Legal
Privacy Policy
Version dated 1 November 2026. Sigma is operated by 365 Sigma, Amsterdam.
1 Who is responsible
Sigma is operated by 365 Sigma, Amsterdam, the Netherlands. Chamber of Commerce number: 34366254. VAT number: NL002187295B83. Contact: service@365sigma.com. We are responsible for the personal data described in this policy. This policy covers our website, waiting list and personal leadership app, together with personal information used for Training and Nutrition when you use those services.
2 Information we process
Account information includes your name, email address, authentication information and preferences such as time zone and review rhythm.
Your content may include journal entries, reflections, uploaded pages, assessments, habits, goals, actions, decisions, maps and reviews. Associated dates, links and versions help connect your records. You choose what to record. Avoid unnecessary personal information about other people.
When you join the waiting list, we process your email address and relevant subscription and consent records. Joining the waiting list does not create a paid subscription.
We process support messages and feedback you send us. Where invitation or peer features are available, we also process relevant contact information and responses submitted by participants. The relevant feature must explain what is shared before submission. If you contact or interact with our official social-media accounts, we process the messages and information made available to us to respond and manage those interactions. The platform separately processes information under its own privacy policy. Do not submit sensitive journal content through public comments.
Technical information can include IP addresses, device and browser information, access records and error reports. For paid services, we process order, billing and transaction information needed to administer the purchase.
Device dictation may be processed by your device’s speech service under its own settings. Sigma receives the text submitted to the app. Scanning, uploads and external connections may involve additional processing explained in the relevant feature.
3 Purposes and legal bases
We process account information and your records to provide the features you request, manage access, save and connect content, display plans and reviews and administer purchases. Processing necessary for these purposes is based on performance of our agreement with you.
We use relevant account and technical information to respond to enquiries, investigate faults, prevent abuse and protect the service. Where not necessary for our agreement, these activities rely on our legitimate interests in operating a reliable and secure service, balanced against your rights.
We retain records required by applicable law and process relevant information where necessary to establish, exercise or defend legal claims. Optional marketing relies on consent where required. You can unsubscribe at any time.
Information needed to create an account or provide a requested feature is necessary for that feature to work. Optional marketing choices are not a condition of unrelated services. An additional legal condition is required where processing involves special-category information.
4 Sensitive information and consent
Reflections can reveal health information, beliefs or other sensitive information protected by data-protection law. An agreement to use Sigma does not by itself authorise all processing of that information.
Where explicit consent is the applicable condition, it must be requested separately for the specific purpose before processing begins. The request must explain the information used, the purpose, relevant sharing and how to withdraw consent. Reading this policy or accepting the Terms of Service is not a substitute for that consent.
You may withdraw consent without affecting the lawfulness of earlier processing. Where a feature cannot operate without the relevant information, withdrawal may affect that feature. Contact service@365sigma.com for help with withdrawal or deletion. Your consent does not automatically authorise processing of another person’s sensitive information.
5 AI assistance and human access
AI features may process your instructions and relevant records to generate responses, suggestions and review summaries. Outputs can include inferences about your habits or circumstances and may be incomplete or wrong. Check them against your records.
Use the source controls available in the relevant feature or account settings to manage what information is included. An AI suggestion does not remove your responsibility to decide whether it fits your circumstances.
Authorised personnel may need access to relevant information to respond to support requests, investigate faults or protect the service. Reports may quote your writing, so access to a report can reveal its underlying content. Do not assume that the service guarantees no human access.
The information presented for an AI feature must explain any additional use, including model improvement or quality review, before that use occurs. This policy does not grant blanket permission to use private content to train AI models or for unrelated purposes.
6 Recipients and international processing
We use service providers for website and application hosting, authentication, data storage, email delivery, subscription administration, AI processing, technical operations and payment processing. They receive information relevant to their role.
We may disclose information where required by law or where necessary to establish, exercise or defend a legal claim. Private content is not made public merely because you submit it to Sigma. Identifiable testimonials require a separate agreement.
Some providers may process information outside the European Economic Area. Such processing requires an applicable transfer mechanism, such as an adequacy decision or standard contractual clauses with any necessary supplementary measures. Contact service@365sigma.com for current information about recipients, processing locations and applicable safeguards, including how to obtain a copy of safeguards.
7 Cookies and device storage
The website and app use cookies or similar storage for functions such as sign-in, preferences and locally stored writing. Access and error records may also be processed to operate and secure the service.
Optional analytics or tracking must be explained and, where required, offered with a consent choice before activation. Where optional consent controls are provided, you can use them to change your choice. You can also manage browser storage through your browser settings, although disabling necessary storage may affect functionality.
Contact service@365sigma.com for information about the storage used by the service. This policy does not claim that the website uses no cookies or collects no technical information.
8 Retention and deletion
We retain personal data for as long as necessary for its purpose, considering account status, your requests, security, disputes and applicable record-keeping duties.
Account content is retained to provide your records while you use the service. Waiting-list information is retained to administer the updates you requested. Following an unsubscribe request, limited suppression or consent records may be retained where necessary to respect your choice and demonstrate compliance.
Support information is retained for the enquiry and necessary follow-up. Technical records are retained for operational and security purposes. Billing records are retained for applicable statutory accounting periods. Information needed for a specific legal claim may be retained for that claim.
Deleting a record, deleting an account and unsubscribing from emails are different actions. The existing record-trash feature provides a 30-day restore period. Account deletion is a separate process. Backup copies may expire on a separate cycle and are not a promise of continued user access. Contact us for information about the applicable retention and deletion arrangements.
9 Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction or portability of your data. You can object to processing based on legitimate interests and to direct marketing. Where processing relies on consent, you can withdraw it.
Use available account controls or email service@365sigma.com. We may request proportionate information to verify your identity. We normally respond within one month. If a lawful extension is necessary, we explain it within that first month.
You may complain to the Autoriteit Persoonsgegevens in the Netherlands at autoriteitpersoonsgegevens.nl or another competent supervisory authority, including in the country where you live or work.
10 Security, age and updates
We use measures intended to protect personal data and limit access to its purpose. No online service can guarantee absolute security. We notify authorities and affected people of breaches where legally required.
Sigma is intended for adults aged 18 and over. Contact us if you believe a child has provided personal information through an account.
We update this policy when our practices change and give additional notice where appropriate. A policy update does not replace consent where new consent is required. For questions or requests, email service@365sigma.com.