1. The short version
This Privacy Policy explains what personal information Siren collects, why, and what you can do about it. It applies to mysiren.ai, app.mysiren.ai, api.mysiren.ai, and every other endpoint we operate (the "Service").
We are Siren Ai, Inc., a Delaware corporation. For data-protection purposes under the EU General Data Protection Regulation (GDPR) and the UK GDPR, Siren Ai, Inc. is the data controller for information we collect about you as a customer, and a data processor for content you submit into the Service on behalf of your own end users.
2. Who we are
Siren Ai, Inc. is a Delaware corporation. You can reach our privacy function at [email protected]. This mailbox is monitored for data-subject requests and for GDPR Article 15–22 requests in particular.
3. What we collect
Information you give us directly
- Account data. Your email, name (if provided), and a bcrypt-hashed copy of your password. If you sign in via Google, Nexus, or X, we additionally store the provider name, a stable provider user ID, and whether the provider verified your email.
- Workspace data. Workspace name, slug, plan, and your role in it.
- Brand DNA. The archetype you select, custom voice profile (if any), colors, fonts, tagline, banned topics, banned words, required disclaimers, and any logos or mascot images you upload.
- Pipeline input. Briefs you type, channels and asset types you select, and any structured extra context you pass in.
- Connected accounts. OAuth access and refresh tokens from platforms you connect for posting (X, LinkedIn, Instagram, YouTube, TikTok, Facebook, and others we add). Tokens are stored encrypted at rest.
- Billing details. We collect the billing contact information and payment-method reference returned by Stripe; we do not see or store your full card number.
- Support communication. Emails or messages you send us.
Information we generate while delivering the Service
- Pipeline runs. Each generation creates a record with the brief, channel, asset type, status, generated copy, Reasoner score, verdict, flags, and a URL to the rendered asset.
- Rendered assets. PNGs and MP4s produced by the rendering pipeline, stored in Cloudflare R2 under a workspace-partitioned key.
- Brand Memory embeddings. For approved outputs meeting a quality threshold, we compute and store vector embeddings using a local model running on Siren's own infrastructure (no third-party embeddings API) so future generations inside the same workspace can retrieve similar winning copy as cached prompt context. Embeddings are scoped to a single workspace and never cross-pollinate between workspaces.
- Posting records. When you dispatch an approved run to a connected account, we record the platform, external post identifier, timestamp, and any error message returned.
- Session tokens. JWT access tokens (short-lived) and hashed refresh tokens (long-lived) associated with your login sessions, plus the user-agent and IP on which each refresh token was issued.
Information we collect automatically
- Request metadata. IP address, user-agent, referrer, and the path and timestamp of each request to the Service. We use this for security, rate-limiting, and debugging. When you arrive through a creator's link, we keep a one-way hash of your IP for 30 days so the creator is credited if you sign up later.
- Error telemetry. When the application encounters an error, we send a stack trace and request metadata to Sentry, with personal identifiers redacted where possible (
send_default_pii=False). - Cookies. Essential cookies keep you signed in. Advertising cookies from Meta and X are set only with your consent. See our Cookie Policy.
Information we receive from third parties
- OAuth providers. Your verified email, provider user ID, display name, and avatar (where shared), per the scopes you approve.
- Payment processor. Confirmation of payment method, last four digits of the card, billing country, and subscription status from Stripe.
4. How we use it
- Deliver the Service. Authenticate you, show your workspace, route your briefs to the pipeline, render assets, post when you ask, and show results.
- Improve the Service. Understand which channels and asset types are used, which bricks of the product need attention, which errors need fixing. This uses aggregated product telemetry, not the content of your briefs.
- Security. Detect and prevent fraud, abuse, and unauthorised access; enforce rate limits; investigate incidents.
- Billing. Process subscriptions, collect taxes, send invoices and receipts.
- Communication. Transactional messages (password resets, security alerts, billing confirmations, service updates that affect you). We will only send product-marketing email if you opt in, and you can opt out at any time.
- Legal. Respond to lawful requests, comply with applicable law, enforce our Terms, and protect rights and safety.
What we never do: we do not sell your personal data, and we do not share Your Content with any third party for AI training. With your cookie consent, we share limited ad-measurement data with Meta and X (see "Advertising measurement" below). We may use Your Content to improve Siren's own AI models. Opt-out lives in your account at /app/settings → "Privacy & Data". See Section 13 for the full training-data position.
Advertising measurement. If you accept our cookie banner, the Meta pixel and the X pixel tell us which ads brought you to Siren. A signup can send X a Sign up event in the browser. If you then pay, our server sends Meta a purchase event with a SHA-256 hash of your email, a hash of your workspace id, Meta's cookie ids, the amount and the currency. No briefs, content or card details. This lets us measure our ads and show them to people likely to find Siren useful. Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with "Cookie settings" in the footer, and we honour Global Privacy Control.
5. Legal bases (GDPR)
If you are in the UK, European Economic Area, or Switzerland, we rely on the following lawful bases under Article 6 of the GDPR:
- Performance of a contract (Art. 6(1)(b)). Delivering the Service you've subscribed to, authenticating you, processing briefs, rendering and posting assets.
- Legal obligation (Art. 6(1)(c)). Tax records, retained billing documents, responding to lawful orders.
- Legitimate interests (Art. 6(1)(f)). Operating and improving the Service, preventing fraud and abuse, security monitoring via Sentry, and understanding aggregated product usage. We balance these interests against your rights; where they would outweigh ours, we don't rely on this basis.
- Consent (Art. 6(1)(a)). For product-marketing email, and for advertising cookies and the ad measurement described above. You can withdraw consent at any time.
7. Data retention
We retain personal data only for as long as necessary to fulfil the purpose it was collected for, plus a reasonable buffer for back-up rotation and regulatory compliance.
- Active workspace data. Retained for the life of the workspace and up to 30 days after deletion/termination to allow recovery or export.
- Pipeline runs & rendered assets. Retained with the workspace; deleted when the workspace is deleted. Plan-specific caps may evict older assets sooner; see the relevant plan page.
- Brand Memory embeddings. Retained with the workspace; you can request selective erasure at any time.
- OAuth tokens. Retained until you disconnect the account or the provider revokes the token.
- Session & refresh tokens. Refresh tokens: 30 days. Revoked on logout or on password change.
- Billing records. Retained as required by tax and accounting law (typically 7 years in most jurisdictions we operate).
- Backups. Rotated out within 90 days.
- Support and refund records. The requester address on a support thread, and the actor address on a refund, are kept after account deletion as an audit trail. We rely on the statutory-records and legal-claims exemptions (GDPR Art. 17(3)(b) and (e)) and never use these addresses to contact you.
8. Your rights
Depending on where you live, you may have some or all of the following rights:
- Access. A copy of the personal data we hold about you.
- Rectification. Correction of inaccurate or incomplete data.
- Erasure ("right to be forgotten"). Deletion, subject to our need to retain certain records for legal or legitimate-interest reasons.
- Portability. A machine-readable copy of the data you provided us, where processed by consent or contract and by automated means.
- Restriction. Pause processing while a dispute is resolved.
- Objection. Object to processing based on legitimate interests; we will stop unless we have a compelling overriding ground or it's needed for a legal claim.
- Withdraw consent. Withdraw any consent at any time without affecting past processing.
- Automated decision-making. We do not make decisions that produce legal or similarly significant effects on you solely by automated means.
- Complaint. Lodge a complaint with your local data-protection authority.
9. How to exercise your rights
Email [email protected] from the address on your account, stating the right you want to exercise. We may ask for additional verification to make sure we're responding to you, not to an impersonator. We aim to respond within 30 days (60 for complex requests, with notice to you of the extension), free of charge. We will tell you if we cannot fulfil a request and why.
For straightforward requests (export, account deletion), we are building self-serve tooling in the dashboard. Until that ships, email is the authoritative channel.
10. Data security
We take appropriate technical and organisational measures to protect personal data, including:
- TLS 1.2+ in transit for every public endpoint, enforced via Let's Encrypt certificates and HSTS.
- Passwords stored as bcrypt hashes (never in plaintext); OAuth tokens encrypted at rest with Fernet.
- Short-lived JWT access tokens (1 hour) with revocable refresh tokens; logout revokes the refresh chain.
- Role-based workspace membership; tokens never grant cross-workspace access.
- Workspace-partitioned storage keys in R2 so a credential scoped to one workspace cannot read another.
- privacy.sections.security.bullets.b6
- Principle of least privilege for infrastructure access; audit logs on administrative actions.
No security program is perfect. If we learn of an incident that materially affects you, we will notify you without undue delay, consistent with Article 33–34 of the GDPR and applicable breach-notification laws.
11. International transfers
Your personal data may be transferred to and processed in countries outside your home country, including the United States. Where we transfer personal data out of the UK, EEA, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and additional technical measures where required. Contact [email protected] for a copy of the safeguards in place for a specific transfer.
12. Children's privacy
Siren is not directed at children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has submitted data to us, please contact us and we will delete it.
13. AI-specific disclosures
Training data. Opt-out controlled
When we send your briefs and related workspace context to our AI model provider, we are sending them through a paid API whose terms specify that submitted content is not used to train the provider's foundation models. That's per their public terms, not something we control. Brand Memory embeddings are computed by a local model on Siren's own infrastructure and are never sent to any third party.
For Siren's own models: by default, your briefs, generated SirenSeeds, renders, and outcome signals may be incorporated into a training corpus that we use to fine-tune our Reasoner and quality scorer. The corpus stays inside Siren. We never share it with third parties for their training, and we never sell it.
You can opt out anytime in your account at app.mysiren.ai/app/settings under "Privacy & Data". Opting out excludes your future content from any Siren training corpus. It does not affect your existing renders, your subscription, your features, or your quotas. Only the training-data flow.
What is persisted
Your briefs and the resulting outputs are stored in our database so you can view past campaigns and so the pipeline can run. For outputs that pass the Reasoner's quality threshold, we compute vector embeddings and store them in a workspace-scoped Brand Memory index, so future prompts in the same workspace can retrieve similar past winners as cached context. Brand Memory entries never leave a workspace's index.
Automated decision-making
The Reasoner assigns an impact_score (0–100), an angle label, and a verdict (approved / flagged / rejected) to every generation. Rejected runs are not published; flagged runs surface with a warning for human review. This is a quality filter for your own content, not a decision that produces legal or similarly significant effects on an individual in the sense of GDPR Article 22. You always remain in control of whether to publish.
Right to meaningful information
If a Reasoner verdict surprises you, email us and we will explain the flagged criteria and, where possible, the aspects of the brief or output that triggered them.
Quality scoring
Generated content is scored by the Reasoner for brand fit (impact score, angle label, flags) before it reaches your queue. Scores are advisory. Your content is used to produce your report; it is never sent to any social platform for scoring and is never used to train public models without your settings allowing it.
Quality scores are heuristics. They inform your posting decision but never replace your judgment. You always remain in control of whether to publish.
14. California residents
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you specific rights regarding personal information we collect about you:
- Right to know. Categories and specific pieces of personal information we have collected about you, where it came from, why we have it, and with whom we've shared it.
- Right to delete personal information, subject to exceptions.
- Right to correct inaccurate personal information.
- Right to limit use of sensitive personal information to what is necessary to provide the Service.
- Right to opt out of "sale" or "sharing" of personal information. We do not sell personal information. If you accept advertising cookies, we "share" limited identifiers with Meta and X for cross-context behavioural advertising as the CPRA defines it. Decline the banner, withdraw in "Cookie settings", or send Global Privacy Control, and we stop.
- Right to non-discrimination. We will not deny service, charge different prices, or provide a different quality of service because you exercised a right.
To exercise these rights, email [email protected].
Global Privacy Control. We honour GPC as a valid opt-out of sharing. When your browser sends it, the Meta pixel and the X pixel do not load and no purchase event is sent to Meta.
Shine the Light. Under California Civil Code Section 1798.83, California residents may request the names of third parties to which we disclosed personal information for those parties' own direct-marketing purposes during the preceding calendar year. We do not make such disclosures. If you wish to confirm, email [email protected] with the subject line "Shine the Light Request", your full name, and certification that you are a California resident.
15. Other US states
Residents of Colorado, Connecticut, Virginia, Texas, Oregon, Montana, and other states with comprehensive consumer-privacy laws may have some or all of the following rights under those laws: to access, correct, or delete personal data; to obtain a portable copy; to opt out of the sale of personal data, targeted advertising, or certain profiling; and to appeal a decision we make on a request. We do not sell personal data. We process limited data for targeted advertising only with your consent, and you can opt out at any time by declining or withdrawing ad cookies or by sending Global Privacy Control. We do not profile you in ways that produce legal or similarly significant effects.
Appeals
If we decline to act on a privacy request, you may appeal by replying to our response (or emailing [email protected]) with "Appeal" in the subject line. We will review the decision and respond within the timeframe your state's law requires (60 days at most).
Authorised agents
You may use an authorised agent to submit a request on your behalf. We may ask the agent for proof of your written permission and may ask you to verify your identity directly before we act.
Nevada
Nevada residents have the right under NRS Chapter 603A to opt out of the sale of certain covered information. We do not sell covered information. You may register a preference for the future at [email protected].
16. Changes to this policy
We may update this Privacy Policy as the Service evolves. For material changes (new categories of data, new subprocessors, new purposes of use), we will give affected customers at least 30 days' email notice. The "last updated" timestamp at the top of this page is authoritative.
17. Contact
Privacy questions, data-subject requests, or concerns: [email protected]
Security reports: [email protected]
Post: Siren Ai, Inc., 2810 N Church St STE 89663, Wilmington, DE 19802, USA