Privacy Policy

Vivtech Solutions (Noida, Uttar Pradesh, India) runs sikia.dev. We play two roles:

• For our customers (people who sign up and run projects), we decide how account and billing data is used, so we are the controller of it.
• For our customers’ users (people whose feedback a project captures from Slack, Discord, the widget, GitHub or the public board), the project owner decides what is collected and why. They are the controller and we process that data on their behalf. If your feedback was captured by a product that uses Sikia, contact that product first; we’ll help them answer you, or forward your request.

This policy covers Sikia Cloud. Self-hosted copies of Sikia are run by whoever hosts them, and we don’t receive their data.

• Account: your email address. If you sign in with Discord, your Discord user ID, username and avatar.
• Billing: your plan, subscription status, renewal dates and the customer ID from Dodo Payments. Card details go to Dodo Payments, never to us.
• Project content: requests, votes, comments, changelog entries, settings and the teammates you invite (their email addresses).
• Captured feedback (on behalf of project owners): the text of messages from the Slack and Discord channels, widget and GitHub repositories a project connects, plus the author’s display name, avatar, Slack or Discord user ID or GitHub username, the email and name a widget passes in (if any), and the page the widget was opened on.
• Technical: IP address, browser and request details in standard server logs, and an IP address held briefly in memory to rate-limit the widget.
• Secrets you give us: AI provider keys (stored encrypted with AES-256-GCM) and MCP tokens (stored only as a hash).

We use only the cookies needed to keep you signed in (set by our authentication provider, Supabase). We don’t use analytics, advertising or cross-site tracking cookies, so there’s no cookie banner. The embeddable widget does not set cookies.

• To run the service: sign you in, capture and sort feedback, show boards, send replies and emails you’ve set up.
• To bill you and keep the records tax law requires.
• To keep Sikia secure, prevent abuse and fix problems.
• To send service emails: sign-in links, invites, receipts, “shipped” notices to people who voted, and important changes. We don’t send marketing emails without asking.

Our legal bases under the GDPR and UK GDPR are performing our contract with you, our legitimate interest in running and securing the service, and legal obligations such as keeping invoices.

To sort, de-duplicate, translate and answer feedback, Sikia sends the message text and relevant roadmap titles to an AI provider (Anthropic or OpenAI). Both process this data under their API business terms, which, as of the date of this policy, do not use API data to train their models by default. If a project adds its own AI key, that project’s data goes to the provider it chose, under its agreement with that provider.

We don’t sell or rent personal data, and we don’t share it for advertising. We use these service providers to run Sikia:

When you connect Slack, Discord or GitHub, Sikia also sends replies and reads messages through their APIs, under their policies. A connected Slack workspace’s access token is stored encrypted and deleted when you disconnect or uninstall the app. We may disclose data if the law requires it, or to a buyer if the business is sold, under the same protections.

Our database is hosted in the United States, and some providers above process data in other countries. Where data leaves the EU, UK or another region with transfer rules, we rely on safeguards such as the European Commission’s Standard Contractual Clauses offered by those providers.

• Account and project data: while your account exists. If your subscription ends, we keep it so you can return, until you ask us to delete it.
• Deletion requests: completed within 30 days, including removal from active systems; backups roll off within a further 30 days.
• Billing records: as long as tax law requires (in India, generally up to 8 years).
• Server logs: kept by our hosting providers for a short period, typically 30 days or less.

Traffic is encrypted with TLS. Project data is isolated with row-level security in the database, AI keys are encrypted at rest, MCP tokens are stored only as hashes, and service credentials are never sent to the browser. No system is perfectly secure; if a breach affects your data, we’ll tell you without undue delay.

Depending on where you live, you can ask to access, correct, export or delete your personal data, object to or restrict how we use it, and complain to your data protection authority. California residents have the right to know, delete and correct, and the right not to be discriminated against for using them; we don’t sell or share personal information as those laws define it. Write to privacy@sikia.dev and we’ll reply within 30 days. We may need to confirm it’s you first.

Sikia is a business tool and isn’t meant for anyone under 16. We don’t knowingly collect their data; if you believe we have, contact us and we’ll delete it.

We’ll post changes here and update the date at the top. For significant changes we’ll email account owners before they take effect.

Vivtech Solutions, Noida, Uttar Pradesh, India. Privacy questions: privacy@sikia.dev.