Sirius
Privacy policy
Last updated 6 October 2026. This policy completes the terms.
Who is responsible
Sirius is the controller of the personal data processed through sirius-data.tech. Contact: sirius.data.contact@gmail.com.
What Sirius processes and why
Wallet address and sign-in
- Data:
- Your wallet address and the message you sign to prove you control it. Sirius never asks for your private key or seed phrase.
- Purpose:
- Signing you in and authorising the actions you take.
- Legal basis:
- Performance of the contract (the terms).
- Retention:
- A sign-in challenge expires after 5 minutes and expired challenges are deleted. The session cookie lasts 24 hours, or until you sign out.
Account profile
- Data:
- Your wallet address, the dates of your first and latest visit, your interface settings, the guided tours you have seen, a copy of your on-chain verification status and, if an account is suspended, the date and reason.
- Purpose:
- Running your account, remembering your preferences and enforcing suspensions.
- Legal basis:
- Performance of the contract; legitimate interest in preventing abuse for suspensions.
- Retention:
- Kept while your account is active. Deleted on request, except a suspension record that is still needed to prevent abuse.
Datasets you publish
- Data:
- The listing details you enter (name, description, category, price), aggregate statistics computed inside the enclave (size, schema, completeness), the encrypted file and its wrapped key, and your model improvement choice with its date and text version. The file is encrypted in your browser before upload and decrypted only inside the training enclave: Sirius and its hosting providers cannot read its content.
- Purpose:
- Listing your dataset and running the loans and trainings you agree to.
- Legal basis:
- Performance of the contract. Use for model improvement relies on your consent, which is optional and can be withdrawn at any time.
- Retention:
- Kept until you delete the dataset. Deleting it destroys the active encryption key and removes the encrypted file from Sirius' IPFS storage; the listing record is kept for the audit ledger. Database backups may keep an older copy of the encrypted key for a limited time.
Loans and payments
- Data:
- Borrower and provider wallet addresses, amounts, transaction hashes, signed training receipts and attestations, and a reference to the delivered model.
- Purpose:
- Executing, settling and refunding loans, and publishing the audit ledger.
- Legal basis:
- Performance of the contract.
- Retention:
- Kept while the service operates, as they mirror public on-chain transactions. The off-chain copy can be deleted on request once no loan or dispute depends on it.
Dataset access records
- Data:
- For each delivered model: the wallet address, the loan, the date, the delivered model and its fingerprint (a hash, not the model itself).
- Purpose:
- Detecting and investigating dataset leaks. Visible only to Sirius administrators.
- Legal basis:
- Legitimate interest in protecting providers' data against leaks.
- Retention:
- Kept for 24 months after the access, then deleted.
Security and technical data
- Data:
- Your IP address and basic request details (address requested, browser type).
- Purpose:
- Delivering the site, limiting the request rate and preventing abuse.
- Legal basis:
- Legitimate interest in keeping the service secure.
- Retention:
- Sirius uses the IP address only in memory to limit the request rate and does not store it in its database. The hosting provider keeps request logs for a short period under its own retention rules.
Sign-in with Google (optional)
- Data:
- If you choose it, Web3Auth processes your Google account to create your wallet key. Sirius receives only the resulting wallet address. Your email may be shown in your own browser but is never sent to Sirius' servers or stored by Sirius. Web3Auth's analytics are switched off.
- Purpose:
- Giving you a wallet without a browser extension.
- Legal basis:
- Performance of the contract, at your request.
- Retention:
- Sirius stores nothing beyond your wallet address. Web3Auth keeps its own data under its privacy policy.
Wallet verification
- Data:
- An on-chain attestation that your wallet is verified: the wallet address, the verifier address and an expiry date. Sirius never writes your name or email on-chain.
- Purpose:
- Allowing verified wallets to lend and borrow, and revoking access in case of abuse.
- Legal basis:
- Performance of the contract; legitimate interest in preventing fraud.
- Retention:
- Public and permanent on the blockchain (see below). The copy in Sirius' database follows the account profile.
Messages you send us
- Data:
- Your email address and the content of your message.
- Purpose:
- Answering you.
- Legal basis:
- Legitimate interest in replying to requests.
- Retention:
- Kept as long as needed to handle your request.
Providers that process data for Sirius
- Sirius relies on the following providers, which process data only to provide their service: Vercel (web application hosting), Neon (database), Pinata (IPFS storage of encrypted files), Phala Cloud (confidential compute in Intel TDX enclaves), OVHcloud (background settlement tasks), Web3Auth (optional Google sign-in), Alchemy (blockchain node access).
- Some of them are located outside the European Union, mainly in the United States. These transfers rely on the standard contractual clauses adopted by the European Commission.
- If you buy tokens by card or bridge funds, you leave Sirius for MoonPay or Relay, which act under their own privacy policies. Sirius only passes them your wallet address and the asset requested.
- Sirius does not sell your data and does not use it for advertising.
Blockchain data is public
- Wallet addresses, transactions, loans and wallet verifications recorded on Robinhood Chain are public and permanent. Neither Sirius nor anyone else can erase or modify them, so the rights below apply only to the data Sirius holds off-chain.
- Sirius never writes names or email addresses on-chain.
Cookies and browser storage
- Sirius uses only strictly necessary cookies: sirius_session, which keeps you signed in for 24 hours, and sirius_preview, which gives the team access to the site before it opens to the public and lasts 7 days.
- Your browser also stores, on your device only, your interface preferences, your choice of wallet and the status of a transaction in progress. If you sign in with Google, Web3Auth keeps its session in your browser storage.
- Sirius uses no analytics, advertising or tracking cookies. That is why there is no consent banner.
Your rights
- You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. Where processing relies on your consent, you can withdraw it at any time.
- To exercise these rights, write to sirius.data.contact@gmail.com from an address you control. Sirius may ask you to sign a message with your wallet to confirm that the data is yours.
- You can also lodge a complaint with the CNIL (cnil.fr), the French data protection authority, or with the authority of your country of residence.
Changes and contact
This policy may change. The date above shows the last update. Questions about it: sirius.data.contact@gmail.com.