Privacy Policy

Introduction

Welcome to SemanticFed ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and the SemanticFed data federation platform (collectively, the "Platform").

By using SemanticFed, you consent to the data practices described in this policy. If you do not agree with our policies and practices, please do not use our Platform.

Information We Collect

Account & Profile Information

• • Account Information: Name, work email address, and authentication credentials
• • Organization Information: Company name, team and workspace membership, and role
• • Billing Information: Billing contact and payment identifiers, processed by our payment providers (we do not store full card numbers)
• • Source Connection Settings: The configuration and scoped credentials you provide to connect your own data sources

Usage Information

• • Service Usage: Queries you run, models you define, and how you use the platform — used to operate, secure, and improve the service
• • Device & Log Data: Browser type, operating system, IP address, and request logs
• • Support Communications: Messages you send us and support interactions
• • Your source data: SemanticFed queries data in your connected source systems in place. We process query results to return answers to you and do not take custody of, or copy by default, the underlying data in those systems.

How We Use Your Information

• • Service Delivery: To operate the platform and resolve your queries across your connected sources
• • Billing: To process subscriptions and payments securely
• • Communication: To send service updates, security notices, and product announcements you opt into
• • Improvement: To understand how the platform is used and improve reliability and performance
• • Safety & Security: To secure accounts, prevent abuse, and ensure platform integrity
• • Analytics: To understand usage patterns and improve our services
• • Legal Compliance: To comply with applicable laws and regulations

Semantic Models, Ontologies, and Query Data

SemanticFed is a semantic layer: you describe your data with models, ontologies, metrics, relationships, and access policies, and the Platform answers queries by reaching into your sources. This shapes how personal data is handled:

• • Models describe data, they do not hold it. Semantic models and ontologies normally contain names, descriptions, and mappings rather than records about people. If you choose to put personal data into a model, a vocabulary, or knowledge-graph content (for example RDF triples that name individuals), we protect it as Customer Data under this policy and our Data Processing Addendum.
• • Query results are not kept by default. Rows returned by a federated query are streamed back to whoever ran it. They are only stored if you turn on result caching for a query, and then only for the cache lifetime you set.
• • Query history is metadata. For each query run we record who ran it, when, its status, duration, row count, a summary of the execution plan, and any error message, so you can audit access. We do not store the returned rows in this history.
• • Access policies apply first. Row-level rules, column masking, and entity-level policies you configure are enforced before results leave the Platform, so personal data you have restricted is not returned to people who should not see it.
• • Source credentials are kept apart. Credentials for your sources are held in a dedicated secrets store and referenced, never stored in the application database alongside your models.

Legal Bases for Processing (GDPR / UK GDPR)

Where the EU or UK GDPR applies, we rely on the following legal bases:

• • Contract: to create and run your account and workspaces, execute your queries, and provide support
• • Legitimate interests: to secure the Platform, prevent abuse, and understand aggregate usage so we can improve it, balanced against your rights
• • Legal obligation: to keep tax and accounting records and respond to lawful requests
• • Consent: for optional product announcements, which you can withdraw at any time

For data inside your connected sources and workspaces, your organisation is the controller and we act as its processor under our Data Processing Addendum. Requests about that data should go to your organisation first; we will help them respond. Under India's Digital Personal Data Protection Act, 2023, the same roles apply as Data Fiduciary and Data Processor.

Information Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share your information in the following circumstances:

• • With Service Providers: Payment processors, cloud storage providers, analytics services
• • Within Your Organization: Information shared among members of your workspace as needed to collaborate on shared models and sources
• • For Legal Reasons: When required by law or to protect our rights and safety
• • Business Transfers: In case of merger, acquisition, or sale of assets
• • With Consent: When you explicitly agree to share your information

Data Security

We implement industry-standard security measures to protect your information:

• • Encryption in transit with TLS, including to our databases
• • Encryption at rest for databases, backups, and object storage using AWS Key Management Service keys
• • Source credentials held in a dedicated secrets store
• • Automated vulnerability scanning of code, dependencies, and container images on every build
• • Payments handled by PCI-DSS-compliant payment providers
• • Role-based access control, workspace isolation, and audit logging of access to Customer Data

Our Security page describes our current posture, including which certifications we do and do not yet hold.

Your Rights and Choices

You have the following rights regarding your personal information:

• • Access: Request a copy of your personal data
• • Correction: Update or correct inaccurate information
• • Deletion: Request deletion of your account and associated data
• • Portability: Receive your data in a structured, machine-readable format
• • Opt-out: Unsubscribe from marketing communications
• • Consent Withdrawal: Withdraw consent for data processing where applicable
• • Objection and Restriction: Object to processing based on legitimate interests, or ask us to restrict processing while a concern is resolved
• • Complaint: Lodge a complaint with your data protection authority, or with the Data Protection Board of India

To exercise any of these rights, email [email protected] from the address on your account. We respond within 30 days and may need to verify your identity first.

Cookies and Tracking Technologies

Our website sets no advertising or cross-site tracking cookies. It keeps your theme choice in browser storage, our network provider may set a strictly necessary security cookie, and any website analytics we use are cookieless. The application stores your sign-in session so you stay signed in. Our Cookie Policy lists each item and how to control it.

Children's Privacy

SemanticFed is a business product and is not intended for children. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

International Data Transfers

SemanticFed is hosted on Amazon Web Services in the Mumbai, India region (ap-south-1), and your account data and workspace content are stored there. Some providers listed on our Subprocessors page, such as our content delivery network and international payment processor, operate in other countries. Federated queries read your sources wherever you host them and return results to you; we do not move source data to another region for storage. Where personal data from the EEA or UK is transferred to India or elsewhere, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, as set out in our Data Processing Addendum.

Data Retention

We keep information only for as long as we need it for the purposes in this policy, then delete or irreversibly anonymise it. The schedule below applies to the SemanticFed Platform:

Data stays in your own sources and is governed by your own retention rules; SemanticFed does not copy it there or keep it elsewhere. If a law or a legal claim requires us to keep something longer, we keep only what is needed for that purpose.

Updates to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes through the Platform or via email. Your continued use of SemanticFed after changes indicates acceptance of the updated policy.

Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Grievance Officer

In accordance with Information Technology Act 2000 and rules made thereunder, the name and contact details of the Grievance Officer are provided below: