Privacy notice

Saible AI ApS, of Copenhagen, Denmark ([registered address and CVR number to confirm]), runs this website and the Saible console. For what this notice describes in its first part (people who ask for access, console users, support), Saible decides why and how your data is used, so we are its controller. Write to naveen@saible.ai with any question about it.

When an organisation uses Saible to govern its own AI use, the records it creates (its decision records, its applications and policies, and, if it opts in, its evaluation corpus) are its data, and we process them for it under its contract with us. For those, the organisation is the controller; see Data we process for our customers.

If you ask for access

The form keeps what it asks and nothing else: your name, work email, company, role, what you focus on, your country, the region you would like your records kept in, the AI providers you use, a spending band, your timeline and what you need, plus the time you agreed to be contacted. We note whether the address is a personal one (gmail.com and the like). The form itself keeps no IP address. Each request is emailed to the two people at Saible who answer it, and we use it to arrange a call and, if you go ahead, to set up your organisation. We rely on your request: these are steps you asked for before any contract (GDPR Art. 6(1)(b)), and on our legitimate interest in answering the people who write to us (Art. 6(1)(f)).

If you have a console account

Your name, email address, organisation and role; your sign-in and multi-factor enrolment, which Amazon Cognito holds; when you last signed in; and an audit record of each change you make in the console (what was asked, when, and the network address it came from). Decisions you approve or make are written into your organisation's evidence ledger under your name, because showing who approved what is what the ledger is for. We use this to run your account, keep it secure, and give your organisation the record it pays for: our contract with your organisation and our legitimate interest in running a secure service (Art. 6(1)(b) and (f)).

If you write to us, or we give your organisation support

The email you send and our replies, in our mailboxes. When your organisation grants Saible staff support access, a staff member can read its console, read-only, for the time and scope it approved; each grant and each use is recorded.

When you visit this website

Our load balancer logs every request, with its network address, for security and fault finding. We use no analytics and no advertising or tracking cookies, and the site loads no third-party scripts or fonts. When you sign in, the console keeps your sign-in session and a few display preferences in your browser; they are needed for the console to work, and signing out ends the session.

Saible runs on Amazon Web Services, with one copy of the service in each region: the United States (Ohio, us-east-2), at saible.ai, and the EU (Stockholm, eu-north-1), at eu-north-1.saible.ai. A request for access is kept in the region whose site you used. An organisation's console users are kept in the region the organisation chose.

Two things are kept in the United States whatever the organisation's region. A user who signs up with a personal address (gmail.com and the like) is held in our home region, Ohio. And AWS's own record of activity in our AWS accounts (which person or system called which AWS service, from which network address) is kept in the United States for every region; it holds no content of your organisation's records. Requests for access are emailed through Amazon SES in the region that took them to our Google Workspace mailboxes.

Where personal data goes to the United States, it goes under our providers' data processing terms, which include the European Commission's standard contractual clauses.

Amazon Web Services runs everything above (computing, the database, storage, encryption keys, sign-in, outbound email, and the AI models Saible uses for its own features, through Amazon Bedrock in the region's geography). Google Workspace carries our email. The full list, with what each does and where, is on our sub-processor page. We do not sell personal data, and we do not use it for advertising.

An organisation that uses Saible decides what its records hold, and it answers for them as controller. In short, and as its contract says: a decision record holds the types and positions of what was found in a request, never the text itself. If the organisation opts a workload into the evaluation corpus, the requests and answers of that workload are kept, in the organisation's own storage bucket under its own key, for the window it chose (7 to 180 days, 30 by default), with what our detectors found replaced by stand-ins; what they did not find is kept as sent, so the corpus is pseudonymised personal data, not anonymous. Saible reads those items while it runs an evaluation the organisation asked for. If you are a member of the public whose data reached Saible through one of our customers, write to that customer first; we help them answer you, and you may also write to us.

You may ask to see what we hold about you, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Write to naveen@saible.ai; we answer within one month. We may need to confirm who you are first. Some things we may have to keep, such as approvals in an evidence ledger that your organisation relies on; we will say what and why. We make no decisions about you by automated means alone.

You may also complain to the data protection authority where you live or work; in Denmark, where Saible is established, that is Datatilsynet. We would like the chance to put things right first.

When we change what we keep or how long we keep it, we change this page and its date first.