This Privacy Policy explains how SAGEA ("SAGEA", "we", "us", "our") collects, uses, and protects information in connection with its websites, APIs, SDKs, models, enterprise systems, and infrastructure services (collectively, the "Services").
This Policy applies to SAGEA as a company-level framework. Product-specific privacy terms (including Helios deployments) may provide additional detail, granular configuration, and sovereign control options.
Scope of This Policy
This Privacy Policy applies to our complete corporate and system framework:
- SAGEA websites and developer platforms
- Hosted APIs and inference services
- Enterprise infrastructure deployments
- Research and experimental systems
- SDKs and developer software tools
- Model and AI-based systems
- Administrative, billing, and support systems
Certain products, including our Helios identity infrastructure, may operate under separate or additional privacy documentation depending on deployment type and customer configuration.
Data Classification Model
To guarantee maximum isolation and privacy credibility, SAGEA distinguishes strictly between three categories of processed data:
Customer Data
Data submitted by customers or processed on their behalf through the Services.
- API prompts & inputs
- Application payloads
- Enterprise files
- System logs
- Config profiles
End-User Data
Data belonging to individuals interacting with customer systems powered by SAGEA.
- Identity verification documents
- Biometric session media
- Onboarding records
- Helios KYC payloads
Operational Data
Data generated by SAGEA systems strictly for reliability, health, and security.
- API request metadata
- System latency & loads
- Diagnostic error traces
- Abuse detection signals
On-Premises Deployments
For on-premises, customer-hosted, or isolated private cloud deployments:
Sovereign Isolation Commitments
Zero Remote Extraction: All Customer Data and End-User Data remain entirely within the customer's physical or logically controlled cloud infrastructure. SAGEA does not collect, access, transfer, or store data from these environments.
No Document Retention: SAGEA does not retain, extract, or mirror biometric details, physical ID scans, or user verification databases processed locally on-prem.
No Remote Visibility: SAGEA maintains zero telemetry, remote log ports, or backdoor visibility into customer production environments after isolated deployment.
Customer Custodianship
Customers retain sole, absolute ownership and responsibility for data storage, retention schedules, privacy policies, statutory compliance obligations, administrative access logs, and overall security configurations.
API and Hosted Services
For SAGEA-managed hosted infrastructure, cloud pipelines, and multi-tenant APIs:
4.1 Customer Data Processing
SAGEA processes Customer Data strictly on behalf of the customer, and solely as necessary to:
- Provide requested model inference, speech synthesis, and verification functions.
- Operate, scale, maintain, and balance our shared hosted clusters.
- Secure platform reliability, trace critical server crashes, and isolate malicious payloads.
4.2 Operational Data Collection
SAGEA may collect limited Operational Data to secure, balance, and maintain the reliability of the hosted infrastructure, including:
- Inbound request timestamps, API payload sizing, and execution latency.
- Platform error codes, non-identifiable system traces, and cluster performance logs.
- Aggregated API usage indices and rate limit analytics.
- Anti-abuse logs and fraud prevention signals.
Strict Data Non-Retention Policy (End-User Data)
SAGEA implements a strict non-retention posture for End-User Data submitted through our Services, unless explicitly instructed otherwise under customer configurations:
* Exceptions apply only to short-lived transient requests required to execute the operational call, legal retention warrants served by sovereign authorities, or customer-configured secure storage in custom enterprise plans.
No Training on Customer or End-User Data
Strict Model Training Isolation Commitment
SAGEA implements a zero-trust architecture regarding general-purpose model tuning:
SAGEA DOES NOT use Customer Data or End-User Data to train foundation models, refine parameter weights, or improve general-purpose AI systems without explicit, signed, written consent.
This strict isolation applies to:
- •Prompts & Inputs
- •API Payload extractions
- •Identity document uploads
- •Verification session media
- •Enterprise customized datasets
Operational Data (metadata, request frequency, infrastructure latencies) may be analyzed in aggregated and anonymized form strictly to improve system reliability, balance workloads, and optimize inferencing engine performance.
Data Use Principles
SAGEA processes all data categories under a strict system design containing five core principles:
We process only the exact volume of data mathematically required to complete the specific Services.
We process data solely for the explicit delivery of the requested operations, with zero secondary repurposing.
Customer data databases, caches, and inferences are isolated logially and run in distinct virtual workloads.
SAGEA does not sell, lease, or commercially exploit personal information, biometrics, or company data.
We provide enterprise customers with maximum tools to control log visibilities and on-premises isolations.
Data Retention
SAGEA's data retention intervals depend strictly on the selected deployment model and contractual agreements:
Operational Data (diagnostic logs, metadata) may be retained for limited administrative windows (typically 30 days) strictly for debugging, crash analytics, and fraud monitoring. Customer Data is retained strictly during the active service execution window and deleted immediately thereafter.
Retention parameters are entirely governed by the customer's administrative settings and SLA contracts. SAGEA does not override or delay custom, customer-defined retention and automatic deletion policies.
SAGEA does not collect, host, or possess physical custody over on-premises processing databases, and thus maintains zero retention capacity.
Security
SAGEA implements rigorous, commercially reasonable technical and organizational security controls designed to guard system integrites, including:
While we utilize high-end protective layouts, no system can guarantee absolute safety. We encourage developers to manage and secure their own API credentials with extreme care.
International Data Processing
Depending on customer configuration, data residency choices, and SLA requirements, SAGEA may process and store hosted data in different geographic regions.
Enterprise customers are responsible for selecting the appropriate region and ensuring full compliance with applicable cross-border data transfer laws when routing queries to SAGEA.
Customer Responsibilities
When integrating SAGEA Services, enterprise customers remain the sole data controllers under many privacy jurisdictions and are responsible for:
- Obtaining lawful, explicit consents from End-Users where biometrics or document processing are required.
- Ensuring a valid legal basis for all submitted data and identity payloads.
- Providing clear, complete, and legally compliant privacy disclosures directly to their users.
- Configuring SAGEA data retention intervals and deployment models appropriately for their industry standard compliance.
- Securing all local systems, network endpoints, developer credentials, and API access tokens.
SAGEA acts strictly as a data processor for Customer Data in all applicable contexts.
Children’s Data
SAGEA Services are not intended for direct use by children under applicable legal age thresholds (such as 14 years old under local Nepalese privacy mandates) unless integrated within regulated institutional environments by authorized, vetted enterprise customers.
Changes to This Policy
SAGEA may update this Privacy Policy from time to time.
Updated versions will be published on SAGEA's legal pages and become effective immediately upon posting. Your continued use of the Services after changes are published constitutes acceptance of the revised policy.
Contact
For legal, enterprise compliance, and security inquiries related to our Privacy Policy: