Privacy Policy

Who this covers

This policy covers people who visit sillion.app, join the waitlist, or book a demo. Throughout, we and Sillion mean the company operating this website.

It also describes, separately and clearly marked, how Sillion handles data when a school, district, or university deploys the product to its students and staff. That part is written as a commitment rather than a description of this website, because the classroom product is not what this site runs.

What the website collects

If you only read the pages

You submit nothing: we do not ask for your name and there is no account to create. Data is still collected, because serving a page requires it. Our host records the ordinary information any web server receives — your IP address, your browser and device type, and which page you requested. Vercel Analytics and Speed Insights, which run on every page, measure traffic and page performance.

If you join the waitlist

We store, in a Supabase database:

• the email address you type in;
• your IP address, taken from the request headers;
• your browser's user-agent string;
• the referring page, meaning the address of whatever site or page sent you to ours;
• the fact that the sign-up came from the website, and the date and time it happened.

We keep those last four because a waitlist is a target for automated sign-ups, and without them we cannot tell a teacher from a script or find out where a burst of fake addresses came from.

If you book a demo

The Book a Demo button opens a scheduling widget operated by Cal.com, embedded in our page. What you type into it — your name, your email, and anything in the notes field — goes to Cal.com and to us as the booking. It does not pass through the waitlist database.

If you email us

We keep the message and your address, for as long as we need it to deal with what you wrote about.

Why we collect it

• To run the site. Serving a page requires the request data described above.
• To operate the waitlist. Your email address is there so we can send the confirmation and, later, the invitation and build notes you signed up for.
• To keep the waitlist honest. The IP address, user agent, and referrer let us spot and remove automated sign-ups.
• To understand what people read. Aggregate analytics tell us which pages get used and where the site is slow.
• To schedule and hold a demo you asked for.

Where the GDPR or UK GDPR applies, our lawful bases are consent for the waitlist mailing, legitimate interests for security and for measuring how the site performs, and contract or legitimate interests for arranging a demo you requested. There is more detail on the GDPR page.

Cookies and browser storage

The site sets one cookie, and only after you successfully join the waitlist. It is named sillion_waitlist_registered, it lasts one year, and its value is a short hash derived from your browser and screen characteristics — user agent, language, colour depth, screen size, and time-zone offset. Its only job is to let the page recognise a returning sign-up so the form says “add another email” instead of pretending you are new.

Alongside it, the site stores the email addresses you have submitted from that browser in localStorage, under the key sillion_waitlist_emails, with the time of each. That data stays in your browser. It is what tells you an address is already on the list without a round trip to us.

Clearing your browser's cookies and site data for sillion.app removes both, immediately and without asking us. Doing so does not take you off the waitlist — see below.

Who else sees it

Four named providers can receive personal data from this site: Vercel, which hosts it and provides the analytics; Supabase, which hosts the waitlist database; Resend, which delivers our email; and Cal.com, which runs the booking widget. The subprocessors page says what each one receives.

Our sign-up handler can also forward a new subscriber's address and record identifier to a mailing-list webhook, when one is configured for the deployment. Where that is switched on, the receiving service is a provider under the same terms as the rest.

Beyond that we disclose personal data only where the law requires it, or where we need to establish or defend a legal claim. If Sillion is ever acquired or merged, personal data would transfer as part of the business, and this policy would continue to apply to it until replaced.

How long we keep it

We keep waitlist records while the waitlist is running, and delete them when we no longer need them for that purpose or when you ask us to. Server and analytics data is retained for the period our providers apply to their logs.

We are not going to publish a table of fixed retention periods. Doing so would state a control this site does not yet enforce programmatically, and a policy that promises a ninety-day purge is worse than one that tells you to ask.

Unsubscribing and deletion

These are two different things, and the difference matters.

Unsubscribing

Every email we send carries an unsubscribe link. Following it marks your record as unsubscribed and records when. We stop sending. Your row stays in the database, with your address in it — that is what lets us honour the request rather than re-add you the next time the address turns up. If you later sign up again, that same record is reactivated.

Deletion

Deletion removes the record. Email hello@sillion.app from the address you signed up with, or tell us which address to remove, and we will delete it. Once deleted there is nothing left to suppress future mail with, so if you also want to be sure we never write again, say so and we will unsubscribe rather than delete.

You can also clear your browser storage as described above. That is about your browser, not our database, and it does not unsubscribe you.

Your rights

Depending on where you live, you may have rights to access a copy of what we hold, correct it, delete it, restrict or object to how we use it, receive it in a portable form, and withdraw consent. Exercising a right costs nothing and we will not treat you differently for it.

Write to hello@sillion.app. We answer within the period the applicable law allows — under the GDPR, one month, extendable by two further months for complex requests, with notice. Where we cannot identify you from what you have sent, we will ask for enough to be sure we are not handing your data to someone else. The GDPR page covers this in more detail, including how to complain to a supervisory authority.

School deployments

Who decides

In a school deployment the institution is the controller of student and staff personal data, and Sillion is its processor. We act on the institution's documented instructions. Under FERPA, Sillion acts as a school official with a legitimate educational interest, under the institution's direct control.

What the product would process

Roster and account data supplied or synced by the institution; course material the institution connects; student work submitted through the product; the content of a student's conversations with the tutor; and the derived signals a teacher sees about how a student is progressing. Teachers retain oversight of grading: the product drafts against a rubric and a person reviews before anything reaches a student.

Commitments

• We do not sell student personal information, and we do not use it for targeted advertising or to build advertising profiles.
• We do not use student personal information for any purpose other than providing the service to the institution and keeping it secure.
• We do not use institutional or student content to train general-purpose models without the institution's written agreement. Processing needed to answer a student's question in the moment is part of providing the service; retaining that content to improve a model for other customers is not, and is not something we do by default.
• Where a service is offered to children under 13, we contract on the basis that the school provides consent on parents' behalf for the educational purpose, as COPPA permits, and we accept the corresponding limits on use.
• On termination, we return or delete institutional data on the terms in the executed agreement.

The operative version of these commitments for a given institution is the executed agreement and its data protection terms — see the DPA. Where that agreement and this page differ, the agreement governs.

Children

This website is aimed at teachers and administrators, not at children. We do not knowingly collect personal data from a child through the waitlist or the booking form. If you believe a child has sent us something, write to hello@sillion.app and we will delete it.

Changes and contact

When this policy changes we update it here and change the date at the top. If a change materially affects people already on the waitlist, we will say so by email rather than relying on you to re-read the page.

Questions, requests, and complaints go to hello@sillion.app.