Privacy policy

Last updated: September 28, 2026

At Siit, we build an AI-powered service desk that helps companies handle requests from their employees, freelancers, subcontractors and end customers across IT, HR, Finance and other teams. Companies that use Siit trust us with information that matters to them and to their people, and we take that trust seriously.

This Privacy Policy explains how Siit SAS (“Siit”, “we”, “us” or “our”) collects, uses, discloses and otherwise processes personal information when you visit our websites, request a demo, sign up for or use the Siit platform, or otherwise interact with us. It also explains the choices and rights available to you. For purposes of this Privacy Policy, “personal information” means “personal data” within the meaning of the EU General Data Protection Regulation (“GDPR”). For information about how we use cookies and similar technologies, please read our Cookie Notice.

Privacy at a glance

We are a B2B platform. Organizations (“Customers”) use Siit to manage requests from their employees, freelancers, subcontractors and end customers. Customers control the content that they and the individuals they authorize to use the platform (“Users”) submit to it (“Customer Data”). We process Customer Data only on the Customer’s behalf and under its instructions (see Section 2).

Customer Data is not used to train AI models. We do not use Customer Data to train, fine-tune or improve AI models, and we do not permit our AI model providers to do so (see Section 2).

You are in control. You can ask to access, correct, delete or export your personal information, and you can opt out of marketing at any time, by contacting privacy@siit.io.

Contents

  1. Who we are and what this Policy covers
  2. Customer Data: when we act on behalf of our Customers
  3. What personal information we collect and why
  4. How long we keep your personal information
  5. How we disclose your information
  6. Your choices
  7. Your privacy rights
  8. International data transfers
  9. Security
  10. Third-party services and Google user data
  11. Changes to this Privacy Policy
  12. Contact us

1. Who we are and what this Policy covers

Who we are

Siit SAS is a French simplified joint stock company (société par actions simplifiée) with a share capital of €5,104.60, registered with the Paris Trade and Companies Register under number 905 371 035, with its registered office at 101 rue de Prony, 75017 Paris, France.

What this Policy covers

This Privacy Policy applies to the account, authentication, security, billing, website usage and business contact information that Siit processes for its own purposes, as a “controller”, namely when you:

  • visit siit.io or any other website that links to this Policy (the “Website”);
  • create an account on, sign in to, or administer a Siit workspace (the “Platform” and, together with the Website, the “Services”);
  • request a demo, subscribe to our communications, register for one of our events or webinars, or contact our sales or support teams; or
  • act on behalf of one of our Customers, prospects, partners or vendors.

What this Policy does not cover

  • Customer Data, i.e. the content submitted to or generated within a Customer’s workspace (such as requests, tickets, messages, attachments and workflow data), which Siit processes on behalf of the relevant Customer (see Section 2);
  • third-party websites, applications and integrations, which are governed by their own privacy policies (see Section 10); and
  • personal information about Siit employees and job applicants, which is covered by separate notices.

2. Customer Data: when we act on behalf of our Customers

Our Customers – for example, your employer, a company you work with as a freelancer or subcontractor, or a company whose services you use – decide who can access their Siit workspace, which tools are connected to it (for example, Slack, Microsoft Teams, Google Workspace, an identity provider or an HR information system), and what information is submitted, stored and processed through it, such as requests, tickets, messages, attachments and workflow data.

For this Customer Data, the Customer is the “controller” and Siit acts as a “processor”. We process Customer Data only to provide the Services and as otherwise instructed by the Customer, in accordance with our agreement with that Customer, including our Data Processing Agreement.

AI features. Siit’s AI Agents and other AI-powered features process Customer Data on behalf of our Customers and under their instructions, like any other Customer Data, using third-party AI model providers acting as our subprocessors. We do not use Customer Data to train, fine-tune or improve AI models, and we do not permit our AI model providers to train, fine-tune or improve AI models for their own purposes or for the benefit of other Customers. If we introduce customer-specific model training or fine-tuning in the future, we will only do so at the relevant Customer’s express request, using that Customer’s Customer Data solely to provide or improve AI features for that Customer, in accordance with its documented instructions and our agreement with that Customer. We will not use Customer Data to train, fine-tune or improve AI models for our own purposes or for the benefit of other Customers.

If you use Siit through one of our Customers and you have questions about how your information is handled, or wish to exercise your privacy rights, please contact that Customer directly. We will assist our Customers in responding to such requests as required by our agreements with them and by applicable law.

3. What personal information we collect and why

We collect personal information that directly identifies you (such as your name or email address) and information that identifies you indirectly (such as your IP address or device identifiers). The tables below summarize, for each source and category of personal information, how we use it and the legal basis on which we rely under the GDPR.

Why we rely on legitimate interests. When you use the Services as an employee, representative, freelancer, subcontractor or end customer of one of our Customers, you are generally not a party to our agreement with that Customer. We therefore rely on our legitimate interests in providing, administering and securing the Services purchased by the Customer, rather than on the performance of a contract with you. In the limited cases where you have entered into an agreement with Siit in your own name, we rely on the performance of that contract. Our legitimate interests include operating, administering and securing the Services, managing our relationships with Customers, prospects and business partners, improving the Services, promoting our Services to relevant business contacts, preventing fraud and misuse, and protecting our legal rights. Where we rely on our legitimate interests, you have the right to object on grounds relating to your particular situation (see Section 7).

Information you provide to us

When you create an account, request a demo, contact us, register for one of our events or otherwise interact with us, we collect the information below. Where we ask you to provide personal information, we indicate when the information is required. If you do not provide information that is necessary to create or administer your account, provide the Services or respond to your request, we may not be able to provide the relevant functionality or respond to you.

Categories of personal informationHow we use itLegal basis under the GDPR
Identification and contact data:
First and last name, email address, phone number, profile picture		Manage your account;
Deliver the Services and provide customer support;
Respond to your requests;
Marketing Communications (as defined below);
Organize and manage our events		Legitimate interests;
Consent, where required by law for Marketing Communications
Professional data:
Job title, company, department, company size and industry		Manage your account;
Respond to your requests;
Marketing Communications;
Organize and manage our events		Legitimate interests
Account credentials:
Login and password (stored in hashed form)		Authenticate you and secure access to the PlatformLegitimate interests (securing access to the Services)
Contract and billing information:
Subscription plan, orders, invoices, payment status and billing contact details. Payment card details are collected directly by our payment processor (Stripe); we do not store full card numbers.		Manage payments, contracts and invoices, and otherwise meet our contractual requirementsLegitimate interests (managing our contractual relationship with the Customer);
Compliance with a legal obligation (invoicing and accounting)
Communications and any other personal information you choose to provide:
Content of your emails, chat messages, support requests, feedback and survey responses; call recordings		Respond to your requests and provide customer support;
Service Improvement (as defined below)		Legitimate interests

Information we collect automatically

When you use the Website or the Platform, we automatically collect the following information through our server logs:

Categories of personal informationHow we use itLegal basis under the GDPR
Device and technical data:
IP address, type of device, operating system and browser, language settings, referring and exit pages, date and time of access, connection and error logs		Operate and secure the Services;
Prevent and investigate fraud and misuse;
Service Improvement		Legitimate interests
Usage data:
Usage metadata, such as features used, pages viewed and other interactions with the Platform. Usage data does not include the content of requests, tickets, messages or other Customer Data		Service ImprovementLegitimate interests
Approximate location data:
Country and city derived from your IP address		Secure the Services;
Service Improvement		Legitimate interests

Where we collect information through cookies and similar technologies, for example for analytics or marketing purposes, the purposes, legal basis, providers, retention periods and your choices are described in our Cookie Notice.

Information we receive from third parties

We may also receive personal information about you from the following third parties:

Categories of personal informationHow we use itLegal basis under the GDPR
Single sign-on data from your identity provider (e.g. Google, Microsoft, Slack) when you sign in with it:
Name, email address, profile picture and an authentication token, as permitted by your settings with that provider. We never receive your password for that provider.		Authenticate you;
Create and manage your account		Legitimate interests (authenticating Users and securing access to the Services)
Workspace data from the Customer that invites you to its Siit workspace:
Name, email address and, where applicable, job title and department		Manage your account;
Deliver the Services		Legitimate interests (providing the Services subscribed to by our Customer)
Integration data from the third-party applications that you or your administrator connect to Siit:
Types of integrations connected and permissions granted		Enable and maintain integrations;
Service Improvement		Legitimate interests
Business contact data from resellers, event co-organizers, marketing partners, B2B data enrichment providers and publicly available sources:
Name, job title, company, business email address		Marketing Communications;
Manage our business relationships		Legitimate interests;
Consent, where required by law

The content that Users and Customers submit to the Platform, including through integrations, is Customer Data, which we process on behalf of our Customers as described in Section 2.

Legal, security and compliance purposes. We may also process any of the personal information above for legal, security and compliance purposes (“Compliance Purposes”), namely to:

  • comply with applicable laws and regulatory requirements;
  • prevent, mitigate and investigate security incidents, fraud and any illegal or prohibited activity relating to the Services;
  • protect the rights, safety, property or operations of Siit, our Customers, you or others;
  • respond to requests from regulators, law enforcement or other public authorities, and to your privacy requests; and
  • enforce our agreements, resolve disputes and establish, exercise or defend legal claims.

Depending on the purpose, we rely on compliance with our legal obligations or on our legitimate interests in protecting the Services, preventing fraud and misuse, enforcing our agreements, and establishing, exercising or defending legal claims.

“Marketing Communications” means communications about Siit’s Services, products, features and events, such as newsletters, event invitations and product announcements, and the measurement of their effectiveness. Where you are a business contact, we send Marketing Communications on the basis of our legitimate interests where they relate to your professional role, and on the basis of your consent where required by law. You can opt out at any time (see Section 6). We do not send Marketing Communications to individuals who use the Services only as end customers of our Customers.

“Service Improvement” means analyzing how the Website and the Services are used, testing, troubleshooting, producing statistics and developing new features. Wherever possible, we use aggregated and anonymized information that no longer identifies an individual. We do not use Customer Data to train, fine-tune or improve AI models (see Section 2).

4. How long we keep your personal information

We keep personal information only for as long as necessary for the purposes described in Section 3, in accordance with applicable data protection laws and the guidance of data protection authorities. We then delete it or anonymize it so that it can no longer identify you, unless we are legally required to keep it longer (for example, for tax, accounting or audit purposes). Customer Data is retained and deleted in accordance with our agreement with the relevant Customer.

The table below summarizes the retention periods applicable to each purpose:

Purpose of processingData retention
Manage your account, deliver the Services and authenticate youFor the lifetime of your account.
Thereafter, only the information necessary to establish, exercise or defend legal claims is archived, with restricted access, for 5 years.
Connection logs: 1 year.
Provide customer supportFor the duration of the agreement with the relevant Customer. Thereafter, only the information necessary to establish, exercise or defend legal claims is archived, with restricted access, for 5 years.
Respond to your requests (contact and demo requests)3 years from the collection of your data or from your last interaction with us.
Manage payments, contracts and invoicesFor the duration of the agreement, then archived for 10 years (accounting documents).
Marketing CommunicationsProspects: 3 years from the collection of your data or from your last interaction with us (for example, a request, a reply or a click on a link in one of our emails).
Customer contacts: for the duration of the customer relationship and for 3 years thereafter.
If you opt out, we will stop using your personal information for Marketing Communications. We retain only the minimum information necessary to honor your opt-out in a suppression list for 3 years from your opt-out.
Organize and manage our eventsFor the time necessary to organize the event, then in accordance with the Marketing Communications retention period.
Service ImprovementCookies and information collected through cookies: see our Cookie Notice.
Anonymized information that no longer identifies you may be retained without a specific time limit.
Operate and secure the Services; prevent and investigate fraud and misuseSecurity logs: 1 year, unless needed for longer to investigate an incident.
Compliance PurposesAs required by applicable law or regulation, except:
Privacy requests: proof of identity deleted once your identity is verified; records of requests kept for 3 years;
In case of a dispute: until the dispute is settled;
In case of a legal claim: until the proceedings, including any appeals, have been finally resolved.

5. How we disclose your information

We disclose personal information only as described below:

  • Service providers: companies that process personal information on our behalf and under our instructions, such as hosting (Amazon Web Services), infrastructure, AI model providers, customer support, analytics, marketing automation and communication tools, including meeting recording and analysis tools (Praiz.io) and telephony and call management tools (Aircall). They are bound by contractual confidentiality and data protection obligations. Some of these service providers also act as our subprocessors when they process Customer Data on our Customers’ behalf. Our current Subprocessor List is available at https://trust.siit.io/subprocessors;
  • Professional advisers and payment providers: our lawyers, auditors, accountants and insurers, and our payment processor, which may process personal information as independent controllers, subject to their own privacy policies and professional obligations;
  • The Customer whose workspace you use: if you use the Services through a Customer’s workspace, whether as an employee, freelancer, subcontractor or end customer of that Customer, the administrators of that workspace can access information about your account and activity;
  • Integrations you authorize: when you or your administrator connect a third-party application, we share information with that application as needed to enable the integration;
  • Affiliates: companies under common control with Siit, for the purposes described in this Policy;
  • Business transfers: in connection with a merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of our assets, subject to customary confidentiality obligations;
  • Legal and safety reasons: where we believe in good faith that disclosure is necessary to comply with applicable law or legal process, respond to lawful requests from public authorities, enforce our agreements, or protect the rights, property or safety of Siit, our Customers, Users or others;
  • With your consent or at your direction.

6. Your choices

  • Marketing emails: you can unsubscribe at any time using the link in any marketing email or by contacting privacy@siit.io. We will still send you service-related messages;
  • Cookies: you can change your cookie preferences at any time via the “Cookie Settings” link in the footer of the Website. See our Cookie Notice;
  • Account information: you can update your profile in your account settings or by contacting your workspace administrator.

7. Your privacy rights

What your rights are

Subject to the conditions set out in applicable law, you have the right to:

  • access your personal information and obtain a copy of it;
  • rectify inaccurate or incomplete information;
  • erase your personal information;
  • restrict the processing of your personal information;
  • receive the personal information you provided to us in a structured, commonly used and machine-readable format, and have it transmitted to another controller (data portability);
  • object, on grounds relating to your particular situation, to processing based on our legitimate interests, and object at any time, without giving any reason, to processing for direct marketing purposes;
  • withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal; and
  • if you are in France, give instructions regarding the retention, erasure and disclosure of your personal information after your death.

You also have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the French Commission Nationale de l’Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr). You may also contact the supervisory authority of the EU Member State in which you live or work.

How to exercise your rights

To exercise any of these rights, please email privacy@siit.io or write to us at the address in Section 12. We will verify your request by matching the information you provide with the information we hold. We will only ask for proof of identity where we have reasonable doubts about your identity, and will delete it once verification is complete.

We will respond to your request without undue delay and in any event within one month of receipt. This period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we will inform you within the first month.

If your request concerns Customer Data, we will refer you to the relevant Customer and assist it as required.

8. International data transfers

Siit is based in France. The Siit Platform is hosted by Amazon Web Services in the European Union (Ireland). Some of the service providers we use for the processing described in this Privacy Policy, including certain AI model providers, are located in, or may access personal information from, countries outside the European Economic Area (“EEA”), including the United States.

Where personal information is transferred outside the EEA, we rely on a lawful transfer mechanism under the GDPR. This may include:

  • an adequacy decision adopted by the European Commission, including the EU-U.S. Data Privacy Framework where the recipient is certified; or
  • where no adequacy decision applies, appropriate safeguards such as the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), together with supplementary measures where needed.

You can obtain a copy of the relevant safeguards by contacting us as described in Section 12.

9. Security

We maintain administrative, technical and organizational safeguards designed to protect personal information, including encryption, access controls, security monitoring and vulnerability management. Siit has completed a SOC 2 Type II examination. For more information about our security program, please visit our Security page.

No method of transmission over the Internet or of electronic storage is completely secure. If we become aware of a security incident affecting your personal information, we will notify you and the competent authorities as required by applicable law.

10. Third-party services and Google user data

Our Services may contain links to, or integrate with, third-party websites and applications. We are not responsible for their privacy practices, and we encourage you to review their privacy policies. It is your responsibility (or that of your administrator) to review the permissions requested by any integration you authorize.

Google user data. Siit’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in our Services or in applicable law. We will update the “Last updated” date at the top of this Policy. Where required by applicable law, we will provide additional notice of material changes before they take effect, for example by email or through the Services.

12. Contact us

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

  • By email: privacy@siit.io;
  • By mail: Siit SAS, Attn: Privacy, 101 rue de Prony, 75017 Paris, France.