may affect the availability or functionality of portions of the Services.
Where required by applicable law, additional choices regarding non-essential cookies will be made available.
5. How Information Is Used
Personal Information is processed only where there is a legitimate business purpose, contractual necessity, legal obligation, consent where required, or another lawful basis recognized under applicable law.
The purposes described below may overlap, and the same information may be processed for multiple compatible purposes.
5.1 Providing the Services
Information is processed to operate and deliver the Services, including to:
- create and manage Accounts;
- authenticate users;
- provide access to Console;
- process API requests;
- execute AI model inference;
- generate Outputs;
- manage organizations;
- administer subscriptions;
- provide customer support;
- communicate regarding the Services;
- maintain user preferences.
Without processing certain information, some Services cannot be provided.
5.2 Operating and Maintaining the Platform
Information is processed to maintain the availability, reliability, integrity, and performance of the Services.
Examples include:
- diagnosing technical issues;
- monitoring infrastructure;
- improving latency;
- measuring availability;
- preventing service degradation;
- capacity planning;
- maintaining compatibility;
- restoring service after failures.
5.3 Security and Abuse Prevention
Protecting customers, infrastructure, and the public is an essential part of operating AI services.
Information may be processed to:
- detect unauthorized access;
- authenticate users;
- investigate suspicious activity;
- identify compromised credentials;
- detect fraud;
- prevent abuse of the Services;
- enforce usage restrictions;
- investigate violations of agreements or policies;
- respond to security incidents;
- protect the confidentiality, integrity, and availability of systems.
Reasonable automated systems may be used to identify suspicious or abusive activity.
Where appropriate, automated findings may be reviewed by authorized personnel.
5.4 Communications
Information may be used to communicate regarding:
- account activity;
- authentication;
- security events;
- billing;
- product updates;
- changes to agreements or policies;
- support requests;
- administrative notices.
Marketing communications are provided in accordance with applicable law and available user preferences.
5.5 Research and Service Improvement
Information may be processed to improve the quality, safety, performance, accessibility, and reliability of the Services.
Examples include:
- evaluating system performance;
- identifying software defects;
- measuring feature adoption;
- improving documentation;
- developing new capabilities;
- improving security systems;
- improving operational efficiency.
Whenever reasonably possible, these activities use aggregated, de-identified, or otherwise minimized information rather than directly identifiable Personal Information.
5.6 Compliance With Legal Obligations
Information may be processed where reasonably necessary to:
- comply with applicable law;
- respond to lawful requests from public authorities;
- establish, exercise, or defend legal claims;
- protect the rights, property, or safety of customers, users, or third parties;
- enforce agreements;
- comply with court orders or other legal processes.
6. Customer Content
The Services process Customer Content only as necessary to provide the requested functionality and operate the Services.
Customer Content may include Personal Information depending on how the Services are used.
Customers remain responsible for determining whether Customer Content contains Personal Information and for ensuring they have all rights, permissions, notices, and legal bases required to submit that information to the Services.
Unless otherwise agreed in writing, Customer Content is processed only for purposes described in this Privacy Policy, applicable agreements, and documented customer instructions where we act as a processor.
7. AI Model Training and Service Improvement
Unless explicitly stated otherwise in a separate agreement or product-specific notice:
Customer Inputs and Outputs submitted through the APIs or Console are not used to train publicly available AI models.
Limited processing of Customer Content may nevertheless occur where reasonably necessary to:
- provide requested model inference;
- maintain system reliability;
- investigate technical failures;
- detect abuse;
- identify security threats;
- comply with applicable law;
- protect the Services and their users.
If optional programs are introduced that allow customers to contribute data for model improvement, participation will be voluntary and governed by separate terms or notices where required.
Nothing in this section limits processing necessary to satisfy legal obligations, enforce agreements, investigate misuse, or protect the security of the Services.
8. Sharing Information
Personal Information is not sold.
Personal Information is disclosed only as described in this Privacy Policy, where directed by customers, or where otherwise permitted or required by applicable law.
8.1 Service Providers
Certain services are performed by carefully selected providers acting on our behalf.
Depending on the circumstances, providers may perform services relating to:
- cloud infrastructure;
- content delivery;
- authentication;
- customer communications;
- payment processing;
- customer support;
- monitoring;
- security;
- analytics;
- fraud prevention;
- email delivery;
- infrastructure operations.
Service providers receive only the information reasonably necessary to perform the services requested of them and are required to protect that information under appropriate contractual obligations.
8.2 Organization Administrators
Where the Services are used through an organization, authorized administrators may have access to certain information relating to organization members, activity, settings, billing, and administrative actions as necessary to administer the organization.
The scope of information available depends on administrative permissions and organization configuration.
8.3 Customer Instructions
Where acting as a processor, Personal Information may be disclosed or otherwise processed solely on documented customer instructions, including through customer-configured integrations, APIs, or authorized third-party services.
8.4 Legal Requirements
Information may be disclosed where reasonably necessary to:
- comply with applicable law;
- respond to lawful requests;
- comply with judicial proceedings;
- enforce agreements;
- investigate fraud or abuse;
- protect rights or property;
- protect public safety;
- prevent unlawful activity.
Requests are evaluated on a case-by-case basis, taking into account applicable legal requirements and the rights of affected individuals.
9. International Data Transfers
The Services are designed to support customers in multiple jurisdictions.
Console infrastructure is hosted in London, United Kingdom. Depending on the Service used, Customer Content, Usage Information, and other information may also be processed through infrastructure located in additional jurisdictions to provide AI inference, maintain availability, improve resilience, perform disaster recovery, or support other operational requirements.
As a result, Personal Information may be transferred to and processed in countries other than the country in which it was originally collected.
Where required by applicable law, appropriate safeguards are implemented for international transfers. These safeguards may include:
- Standard Contractual Clauses or equivalent contractual mechanisms;
- adequacy decisions issued by competent authorities;
- legally recognized transfer mechanisms available under applicable law; or
- other appropriate safeguards recognized by applicable data protection laws.
Additional information regarding international transfers may be requested using the contact information provided at the end of this Privacy Policy.
10. Data Retention
Information is retained only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, comply with applicable legal obligations, resolve disputes, enforce agreements, maintain security, or protect the integrity of the Services.
Retention periods vary depending on the nature of the information and the purposes for which it was collected.
Factors considered when determining retention periods include:
- the functionality being provided;
- contractual obligations;
- legal and regulatory requirements;
- security and fraud prevention needs;
- operational requirements;
- the sensitivity of the information;
- customer instructions where processing occurs on behalf of a customer.
Examples include:
Account Information
Generally retained while an Account remains active and for a reasonable period afterward to comply with legal obligations, resolve disputes, or maintain security.
Billing Information
Retained for the period required under applicable accounting, financial, and tax laws.
Authentication and Security Logs
Retained for periods reasonably necessary to investigate unauthorized access, detect abuse, maintain platform security, and satisfy legal obligations.
Usage Information
Retained for operational analytics, reliability, capacity planning, security, and service improvement for periods appropriate to those purposes.
Customer Content
Retention depends on the applicable Service, customer configuration, contractual commitments, and operational requirements.
Where acting solely as a processor, Customer Content is retained and deleted according to customer instructions and applicable agreements unless continued retention is required or permitted by law.
Information may be retained for longer periods where necessary to establish, exercise, or defend legal claims or to comply with applicable legal obligations.
11. Security
Reasonable technical, administrative, and organizational safeguards are implemented to protect Personal Information against unauthorized access, disclosure, alteration, misuse, accidental loss, or destruction.
Security measures may include, where appropriate:
- encryption during transmission;
- encryption of stored information where appropriate;
- authentication controls;
- authorization controls;
- least-privilege access management;
- infrastructure monitoring;
- vulnerability management;
- audit logging;
- incident detection;
- security testing;
- backup and disaster recovery procedures.
Security measures are continually reviewed and may evolve over time to address changes in technology, operational requirements, and emerging threats.
Despite these safeguards, no method of transmission over the Internet or electronic storage can be guaranteed to be completely secure. Accordingly, absolute security cannot be guaranteed.
Users are responsible for protecting their own credentials, API keys, devices, and systems used to access the Services.
12. Your Rights
Depending on your location and applicable law, you may have certain rights regarding your Personal Information.
These rights may include the right to:
- request access to Personal Information;
- request correction of inaccurate or incomplete information;
- request deletion of Personal Information;
- request restriction of certain processing activities;
- object to processing carried out on certain legal grounds;
- request portability of Personal Information where applicable;
- withdraw consent where processing is based on consent;
- lodge a complaint with a competent supervisory authority.
The availability of particular rights depends on applicable law and the circumstances of the processing.
Requests may be submitted using the contact information provided below.
Reasonable steps may be taken to verify the identity of the individual submitting a request before responding.
Where permitted by law, requests may be denied or limited where necessary to protect the rights of others, comply with legal obligations, prevent fraud, protect the security of the Services, or where another lawful exception applies.
13. Legal Bases for Processing
Where the UK General Data Protection Regulation, the EU General Data Protection Regulation, or similar laws apply, Personal Information is processed on one or more of the following legal bases:
- performance of a contract;
- compliance with legal obligations;
- protection of vital interests;
- legitimate interests, provided those interests are not overridden by the rights and freedoms of affected individuals; or
- consent, where consent is required by applicable law.
Legitimate interests may include:
- operating and improving the Services;
- maintaining security;
- preventing abuse;
- responding to customer requests;
- developing new functionality;
- protecting legal rights;
- maintaining reliable infrastructure.
14. California Privacy Rights
Where applicable under California law, California residents may have additional rights regarding Personal Information.
These rights may include:
- the right to know;
- the right to request deletion;
- the right to request correction;
- the right to receive certain information regarding disclosures of Personal Information;
- the right to limit certain uses of sensitive Personal Information where applicable;
- the right not to be discriminated against for exercising privacy rights.
Personal Information is not sold or shared for cross-context behavioral advertising as those terms are defined under applicable California privacy laws.
California residents may exercise applicable rights using the contact information provided below.
15. Children's Privacy
The Services are intended for use by individuals who are legally permitted to enter into binding agreements under applicable law.
The Services are not directed to children under the age of 13, or any higher minimum age required under applicable law.
Personal Information is not knowingly collected from children where prohibited by law.
If it is determined that Personal Information has been collected from a child in violation of applicable law, reasonable steps will be taken to delete that information as required.
Parents or legal guardians who believe a child has provided Personal Information may contact us using the information below.
16. Third-Party Services
The Services may contain links to websites, services, software, or content operated by third parties.
This Privacy Policy applies only to the Services.
Third-party products and services operate under their own privacy policies, terms, and practices. Responsibility for those practices rests with the applicable third party.
Customers are encouraged to review the privacy policies of any third-party services they choose to use in connection with the Services.
17. Changes to This Privacy Policy
This Privacy Policy may be updated from time to time to reflect changes to the Services, applicable law, operational practices, or legal requirements.
When material changes are made, reasonable efforts will be made to provide notice where required by applicable law.
The "Effective" at the beginning of this Privacy Policy will be updated whenever a revised version becomes effective.
Continued use of the Services after the effective date of an updated Privacy Policy constitutes acknowledgment of the revised Privacy Policy.
18. Contact
Questions, requests, or concerns regarding this Privacy Policy or privacy practices may be directed to:
Privacy Team
Email: [email protected]
Where required by applicable law, additional contact information or regional representatives may be designated for specific jurisdictions.