This Policy governs our relationship with you as our direct customer — a Relying Party or Portal User. It does not cover how your end-users' data is processed through the platform; that is governed by the Data Processing Agreement, and by the App Privacy Policy we provide to your end-users.
1. Introduction
1.1 We are Seventh Sense Artificial Intelligence Private Limited, a company incorporated in Singapore with our registered office at 36 Robinson Road, #20-01, Singapore 068877 (“Seventh Sense AI”, “we”, “us” or “our”).
1.2 This Privacy Policy and Notice (“Policy”) explains how we collect, use, store, and protect personal data when you — as a Relying Party (“RP”) or Portal User — register for, access, and use the SenseCrypt Authenticator SaaS Portal (“Portal”). This Policy governs our relationship with you as our direct customer.
1.3 This Policy does not cover how your end-users' personal data is processed through the platform. As between you and us, that processing is governed by the Data Processing Agreement (“DPA”), under which we act as your data processor. Separately, we provide your end-users with the SenseCrypt Authenticator Privacy Policy (the “App Privacy Policy”), which describes our own processing of their data in operating the App. You remain the data controller for your end-users and are responsible for providing them with your own privacy notice covering your use of SenseCrypt Authenticator.
1.4 By registering for and using the Portal, you acknowledge that you have read and understood this Policy. If you do not agree, you must cease using the Portal and delete your account.
2. Legal and regulatory framework
2.1 This Policy has been adopted in accordance with our obligations under applicable privacy and data protection law, including:
- EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”);
- UK General Data Protection Regulation and UK Data Protection Act 2018 (“UK GDPR”);
- Singapore Personal Data Protection Act 2012 (“PDPA”);
- California Consumer Privacy Act 2018 as amended by the California Privacy Rights Act 2020 (“CCPA/CPRA”), for California residents; and
- Other applicable national and regional data protection laws.
3. Our role
3.1 For personal data we collect directly from you as a Portal User or RP — your account credentials, contact details, billing information, and usage data — we act as the data controller. This Policy governs that processing.
3.2 For personal data belonging to your end-users that is processed through the SenseCrypt Authenticator platform on your behalf, we act as data processor only. That processing is governed by the DPA, not this Policy.
3.3 This dual-role structure is consistent with how leading CIAM and IdP providers operate. Your responsibilities as data controller for your end-users are set out in the DPA and our Terms of Service.
4. Personal data we collect
4.1 We collect the following categories of personal data from you as a Portal User or RP in connection with your use of the Portal:
A. Account, identity, and administrator data
Each customer account is owned by an account owner and may contain one or more tenants (each tenant being an isolated authentication environment with its own OIDC issuer and subdomain). The account owner may invite additional administrators (“sub-admins”) and assign them tenant-scoped roles. We process personal data for each of these administrator principals:
| Data element | How it is collected / used | Retention |
|---|---|---|
| Account owner — name, email, company, password hash | Collected at Portal registration. Password stored as an Argon2id hash only. Used to identify and authenticate the account owner. | Until the account is deleted. |
| Invited sub-admin — email address | Provided by the account owner or an authorised admin to send an invitation. Used to deliver the invite and identify the member. | Until the member is removed or the account is deleted. |
| Invite token | Single-use token generated to allow an invited member to join. Expires on first use or after TTL. | Consumed on first use or expired. |
| Sub-admin password hash | Set by the invited member when they accept. Stored as an Argon2id hash only. | Until the member is removed or the account is deleted. |
| Per-tenant role assignments (RBAC) | Console roles granted to each administrator, scoped per tenant. Used for access control across the tenants in the account. | Until the role is revoked, the member is removed, or the account is deleted. |
| Admin session data | Portal session JWT (HS256, TTL 1 800 s). Stateless — not persisted server-side. | Expires automatically. |
| Email verification token | Generated at registration for email verification. Single-use. | Consumed on first use or expired after TTL. |
Tenant structure (name, OIDC issuer, subdomain) is configuration data associated with your account rather than personal data, and is retained until the tenant or account is deleted.
B. Application and configuration data
| Data element | How it is collected / used | Retention |
|---|---|---|
| OAuth client credentials (client_id, client_secret_hash) | Generated when you register an OIDC or SAML application on the Portal. Used to authenticate your RP application with the SenseCrypt Authenticator IdP. | Until the client is revoked or your account is deleted. |
| SAML configuration (entity ID, ACS URL, certificate) | Provided by you when configuring a SAML application. Used to establish SAML federation. | Until the SAML application is deleted or your account is deleted. |
| Redirect URIs and allowed origins | Provided by you when configuring an application. Used for OAuth security validation. | Until updated or your account is deleted. |
| Branding configuration (logo, colours, app name) | Provided by you to customise the sign-in experience for your end-users. | Until updated or your account is deleted. |
| Self sign-up settings | Configured by you to enable or disable consumer self-registration for your application, including the privacy policy URL and ToS URL you specify for your end-users. | Until updated or your account is deleted. |
| SCIM provisioning tokens | Generated when you enable SCIM directory provisioning. Used to authenticate directory sync from your identity provider (for example, Azure AD or Okta). End-user directory data synced via SCIM is processed on your behalf under the Data Processing Agreement. | Until the token is revoked or your account is deleted. |
| Machine-to-machine (M2M) client credentials | Generated when you create an M2M application for server-to-server API access. Used to authenticate automated API clients. | Until the client is revoked or your account is deleted. |
C. Usage and billing data
| Data element | How it is collected / used | Retention |
|---|---|---|
| Usage data (authentication and active-user counts) | Automatically recorded to operate the service and, where you subscribe to a paid plan, to calculate your invoice. Visible on your Portal overview. | Retained for the period required for billing and applicable financial and tax law. |
| Billing and payment information | Where you subscribe to a paid plan, payment is processed by our payment processor (Stripe). Card numbers and security codes are handled by the payment processor directly and are not stored by us. We retain a payment reference and transaction records. | Retained for the period required by applicable financial and tax law. |
Pricing and plan terms are set out in your order form or the Terms of Service, not in this Policy.
D. Technical and security data
| Data element | How it is collected / used | Retention |
|---|---|---|
| Portal login events | Recorded for security monitoring and fraud prevention. | Up to 90 days. |
| reCAPTCHA Enterprise signals | Collected by Google reCAPTCHA Enterprise during Portal sign-up and admin actions to verify you are a human user. Processed by Google. | Per Google's privacy policy. |
| API usage logs (rate limit tracking) | Request counts tracked per API key to enforce rate limits. | Up to 30 days. |
| Certificate expiry data | SAML signing certificate expiry dates tracked to generate renewal reminders. | Until certificate is renewed or application is deleted. |
5. How we use your personal data
We process your personal data only for the purposes below:
| Purpose | Data categories | Legal basis (GDPR) |
|---|---|---|
| Account, administrator, and tenant management | Owner and sub-admin name/email, password hashes, invite tokens, per-tenant roles, session data | Art. 6(1)(b) — Performance of contract |
| Application and OIDC/SAML/SCIM/M2M client management | OAuth/SAML credentials, SCIM and M2M tokens, redirect URIs, branding, self sign-up settings | Art. 6(1)(b) — Performance of contract |
| Usage measurement and billing | Authentication and active-user counts; payment reference and transaction records | Art. 6(1)(b) — Performance of contract; Art. 6(1)(c) — Legal obligation (financial records) |
| Service communications (account verification, certificate expiry reminders, security alerts) | Email address | Art. 6(1)(b) — Performance of contract |
| Security and fraud prevention (reCAPTCHA, rate limiting, login event monitoring) | reCAPTCHA signals, API logs, login events | Art. 6(1)(f) — Legitimate interests |
| Compliance with legal obligations | Minimum data as required by law | Art. 6(1)(c) — Legal obligation |
| Corporate transactions (merger, acquisition, restructuring) | Account data as described in this Policy | Art. 6(1)(f) — Legitimate interests, subject to prior notice |
CCPA/CPRA (California residents): we do not sell personal information and do not share personal information for cross-context behavioural advertising.
PDPA (Singapore residents): we collect, use, and disclose personal data for the purposes described in this Policy.
6. Your responsibilities as data controller
6.1 When you use the SenseCrypt Authenticator platform to authenticate your end-users, you are the data controller for those end-users' personal data. You are solely responsible for:
- Providing your end-users with a privacy notice that accurately describes the processing carried out through SenseCrypt Authenticator, including the URL you register in the Portal's self sign-up settings;
- Obtaining valid consent or establishing another lawful basis for processing your end-users' personal data, including biometric data where applicable;
- Fulfilling data subject rights requests from your end-users; and
- Ensuring your use of the platform complies with all applicable data protection laws in the jurisdictions in which you operate.
6.2 Self sign-up disabled. If self sign-up is disabled, your users are provisioned by you — invited by an administrator or synced from your directory. The legal basis for processing is established through your existing relationship with them, for example an employment or service agreement, and no separate consent notice is collected through the App at registration.
6.3 Self sign-up enabled. If you enable self sign-up, your end-users register themselves through the App. You must provide a privacy notice and terms of service and register those URLs in your self sign-up settings, so they are shown to the user at the consent step. This applies whether those end-users are employees or consumers — enabling self sign-up is the trigger for the notice, not whether the users are workforce or consumer. Seventh Sense AI displays those links and records acceptance on your behalf during the self sign-up flow.
6.4 We are a technology services provider. We cannot provide legal advice to assist your compliance efforts. If you are unsure of your obligations as data controller, seek competent legal advice.
7. Third-party service providers
7.1 We engage the following third-party service providers in connection with the Portal. Each is bound by appropriate data processing agreements.
| Provider | Service | Data involved | Location |
|---|---|---|---|
| Amazon Web Services — Simple Email Service (SES) | Transactional email — account verification, certificate expiry reminders, security alerts | Your email address. No end-user biometric data. | European Union |
| Stripe Inc. | Payment processing and billing | Payment reference and transaction records. Card numbers and security codes are processed by Stripe directly and not stored by SSAI. | United States |
| Google LLC — reCAPTCHA Enterprise | Bot and fraud prevention on Portal sign-up and admin actions | Device and behavioural signals. Governed by Google's privacy policy. | United States / Global |
7.2 The Portal does not use any analytics or crash-reporting SDKs. We do not share your personal data with third parties for advertising or data brokerage purposes. We do not sell personal data.
7.3 In the event of a corporate transaction (merger, acquisition, sale of assets), personal data may transfer to a successor entity. We will provide notice before data becomes subject to a materially different privacy policy.
7.4 We may disclose personal data where required by law, court order, or governmental authority.
8. Cross-border data transfers
8.1 Our Portal infrastructure is hosted on Amazon Web Services (AWS) in the European Union ([specify region — e.g. eu-central-1, Frankfurt]). Your personal data is processed and stored in the EU, including transactional email via Amazon SES. Certain limited data is also processed by sub-processors in the United States (Stripe for payments; Google reCAPTCHA Enterprise for bot prevention).
8.2 Where personal data is transferred from the EEA or UK to a country without an equivalent level of protection, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. For UK transfers we rely on the UK International Data Transfer Agreement (IDTA). For Singapore transfers we rely on contractual provisions consistent with PDPA transfer-limitation obligations.
8.3 You may request a copy of the relevant transfer mechanism by contacting dpo@seventhsense.ai.
9. Data retention
We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy or as required by applicable law.
| Data type | Retention period |
|---|---|
| Portal account data (name, email, company, password hash) | Until you delete your Portal account. |
| OAuth / SAML application credentials and configuration | Until the application is deleted or your account is deleted. |
| Usage data (authentication and active-user counts) | Retained for the period required for billing and applicable financial and tax law. |
| Billing and transaction records | Retained for the period required by applicable financial and tax law. |
| Portal session JWT | 1 800 seconds (30 minutes). Stateless — not persisted. |
| Portal login events | Up to 90 days. |
| API usage logs | Up to 30 days. |
| reCAPTCHA signals | Per Google's privacy policy. |
| Email verification tokens | Consumed on first use or expired after TTL. |
The account owner may delete the account at any time from within the Portal settings, which triggers deletion of account data, administrator records, tenant configurations, application credentials, and associated tokens. Individual sub-admins may be removed by an authorised administrator without deleting the account. Billing and usage records required by law are retained for the legally required period after deletion.
10. Security
10.1 We implement appropriate technical and organisational measures to protect your personal data, including:
- Argon2id hashing for Portal User password storage;
- HS256 signed Portal session JWTs with a distinct key from the OIDC signing key;
- TLS 1.2 or higher for all data in transit;
- reCAPTCHA Enterprise on Portal sign-up and admin actions to prevent bot-driven account creation; and
- Rate limiting on Portal and API endpoints.
10.2 We have procedures in place to detect, investigate, and report personal data breaches. Where required by law we will notify you and, where required, the relevant supervisory authority within the legally required timeframe.
11. Your rights
Subject to applicable law, you have the following rights in relation to your personal data:
| Right | How to exercise |
|---|---|
| Right of access | Contact dpo@seventhsense.ai. We will respond within 30 calendar days. |
| Right to rectification | Update your account details directly in Portal settings. |
| Right to erasure | Delete your Portal account from within Portal settings. Billing records required by law are retained for the legally required period. |
| Right to restriction of processing | Contact dpo@seventhsense.ai. |
| Right to data portability | Contact dpo@seventhsense.ai. We will provide data in a structured, machine-readable format where technically feasible. |
| Right to object | Contact dpo@seventhsense.ai. |
| CCPA/CPRA rights (California residents) | Right to know, delete, correct, and limit use of sensitive personal information. Contact dpo@seventhsense.ai. |
| PDPA rights (Singapore residents) | Right to access and correct personal data. Contact dpo@seventhsense.ai. |
We aim to acknowledge all requests within 5 business days and respond fully within 30 calendar days. We may extend this by up to 60 days for complex requests and will notify you of any extension.
12. Cookies
The Portal uses a signed HTTP-only cookie for session management (HS256 JWT, TTL 1 800 s). This is a strictly necessary cookie required for Portal login and cannot be disabled without preventing Portal access. Google reCAPTCHA Enterprise may set cookies during sign-up and admin actions. The Portal does not use analytics cookies.
13. Children's privacy
The Portal is intended for business users and is not directed to children under the age of 16. We do not knowingly collect personal data from children.
14. Changes to this privacy policy
We may update this Policy from time to time. When we make material changes we will notify you by email to your registered Portal address and update the Effective Date. Continued use of the Portal after a revised Policy comes into effect constitutes acceptance of the changes.
15. Contact information and complaints
For any queries, rights requests, or complaints, please contact our Data Protection Officer:
Seventh Sense Artificial Intelligence Private Limited
36 Robinson Road, #20-01, Singapore 068877
Email: dpo@seventhsense.ai | Website: www.seventhsense.ai
- EEA and UK Users: you may lodge a complaint with your local supervisory authority. The UK supervisory authority is the ICO at ico.org.uk (telephone: 0303 123 1113).
- Singapore Users: you may lodge a complaint with the PDPC at pdpc.gov.sg.
- California Users: you may contact the CPPA at cppa.ca.gov or email dpo@seventhsense.ai.